My mind is blown. Reflecting on a lifetime of getting declined filling web forms in with a wrong CC number, billing address, expiration or CCV, I...don’t think I’ve ever misspelled my name.

Trying this out on my next purchase for sure.

Fun fact (from 2012): some credit cards had more than one CCV. You could find out by simply trying all 1000 combinations on some web shops. Back then, I did security consulting and we knew a shop or two where it was possible to enumerate the CCVs without submitting an order and without being blocked.

Not sure if this is still valid nowadays, but it blew my mind as well.

Even better fun fact: There’s some issuers that won’t validate your CVV at all, so any of the 999 options work for those cards.

As a Swede, with both my CC and direct debit I'm transfered to the Swedish "Bank ID" service to do mfa with my phone using a 6+ digit code before any online purchase goes through. Kinda privacy invasive, but it's also impossible to steal money from me without these things: my card, my cvv, my phone, my phone unlock code, my bank ID code.

> impossible

Absolute quantifiers shouldn't be used in the context of cybersecurity. Yes, it's more difficult and would most likely require a SIM swap. But there are some gullible people who willfully gave their one-time code to attackers identifying as their bank after some initial groundwork had been done (calling them previously from a number identifying as their bank and warning of a fraud, the victim verifying the number is correct, the attacker calling again and redirecting them to a form requiring a validation with the code).

> impossible to steal money from me without these things

First of all, "stripe" pushes information to the BankID app asking for confirmation, there's no code to input to the site, the verification happens on my phone where I'm asked if i wanna authenticate X or Y to happen (logging in, or transferring money)

But yes, they actually saw an attack vector where people could be fake challenged at the same time they're logging in themselves if someone knows they're about to log in.

This was solved by putting a QR code on the Bank website (and others that have implemented this so far) to be scanned by the BankID app. So now to steal money you would have to pwn the HTTPS between the bank and "me" or pwn my browser, or pwn my entire machine.

Also if you get 2 BankID challenges at the same time they cancel both of them.

Anyways, point is that without my phone and my own personal code being entered after a challenge where I see who's challenging me it's impossible to get money out of my account. It's designed to be REALLY hard to be tricked into authenticating someone else.

This system doesn't care about SIM swaps because it doesn't use the carrier network for anything other than encrypted communications with the BankID service.

I don't think there's a more secure system deployed on this wide of a scale anywhere and I'm quite happy with it. It's a PITA if you lose your phone though since there's no fallback method other than getting a new smartphone.

Nitpicking on words seems a bit below the standard of discussion I want to have though, and it seems like you thought it was just SMS verification. We're not cavemen across the pond, we're people just like you.

A nice benefit of this system is that when I call my bank I'll input my social security number in the system and it'll challenge me with a BankID challenge meaning the bank person knows they're talking to me. It's useful for a lot of things and at the same time VERY privacy invasive. Also doesn't work without a connection on your phone, but we're quite connected here so it's usually fine.

CC purchases in person are not authenticated with this system, we rely on the NFC thingy or chip. Magstrip isn't used anywhere here anymore. The bank covers all fradulent NFC charges without pin entry (which is why they're limited to 40$).

If you're curious for more information about BankID they have a site: https://www.bankid.com/en/ I think it's owned as a collab between "all" Swedish banks.

We also have electronic mail via a system called "Kivra" that the government will send mail through to me so that i don't have to rely on someone not dropping my mail. Also privacy invasive of course, but quite convenient.

> If you're curious for more information about BankID they have a site: https://www.bankid.com/en/ I think it's owned as a collab between "all" Swedish banks.

I'm not sure if it's the same technology as in Norwegian banks:

https://link.springer.com/chapter/10.1007/978-3-540-85230-8_...

Paywalled paper from 2008 or am I missing something?

It turns out they are not the same thing[0], they just share the same name. The one you use in Sweden is different from the one in Norway that was cracked already in 2008 (and fixed somehow since then). I'm sure the one in Sweden will show its weaknesses sooner or later, all these systems do.

Actually, it looks like some scammers have already exploited it using a variant of the method I've already described above[1].

[0] https://en.wikipedia.org/wiki/Talk:BankID

[1] https://www.thelocal.se/20220117/foreign-citizens-in-sweden-...

Sorry, wrong link in [1]:

https://www.thelocal.se/20180813/millions-of-kronor-stolen-i...

Since then banks (at least my bank) has changed so that the Bank presents a QR code which I scan with the BankID app, meaning there's no "prewriting my social security number for a challenge".

Also, even if I authenticate someone to my bank account they're unable to transfer money out of my own accounts without me approving a transaction, where the BankID app will show me the amount and the destination for the money.

So this issue is mostly solved as we move towards the QR code thing and people stop giving their money away. It's impossible to fix layer 8, if someone "willfully" gives their money away it's their fault when the UX is as good at preventing this as it actually is.

Someone could be tricked into giving their money away in person or by other means, look at Theranos, Nikola (I would argue anything Elon Musk touches too) and the likes. They're also scammers. I didn't invest in Theranos or Nikola because i called bullshit directly, same same but different. My colleague tried to get me in on "Onecoin", he walked away with a loss and I didn't because I called the bluff straight away.

What I'm trying to say is, the system isn't insecure at all. There are many failsafes people have to ignore to get scammed.

Wouldn't there be 1000 options?

From my own experience, the only required part of the address is the zip code as it's used for verification.

However, some services go out of their way to check if the address you entered exists and is valid, but that has nothing to do with Visa or MC.

This was a really frustrating experience moving into a new townhouse as the first-ever occupant. It took nearly three years for the city's property records to be correct and propagate everywhere. We couldn't even pay our property taxes at first, and the US Postal Service would not process my move request, insisting my address did not exist, in spite of me being physically in the house.

I discovered this when I accidentally left an autofilled "Soatok Dreamseeker" instead of [redacted legal name] and it... just worked.

Many do validate the address or at least postal code, however, although American Express doesn’t appear to in my experience. I assume it also depends on the issuer for Visa/Mastercard considering many have their own two-factor verification portal.

Note - AMEX does verify cardholder name. In my original comment I am referring only to VISA/MC. They do not verify cardholder name. They do, however, verify other things related to address, etc.

Even for Visa/Mastercard, this seems to depend on the issuer to some extent. Issuing banks often handle two-factor fraud portals (Verified by Visa, etc.) differently, and these portals are increasingly common especially in much of Europe and other regions. As you noted, American Express typically seems to depend on the name but not the address.

Is this real?