Fraudsters can take as little as six seconds to guess the details needed to hack a Visa debit or credit card, research has found.
Experts from Newcastle University said it was “frighteningly easy” to do with a laptop and an internet connection.
The hackers use a so-called Distributed Guessing Attack to get around the online security features.
It may have been the method used in the recent Tesco Bank hacking scam, which affected 9,000 customers and cost £2.5m.
The researchers found even if the cyber criminals made multiple – and unsuccessful – attempts to get payment card data, their efforts would not be detected.
It meant the scammers could systematically fire up different variations of security data at hundreds of websites simultaneously and, within seconds, the criminals could use a process of elimination to verify, via computer, the correct details of a card.
PhD student Mohammed Ali said: “This sort of attack exploits two weaknesses that, on their own are not too severe, but, when used together, present a serious risk to the whole payment system.
“Firstly, the current online payment system does not detect multiple invalid payment requests from different websites.
“This allows unlimited guesses on each card data field, using up to the allowed number of attempts – typically 10 or 20 guesses – on each website.
“Secondly, different websites ask for different variations in the card data fields to validate an online purchase. This means it’s quite easy to build up the information and piece it together like a jigsaw.
“The unlimited guesses, when combined with the variations in the payment data fields make it frighteningly easy for attackers to generate all the card details one field at a time.
“So even starting with no details at all other than the first six digits – which tell you the bank and card type and so are the same for every card from a single provider – a hacker can obtain the three essential pieces of information to make an online purchase within as little as six seconds.”
Responding to the study findings, Visa said: “The research does not take into account the multiple layers of fraud prevention that exist within the payments system, each of which must be met in order to make a transaction possible in the real world.
“Visa is committed to keeping fraud at low levels and works closely with card issuers and acquirers to make it very difficult to obtain and use cardholder data illegally.
“For consumers, the most important thing to remember is that if their card number is used fraudulently, the cardholder is protected from liability.”
The study was published in the academic journal IEEE Security & Privacy.
Days Of Our Lives actor Jay Pickett dies on set
U.K. eases COVID-19 travel restrictions as industry lobbies for more
Death toll triples to more than 300 in recent China flooding
Canada advances to women’s soccer final with 1-0 win over United States
Obstruction to Beirut blast probe ‘shameless’: Amnesty International
Weird6 days ago
Meet the completely tattooed Brazilian who removed his nose, added horns and reshaped his ears to resemble an ‘orc’
Europe6 days ago
Three Armenian soldiers killed in clashes with Azerbaijan: Armenian defense ministry
Europe6 days ago
UK’s PM Johnson in talks with US on COVID-19 travel corridor
Health6 days ago
COVID-19 linked to ‘significant’ drop in intelligence: research
Middle East7 days ago
Iran hits record for new COVID-19 cases for second day running
Africa6 days ago
Tunisia reassures EU, UN, Turkey after its president froze parliament
North America4 days ago
Canadian women’s eight crew win Olympic rowing gold for the first time since 1992
Weird6 days ago
Egyptian impersonated a doctor and practiced the profession for 12 years