Cross wiring user data is always a bad bug. Especially when it has to deal with payments and credit card data. I hope this is a very rare thing and they find the cause quickly. Could be in user authentication, the payment card tokens, or one of any numbers of things. My bet would be on Auth.
Went to update payment info, showed me some random person’s credit card info
11–15 of 15 posts
Re: Went to update payment info, showed me some random person’s credit card info
#12Earlier quoted context omitted.
I really wish they had multi-factor authentication like bank transfers have. The only credit-cards that I use are prepaid ones, for the reason you just mentioned.
Confirming online debit and credit card payments with a one-time password has become a standard practice in the EU. These solutions are also available in the US, are they not being adopted by banks there? https://usa.visa.com/pay-with-visa/featured-technologies/ver... https://www.mastercard.us/en-us/consumers/payment-technologi...
It's not just in Europe, even here in West Africa OTPs (and hardware tokens) have been standard practice for years. I always feel weirdly unsafe interacting with US-based companies/payment processors.
Re: Went to update payment info, showed me some random person’s credit card info
#13Should not this incident involve PCI in some way?
PCI requires a forensic investigation after a breach occurs. (Further requirements may exist, I am not an auditor etc.)
Re: Went to update payment info, showed me some random person’s credit card info
#14Earlier quoted context omitted.
I really wish they had multi-factor authentication like bank transfers have. The only credit-cards that I use are prepaid ones, for the reason you just mentioned.
They do in Europe. Since 9/13 it is mandatory for online transactions with some exceptions. The implementation is up to the bank, so can take different forms. In my case my bank has an app which will show the transaction and I can then accept/reject. My mom's bank's implementation looks very much like TOTP though I haven't investigated if it is. Transactions at a POS use a PIN.
Here in Poland there is also an instant electronic transfer called BLIK, where you confirm the payment as well. What is sent is a temporary numeric code to the terminal (it can be typed in as well as sent over NFC or QR code) and it is similar to automatic escrow. Disputes work differently depending on the bank though.
And in some banks they're starting to roll out OTP 3D Secure etc. confirmations even for PoS terminals above certain value. Most terminals support it, it's just a hold on transaction.
Re: Went to update payment info, showed me some random person’s credit card info
#15Earlier quoted context omitted.
I really wish they had multi-factor authentication like bank transfers have. The only credit-cards that I use are prepaid ones, for the reason you just mentioned.
If it’s prepaid, is it then a credit card anymore? I believe this is relevant with respect to much of the protection you have from using a credit card (chargebacks etc)
Well, there's Revolut not quite prepaid virtual debit cards.
Some banks offer temporary card numbers as a premium feature.