To obtain card details, the attack uses online payment websites to guess the data and the reply to the transaction will confirm whether or not the guess was right.
Different websites ask for different variations in the card data fields and these can be divided into three categories: Card Number + Expiry date (the absolute minimum); Card Number + Expiry date + CVV (Card security code); Card Number + Expiry date + CVV.
Because the current online system does not detect multiple invalid payment requests on the same card from different websites, unlimited guesses can be made by distributing the guesses over many websites.
However, the team found it was only the VISA network that was vulnerable.
“MasterCard’s centralised network was able to detect the guessing attack after less than 10 attempts – even when those payments were distributed across multiple networks,” says Mohammed.
At the same time, because different online merchants ask for different information, it allows the guessing attack to obtain the information one field at a time.
Mohammed explains: “Most hackers will have got hold of valid card numbers as a starting point but even without that it’s relatively easy to generate variations of card numbers and automatically send them out across numerous websites to validate them.
“The next step is the expiry date. Banks typically issue cards that are valid for 60 months so guessing the date takes at most 60 attempts.
“The CVV is your last barrier and theoretically only the card holder has that piece of information – it isn’t stored anywhere else.
“But guessing this three-digit number takes fewer than 1,000 attempts. Spread this out over 1,000 websites and one will come back verified within a couple of seconds. And there you have it – all the data you need to hack the account.”
An online payment – or “card not present” transaction – is dependent on the customer providing data that only the owner of the card could know.
But unless all merchants ask for the same information then, says the team, jigsaw identification across websites is simple.
So how can we keep our money safe?
“Sadly there’s no magic bullet,” says Newcastle University’s Dr Martin Emms, co-author on the paper.
“But we can all take simple steps to minimise the impact if we do find ourselves the victim of a hack. For example, use just one card for online payments and keep the spending limit on that account as low as possible. If it’s a bank card then keep ready funds to a minimum and transfer over money as you need it.
“And be vigilant, check your statements and balance regularly and watch out for odd payments.
“However, the only sure way of not being hacked is to keep your money in the mattress and that’s not something I’d recommend!”