4 ms·
In their statement they deny accessing bank details: > The bug led to random user data being exposed to the wrong user when accessing our user interfaces. It i
by dvaun 5y ago
In their statement they deny accessing bank details:
> The bug led to random user data being exposed to the wrong user when accessing our user interfaces. It is important to note that the access to data has been entirely random and not showing any data containing card or bank details (obfuscated data was visible). This means that it has been impossible to access a specific user’s data.
This is not the experience of the user in the OP: https://twitter.com/esraefe/status/1397843949985931265 https://twitter.com/esraefe/status/1397843949985931265
- hbosch 5y agoI believe it is the case, that when you see your stored payment method is is obfuscated such that it only reveals the last 4-5 digits. Same with bank details as far as I know. However, showing the card issuer/bank + the final 4 or 5 digits of an account or card number is still extremely distressing. There are some services and vectors out there that can be engineered with just that information for sure. Combine that with possibly exposed address, telephone number, and you are in very dangerous territory.
- shkkmo 5y agoIt might be accurate if you are internally discussing PCI compliance. However, to the layperson, "bank details" definitely includes name of bank and last 4 digits of account number. It does come across as deceptive to use that terminology to respond to customer complaints.