PCI DSS is the widely known and implemented industry standard for defining bare-minimum security measures that should be taken when handling sensitive banking data such as credit cards. It's the layer of security to available data when an account is breached, or somehow the credit card data is taken by a third party, it ensures the data is not fully available to the attacker, by restricting storage of some data by the entities, limiting the digits visible on the UI's, receipts, logs and anywhere else by masking.

+------------------------------------+
|                                    |
|  1234 56** **** 7890               |
|                                    |
|  VALID THRU                        |
|  08/29                             |
|                                    |
|  METIN OZYILDIRIM                  |
+------------------------------------+
    

What you can actually show with PCI-DSS 4

• Primary Account Number (PAN) - PAN is masked when displayed. The BIN and Last 4 digits can be displayed
• Cardholder Name - As is
• Service Code - As is
• Expiration Date - As is

What you can't show

• Full Track Data
• Card verification code
• PIN/PIN Block

As a consumer, I thought I was safe; when saving my credit card to a billion dollar valued european merchant, or when i purchase something from supermarket and ignore the receipt, but the reality is slightly different from that.

Story Time

Or, i thought so. Later that day, around 6 hours later than the initial breach, I suddenly got 3-4 3D Secure SMS attempts from different merchants, that i didn't use. All unsuccessful attempts, but the data from here is valuable for understanding how it happened.

After couple of minutes, while i'm on a call with my bank to disable that card completely, they used another merchant, without 3D Secure; this time withdrawing all available limit (which i reduced) with multiple payments. This time the money is withdrawn to a e-wallet of a market, which allows you to withdraw the amount in cash from that market.

Honestly I'm impressed, this is a well designed pipeline, with more untraceability than i expected. At the end, after my chargeback request, i got the money back from my bank. But what exactly happened?

How did they do it?

The data they took with the attempt of purchase is the card is still usable (not cancelled), the bank name (from the 3D secure page), my masked credit card number and the full expiration date. Normally for a purchase to complete from my card seamlessly, they should have the full PAN number (16 digit one), the expiration date, the CVC2 number, my phone used for 3D Secure etc. They don't have all of these details, or i thought so.

The PAN Number

PANs have a certain level of internal structure and share a common numbering scheme set by ISO/IEC 7812. The parts of the number are as follows:

• a six or eight-digit Issuer Identification Number (IIN)
• a variable length (up to 12 digits) individual account identifier
• a single check digit calculated using the Luhn algorithm

But my card and bank doesn't allow merchants to proceed with payments using only the credit card number, they should at least use PAN, Expiration date and the CVV altogether. Some banks and payment gateways can process payments only using a credit card number, that's another unbelievable point for me. My bank rejects the payments without these required values, but you know what, it also tells you which part of the data was faulty. The response codes from payment gateways, are something like that

• That's not a valid credit card
• That card is expired
• You got all the details right but CVV is not correct

So in practice, the attackers tested at rate of 6 request per second (around 2 request per second per API). That rate is very hard to spot from the merchants perspective, as the source ip's are changing via proxies, the credit card numbers are not same as the nature of the brute forcing and the very small rate of requests.

And it turns out there's also a list of merchants who are exempt from 3D Secure stuff. So they are deemed friendly by the bank, and can take payments and subscriptions without 3D Secure, which in turn they get the liability in case of chargebacks.

It was my fault to use unsafe passwords, but the PCI DSS is not only for e-commerce, it also standardizes the information to disclose on physical receipts. It happened to me because of a breached account and it can happen to you because you throw a receipt to a bin without destroying it.

What happened next?

I talked to the merchant about how their credit card to cash system is used withdraw money from my credit card without my authorization, they didn't care. Instead asked me to contact my bank.

I contacted the e commerce website in question about how exposing 10 letters of credit card along with the expiration date makes it easier. They didn't accept it as an vulnerability, instead they said they designed it intentionally to match the standard (PCI DSS 3 and 4).

Then i got curious and explained the situation to people that write payment API's and work in the payments industry, they didn't even got surprised; instead they told me there are merchants that can do transactions even without expiration date. It seems like to me, everybody knows it. The people creating gateways, the engineers, the hackers.

This happened last year, and since then the party that converts payments from credit cards to cast, is no longer doing that without 3d secure. My bank still has a generous rate limit for brute forcing CVC2 that temporarily blocks use of that card for like couple of minutes.

References