4 ms·

Amex is already legally responsible for fraudulent charges on your card, so if they want to make the numbers predictable, why not?

• jjeaff 4y ago
  Actually, the merchants are fully responsible for fraudulent charges. So Amex has little incentive to be secure.
  • iancarroll 4y ago
    It’s not really that simple, and it’s likely that these attacks would fail CVV/3DS/etc, so it’d be hard for a reasonable merchant to be tricked regardless.
    • tyingq 4y ago
      "I also determined that the CSC (essentially behaves like a CID or CVV2 on the magstripe) for a lost or stolen card continues to work for a newer, predicted card. An attacker would be able to use a stolen card's CSC with the predicted card number and expiration to make actual purchases." Also...ask any merchant if they've ever NOT been left holding the bag for a fraudulent purchase. The only time that happened for me was when I could prove it was fraud by the actual cardholder, and even then, the banks would often deny the counterclaim anyway.