9 ms·

Token ABCD is associated to the card number 0123 on the bank's backend.

• kemotep 2y ago
  But from the article and the quote it says that after a new card is issued, the code ABCD (which 0123 generates in the digital wallet) is actually associated with the new card number on the backend. I think that the article is trying to say is that the digital wallet automatically updates to the new card with no additional authentication mechanism? That’s the vulnerability here, if I understand correctly. Once an attacker can associate a stolen card with a digital wallet, the victim can cancel that card and get a new one issued but the attacker still retains access because purchases are done with the virtual token which is mapped on the backend. As long as you have the right virtual token, the bank will map that to the correct account. Like this is a serious issue with digital wallets if true. The advice at the end of the article is key then: > turn on email notifications when a card is added/removed from the wallet, turn on transaction alerts for credit cards, regularly check credit card statements and review devices linked to credit cards through the bank's web portal or mobile app account settings.
  • stavros 2y ago
    They mean a subscription, you cancel your card and get a new one, but the attacker's fraudulent subscription continues on the new card.
    • kemotep 2y ago
      The bank issuing a new card absolutely should kill all ongoing transactions and require them to be updated. Only an attacker with persistent access would be able to do that if all previously authorized transactions are prevented from completing using outdated information. It’s a real shame the US lags in this.
      • stavros 2y ago
        I don't know if it's lag, I think it's prioritizing the business' recurring revenue over the consumer's control.