Bypass With Wrong Cvv Of Debit Card And Getting OTP


Answer :

But shouldn't it suppose verify before I get the OTP? What's the reason, Isn' it a security issue?

This is absolutely NOT a security issue! quite the opposite it's a protection.

Lets go through the steps.

  1. You put in card details.
  2. You put in CVV
  3. You put in the OTP.

The payment is processed if and only if the combination of all of it are correct.

Now assume a scenario where it tell's you the CVV is wrong before the 2FA that is just going to simply give the attacker a chance to better attack.Now the attacker knows the CVV is wrong and can simply change that.While in the correct scenario attacker will have to break 2 Factor authentication to gain that information


As well as the general rule of not giving the attacker information by rejecting too early, there are some things specific to the payment industry which are somewhat relevant.

Although often presented to the customer as mandatory, the authentication information on a payment is generally used to evaluate risk and to assign liability.

For instance:

  • A payment with no CVV provided at all may be accepted by the issuing bank, but if challenged as fraudulent, the merchant will be liable for the refund. If the payment had been fully authenticated, the card scheme or issuer will assume that liability instead.
  • A payment with an incorrect CVV but correct address, interactive one-time password, and order details consistent with previous behaviour may be accepted as "low risk" by a fraud scoring system.

The reduction of security in both cases is traded for the convenience to the customer. The new version of 3-D Secure (branded as "Visa Secure" and "MasterCard ID Check") is explicitly designed around this idea, with a large amount of automated information capture up-front meaning that interactive authentication will simply be skipped if the transaction is already considered low-risk. The CVV entered is now just one piece of data in this complex analysis.


Developer here. I have worked with a couple systems that send OTP's. Neither required the CVV in order to send it.

As per Vipul Nair's answer, it is good practice to not let an attacker know some input is wrong until the end, so as not to leak what might be wrong. I'd like to add that usually online shops may keep your PAN and other data in their databases, but they are not allowed (by law or by the card issuer) to store your CVV. In some (not all) cases it is the store that sends an OTP, so they would not have a way to validate with your CVV anyway.


Comments

Post a Comment

Popular posts from this blog

Converting A String To Int In Groovy

Answer : Use the toInteger() method to convert a String to an Integer , e.g. int value = "99".toInteger() An alternative, which avoids using a deprecated method (see below) is int value = "66" as Integer If you need to check whether the String can be converted before performing the conversion, use String number = "66" if (number.isInteger()) { int value = number as Integer } Deprecation Update In recent versions of Groovy one of the toInteger() methods has been deprecated. The following is taken from org.codehaus.groovy.runtime.StringGroovyMethods in Groovy 2.4.4 /** * Parse a CharSequence into an Integer * * @param self a CharSequence * @return an Integer * @since 1.8.2 */ public static Integer toInteger(CharSequence self) { return Integer.valueOf(self.toString().trim()); } /** * @deprecated Use the CharSequence version * @see #toInteger(CharSequence) */ @Deprecated public static Integer toInteger(String self) { return toInteg
Read more

"Cannot Create Cache Directory /home//.composer/cache/repo/https---packagist.org/, Or Directory Is Not Writable. Proceeding Without Cache"

Answer : if anyone pass through here, this is shorter solution: sudo chown -R $USER $HOME/.composer it seems to me the group information is missing in your command sudo chown -R <user> /home/<user>/.composer/cache/repo/https---packagist.org Shoud be sudo chown -R <user>:<group> /home/<user>/.composer/cache/repo/https---packagist.org But to avoid other permission issues, I would rather advise: sudo chown -R <user>:<group> /home/<user>/.composer/cache (you'll need access to other folders in there) and sudo chown <user>:<group> /home/<user>/.composer To make sure your user has permissions enough on the global composer folder. Mind the missing recursion so the user don't own keys created by root. If you need to find out the group: groups <user>
Read more

Android How Can I Convert A String To A Editable

Answer : As you probably found out, Editable is an interface so you cannot call new Editable() . However an Editable is nothing more than a String with Spannables, so use SpannableStringBuilder: Editable editable = new SpannableStringBuilder("Pass a string here"); If you only want to change the Spannables, never the text itself, you can use a basic SpannableString. Use Editable.Factory.getInstance().newEditable(str) From the android documentation: Returns a new SpannedStringBuilder from the specified CharSequence. You can override this to provide a different kind of Spanned.
Read more