Visa payment card details guessed in seconds by hackers, claims study
Cyber crooks can use computers to make multiple attempts to get confidential data without their illicit efforts being discovered.
Friday 2 December 2016 11:19, UK
Fraudsters can take as little as six seconds to guess the details needed to hack a Visa debit or credit card, research has found.
Experts from Newcastle University said it was "frighteningly easy" to do with a laptop and an internet connection.
The hackers use a so-called Distributed Guessing Attack to get around the online security features.
It may have been the method used in the recent Tesco Bank hacking scam, which affected 9,000 customers and cost £2.5m.
The researchers found even if the cyber criminals made multiple - and unsuccessful - attempts to get payment card data, their efforts would not be detected.
It meant the scammers could systematically fire up different variations of security data at hundreds of websites simultaneously and, within seconds, the criminals could use a process of elimination to verify, via computer, the correct details of a card.
PhD student Mohammed Ali said: "This sort of attack exploits two weaknesses that, on their own are not too severe, but, when used together, present a serious risk to the whole payment system.
"Firstly, the current online payment system does not detect multiple invalid payment requests from different websites.
"This allows unlimited guesses on each card data field, using up to the allowed number of attempts - typically 10 or 20 guesses - on each website.
"Secondly, different websites ask for different variations in the card data fields to validate an online purchase. This means it's quite easy to build up the information and piece it together like a jigsaw.
"The unlimited guesses, when combined with the variations in the payment data fields make it frighteningly easy for attackers to generate all the card details one field at a time.
"So even starting with no details at all other than the first six digits - which tell you the bank and card type and so are the same for every card from a single provider - a hacker can obtain the three essential pieces of information to make an online purchase within as little as six seconds."
Responding to the study findings, Visa said: "The research does not take into account the multiple layers of fraud prevention that exist within the payments system, each of which must be met in order to make a transaction possible in the real world.
"Visa is committed to keeping fraud at low levels and works closely with card issuers and acquirers to make it very difficult to obtain and use cardholder data illegally.
"For consumers, the most important thing to remember is that if their card number is used fraudulently, the cardholder is protected from liability."
The study was published in the academic journal IEEE Security & Privacy.