{
    "success": true,
    "data": {
        "id": 2038239,
        "msgid": "new-scam-uses-apps-to-hack-credit-cards-without-an-otp-1792025427",
        "date": "2026-10-15 07:05:00",
        "title": "New Scam Uses Apps to Hack Credit Cards Without an OTP",
        "author": "",
        "source": "CNBC",
        "tags": "",
        "topic": "Finance",
        "summary": "A new fraud scheme has enabled criminals to make QR-code payments using victims\u2019 credit cards through digital-wallet apps without triggering one-time-password verification. Cyber-security expert Alfons Tanujaya says the attackers may have obtained full card details, while banks\u2019 risk systems and payment-app controls can both fail to flag transactions as suspicious.",
        "content": "<p>Jakarta, CNBC Indonesia \u2014 A new fraud scheme has recently emerged,\nallowing criminals to hack credit cards without using the additional\nsecurity layer of a one-time password (OTP).<\/p>\n<p>Victims have found transactions charged to their credit cards for\nQR-code payments made through a digital-wallet app. They say they did\nnot make the payments and had not linked their credit cards to the\nwallet service.<\/p>\n<p>Cyber-security expert Alfons Tanujaya said the perpetrators may\nalready have had the victims\u2019 credit-card details, including the card\nnumber, expiry date, CVV and cardholder\u2019s name.<\/p>\n<p>To carry out the fraud, the perpetrators first test the cards with\nrepeated transactions of Rp 0. They then use the cards for transactions\nthat can be converted into cash or value, such as cryptocurrency top-ups\nor e-commerce purchases.<\/p>\n<p>Alfons\u2019s findings indicate that these transactions can be made\nwithout an OTP. The code would normally be sent to the cardholder\u2019s\nmobile phone when a transaction using a service is attempted.<\/p>\n<p>In these cases, however, no OTP reached the victims\u2019 phones. Alfons\nexplained that OTPs are not sent for every transaction, but only in\ncertain circumstances or for transactions above particular amounts.<\/p>\n<p>This also means the perpetrators do not need to break into victims\u2019\ndigital-wallet accounts: they already have the necessary credit-card\ndetails.<\/p>\n<p>Whether an OTP is required is also linked to the issuing bank\u2019s\nrisk-management system. If a transaction is judged safe, it may be\napproved without additional security verification.<\/p>\n<p>\u201cTransactions that go through without an OTP are transactions the\nissuing bank\u2019s risk system has deemed \u2018safe\u2019 \u2014 and that assessment is\nwrong. Responsibility is shared: both the issuing bank\u2019s risk system and\nthe payment app\u2019s controls have allowed them through,\u201d Alfons said.<\/p>\n<p>Alfons also outlined several possible sources of credit-card data\nleaks:<\/p>\n<ul>\n<li><p><strong>Infostealer malware:<\/strong> A victim\u2019s device is\ninfected with data-stealing malware that can capture card details saved\nin a browser\u2019s autofill, passwords and cookies.<\/p><\/li>\n<li><p><strong>Web skimming:<\/strong> Malicious scripts planted on\ncertain websites record card details as users enter them.<\/p><\/li>\n<li><p><strong>Phishing:<\/strong> Fake websites impersonating\npromotions, delivery companies or banks trick victims into entering\ntheir card details.<\/p><\/li>\n<li><p><strong>Third-party breaches:<\/strong> Data may be exposed within\nthe payment-processing chain.<\/p><\/li>\n<\/ul>",
        "url": "https:\/\/jawawa.id\/newsitem\/new-scam-uses-apps-to-hack-credit-cards-without-an-otp-1792025427",
        "image": ""
    },
    "sponsor": "Okusi Associates",
    "sponsor_url": "https:\/\/okusiassociates.com"
}