New Scam Uses Apps to Hack Credit Cards Without an OTP

Jakarta, CNBC Indonesia — A new fraud scheme has recently emerged, allowing criminals to hack credit cards without using the additional security layer of a one-time password (OTP).

Victims have found transactions charged to their credit cards for QR-code payments made through a digital-wallet app. They say they did not make the payments and had not linked their credit cards to the wallet service.

Cyber-security expert Alfons Tanujaya said the perpetrators may already have had the victims’ credit-card details, including the card number, expiry date, CVV and cardholder’s name.

To carry out the fraud, the perpetrators first test the cards with repeated transactions of Rp 0. They then use the cards for transactions that can be converted into cash or value, such as cryptocurrency top-ups or e-commerce purchases.

Alfons’s findings indicate that these transactions can be made without an OTP. The code would normally be sent to the cardholder’s mobile phone when a transaction using a service is attempted.

In these cases, however, no OTP reached the victims’ phones. Alfons explained that OTPs are not sent for every transaction, but only in certain circumstances or for transactions above particular amounts.

This also means the perpetrators do not need to break into victims’ digital-wallet accounts: they already have the necessary credit-card details.

Whether an OTP is required is also linked to the issuing bank’s risk-management system. If a transaction is judged safe, it may be approved without additional security verification.

“Transactions that go through without an OTP are transactions the issuing bank’s risk system has deemed ‘safe’ — and that assessment is wrong. Responsibility is shared: both the issuing bank’s risk system and the payment app’s controls have allowed them through,” Alfons said.

Alfons also outlined several possible sources of credit-card data leaks:

• Infostealer malware: A victim’s device is infected with data-stealing malware that can capture card details saved in a browser’s autofill, passwords and cookies.

• Web skimming: Malicious scripts planted on certain websites record card details as users enter them.

• Phishing: Fake websites impersonating promotions, delivery companies or banks trick victims into entering their card details.

• Third-party breaches: Data may be exposed within the payment-processing chain.