5 ms·
It's been known since 90s for plain ccns, and, well, about two years after CVC got phased in they were also broken. Besides once you submit both somewhere, you'
by lstodd 4y ago
It's been known since 90s for plain ccns, and, well, about two years after CVC got phased in they were also broken. Besides once you submit both somewhere, you're potentially toast. 2 factor auth without, or better with disposable CC numbers is the only solution.
It's just that AR only now caught up to the usual fraud level.
- TedDoesntTalk 4y agoOriginally CVCs were intended to prove that you had physical possession of the card (before chips and NFC). Now it is required everywhere for every purchase.
- Nursie 4y ago> Now it is required everywhere for every purchase. That very much breaks the rules, and I can't say I've ever had to use it outside of customer-not-present purchases, in around 30 countries I've used cards in. Where are you that this happens? Is this something that people are doing when processing magnetic stripe transactions in places where that's still supported?
- CryptoBanker 4y agoIt’s required for almost all online transactions in the United States. Amazon is one of the notable exceptions
- Nursie 4y agoOnline, sure. That’s the whole point of it. The post I replied to implied it went further than that.
- TedDoesntTalk 4y agoI suppose you are right now that i think about it more closely. If I’m present for the transaction and using the card, I’m using chip or NFC, so no one bothers to ask for the CVC. They know I have physical possession of the card and that it’s not a fake because NFC and chips are too hard to fake?
- Nursie 4y agoBasically yes, but I still find it unusual (having worked in the industry) if you were ever asked for it in a customer-present situation, because the whole point was that it was for not-present situations. But then I find many things about payments unusual, like the longevity of mag-swipe in the US in the face of much better tech… I’m happy not to really be in that world any more :)
- TedDoesntTalk 4y ago> the longevity of mag-swipe in the US Yes, it was strange. My guess is it was simply related to cost: cost of replacing hundreds of millions of POS terminals and hundreds of millions of plastic cards by snail mail. Perhaps it was easier in countries with a smaller population and/or fewer merchants because the scale was just smaller.
- Nursie 4y agoI did hear that way-back-when, and that the relative power of the retailers vs the banks and networks was fundamentally different in the US, so it couldn't easily be imposed.