Six seconds to hack a credit card

[Kevin Lancaster]

Six seconds to hack a credit card

New research reveals the ease with which criminals can hack a bank account without any of the card details.

 

[Kosmik]

Hmmm, surely the credit provider should be able to detect multiple requests against a number within a short timespan?

Also 3D secure?

 

[backstreetboy]

Six seconds to hack a Visa credit or debit card.

.

 

[faniebraai]

And this is why "card not present" merchants should be avoided by customers. If the banks can't get their merchants to comply to 3DSecure, customers should just stop using those merchants.

Then again, there is no real risk to the customer here. Because Card-Not-Present transactions are so insecure, simply disputing the purchase to get your money back is "easy enough" (depending on the bank).

This risk just highlights to banks to enforce 3DSecure more stringently, and shows how ineffectively their fraud systems are.

 

[ajan]

.

How is mastercard different for online purchases? Do they force merchants to use OTP?

 

[faniebraai]

How is mastercard different for online purchases? Do they force merchants to use OTP?

if you read the article, you would've seen that the hacker said it doesn't work so well for MasterCard as MC detects the phishing attempt, so they only have like 10 tries.

 

[Valerion]

Hmmm, surely the credit provider should be able to detect multiple requests against a number within a short timespan?

Also 3D secure?

I've never been asked for 3D secure on a non-SA merchant. Amazon, Kickstarter, Google, etc just charge the card.
This study is aimed at more than just SA.

 

[faniebraai]

I've never been asked for 3D secure on a non-SA merchant. Amazon, Kickstarter, Google, etc just charge the card.
This study is aimed at more than just SA.

Good point. The 3DSecure system is run out of BankservAfrica. Banks in SA register their cards (or the BINs rather) for 3DSecure at BankservAfrica. eCommerce payments are then routed from the Payment Service Provider to Bankserv to get authentication, which is then passed through to the issuing bank.

That's why you don't get the 3DSecure page on international merchants.

 

[Kosmik]

I've never been asked for 3D secure on a non-SA merchant. Amazon, Kickstarter, Google, etc just charge the card.
This study is aimed at more than just SA.

Actually I have recently. Humble bundle and CDKeys with paypal both asked for 3D secure so it's no longer just a SA thing.