Credit cards are vulnerable to brute force kind attacks

Re:Credit cards are vulnerable to brute force kind attacks by julienchastang on Friday May 01, 2026 @05:13PM (#47980423)

Related story and wondering if the OP may have been chasing red herrings. I recently noticed an unauthorized charge for a small amount on my credit card (something about FB/Meta). Likely someone probing the card to see if anyone would notice. I called the CC company, had them removed the charge, canceled the card and had them send me a new card (5-7 business days). With the brand new unused card (new CC number, new expiration date, new CVV), the fraudulent payments resumed (again FB/Meta). How is this possible? The reason: digital wallets. Your credit card number, etc. transfers via digital wallets even when you cancel the card. I again called the credit card company and this time, told them to cancel all the digital wallets (there were 99 of them!). There is no way to do this online. You have to speak to a human in a call center. You then have to sit through a lecture about how all your renewing payments are going to reset and you will have to re-establish them will all merchants. "Yes, I understand that. Please cancel the card and all digital wallets!" Then you have to hold for twenty minutes (why? what are they doing? manually canceling all the digital wallets?). The lesson I learned here is that canceling your credit card may not be what you think. Also recurring payments must be incredibly lucrative and canceling them must amount to a big loss in revenue. (Edited for grammar.)

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by cj on Friday May 01, 2026 @05:25PM (#47980584)

I’m not sure about “digital wallets”, but the concept of updating credit card details after a new card is issued does exist, and it’s a service offered by credit card companies.

Blog post from Stripe:

https://stripe.com/resources/more/what-is-a-card-account-upd...

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by resonantjacket5 on Friday May 01, 2026 @06:10PM (#47981075)

it's called automatic billing updaters.

Visa: Visa Account Updater (VAU) https://developer.visa.com/capabilities/vau Mastercard: Automatic Billing Updater (ABU)

it worked fine for sometime, but the problem is that now the stolen credentials are being refreshed now as well.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by lxgr on Friday May 01, 2026 @07:02PM (#47981495)

Ideally, the issuer is able to investigate what type of fraud exactly happened on the card, and in case of a suspected compromised card number they can choose to simply not perform account updates or carry over tokens to the new card.

Practically, it's of course not that simple or clear-cut. As most things in payments, this too is a trade-off of cardholder inconvenience, support effort, fraud losses etc.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by SkiFire13 on Friday May 01, 2026 @05:43PM (#47980802)

There are also "network tokens" that allow you to skip this step and instead remain linked to the new credit card when it changes.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by thechao on Friday May 01, 2026 @06:57PM (#47981461)

I discovered this "quirk" when the local ice rink started charging me for dozens of charges — I was watching them come in. There were two "child2 thechao"s (insert crazy common name); and ... they just picked one and started charging. They didn't want to reverse the charges because the mom of child2 didn't want to pay.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by Denvercoder9 on Friday May 01, 2026 @05:57PM (#47980952)

Indeed, I suspect that's what went on here. I don't think there even exist 99 providers of what's customary called a digital wallet (e.g. Apple/Google Pay), and there's no definitely no single person that uses 99 of them.

It's bad service from GP's card company though, with network tokens they should be able to see which specific token was abused, and revoke just that one.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by cogogo on Friday May 01, 2026 @06:11PM (#47981079)

Interesting. I recently cancelled and reordered a card and I have still been able to make purchases via Amazon without ever making an update. In this case I am happy about it because I am lazy but had no idea how it was working. Presume this is what is going on.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by rconti on Friday May 01, 2026 @06:09PM (#47981064)

Yep. I've been able to use the "wrong" (but still valid) expiration date on my AmEx for a long time. I've had other credit cards where the autopay info was never updated and it just kept working for at least 6 months.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by Marsymars on Friday May 01, 2026 @08:08PM (#47981956)

Funny, the Amex on my Pixel Watch stopped working only a couple weeks after the physical card expiry.

It was quite confusing, because a) I received a replacement physical card several months before the card expiry, so by the time my watch stopped working I'd entirely forgotten about it, b) there's no indication anywhere in the Android/Wear OS of what the expiry date is or that it might be expired and c) there's no indication at the point of sale that the virtual card is expired, simply a generic "Declined" message.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by kay_o on Friday May 01, 2026 @07:49PM (#47981838)

You can run a charge with only the card number if you have sufficient trust. Each additional piece you add reduces liability and transaction fees (add exp, add cvc, add 3ds, ...)

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by Denvercoder9 on Friday May 01, 2026 @06:19PM (#47981160)

Account Updater functionality isn't necessarily even involved there. In the end whether to accept a transaction is up to the issuer, and quite often they'll keep accepting recurring transactions on otherwise outdated card information.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by cft on Friday May 01, 2026 @06:44PM (#47981363)

I also noticed that my Google Wallet cards no longer have expiration dates- when a card expires and they issue a new one, the Wallet card works without any intervention on my part

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by Marsymars on Friday May 01, 2026 @08:10PM (#47981972)

That's very much contrary to my experience just a couple months ago that I detailed in another post: https://news.ycombinator.com/item?id=47981956

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by lxgr on Friday May 01, 2026 @07:05PM (#47981516)

Wallets usually don't store the card information directly anyway, but only a token, which can be re-associated with new underlying card details when the card is replaced.

The token itself does also have an expiry date (it's a mandatory field in most protocols), but that can be updated as well, I believe.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by thomk on Friday May 01, 2026 @06:42PM (#47981346)

Check out privacy.com, you can make your own cards. One per service if you want.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by at-fates-hands on Friday May 01, 2026 @07:20PM (#47981647)

Been doing this for a while now for ebay and other stuff. I'm always shocked at how many people have no idea this exists.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by what on Friday May 01, 2026 @10:41PM (#47982822)

Because people use credit cards for the rewards (cash, mileage, whatever) or because they don’t actually have the money now. They don’t want to pay for a unique number for every transaction (which doesn’t actually preserve privacy since most of the stuff you’re buying online needs a shipping address) nor do they want the money immediately pulled from their bank account.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by matheusmoreira on Saturday May 02, 2026 @04:54PM (#47990400)

Credit cards give rewards which can be significant, reduce or eliminate the need to keep liquid cash around and frees it up for investments which compounds on top of the rewards, and it dramatically simplifies the number of annoying bills from N to one.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by thebruce87m on Saturday May 02, 2026 @06:26AM (#47985113)

Visited the site and the first thing it wanted me to do was accept optional cookies. Privacy.com wants to track me because of course it does.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by pxeboot on Friday May 01, 2026 @06:49PM (#47981408)

> I again called the credit card company and this time, told them to cancel all the digital wallets (there were 99 of them!). There is no way to do this online.

This is highly dependent on your bank. For example, Bank of America lets you view and delete any cards that have been added to a digital wallet right on their website.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by Marsymars on Friday May 01, 2026 @08:15PM (#47981997)

Half of my cards can't even be added to non-iPhone devices without a verification phone call to some poor support agent who's never heard of a "Pixel Watch", has no idea what the workflow is on his end to manually verify cards being added, and just wants me to "use the iPhone app to verify".

Heaven forbid if I try to add a card to an Apple Wallet on a Mac where no iOS or Android app exists.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by lxgr on Friday May 01, 2026 @07:08PM (#47981552)

Only digital wallets, or also any merchant that saved the card using a token? The latter is getting more and more common, but usually happens transparently to the cardholder.

Theoretically, it would allow a pretty neat feature of being able to manage all merchants that have a copy of the card in the banking app and revoke said copies – but since token use is not mandatory, that would be fairly confusing, so I haven't seen this yet as far as I remember.

FWIW, India has taken a pretty radical step towards that future at a regulatory level by effectively mandating merchants to no longer store the underlying card number and use tokens instead. I suspect that such an interface would be more common there, but I don't have any personal experience.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by pxeboot on Saturday May 02, 2026 @11:19AM (#47987178)

> Only digital wallets, or also any merchant that saved the card using a token?

Only digital wallets. Specifically, Apple Pay, Garmin Pay, and Google Pay.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by ph1lw on Friday May 01, 2026 @07:24PM (#47981670)

Same here, had a 200 EUR charge from Meta / FB - still waiting for my new card.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by kodbraker on Friday May 01, 2026 @05:24PM (#47980559)

For my case, it was almost certain. As it happened single day, the card i use was a virtual card only used in couple big ecommerce websites etc.

If it was leaked somewhere else, i think they wouldn't bother logging in some unrelated account of mine in an ecommerce website.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by tety on Friday May 01, 2026 @05:30PM (#47980643)

Digital wallets as in Apple/Google Pay? I had a similar thing happen and I am wondering what did you make of this double charge, what did the attackers do in your opinion?

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by resonantjacket5 on Friday May 01, 2026 @06:09PM (#47981063)

no it's like a continuation of your credit card for recurring payments.

It's called Automatic Billing Updater (ABU)

the idea is that if you ask for a new credit card after being stolen, your say utility providers or other like netflix subscriptions can seamlessly switch over to the new credit card number.

it worked fine for a while, but of course the problem is that afterwards the stolen credit card credentials started to be refreshed as well.

(used ai to fetch the list below).

Visa: Visa Account Updater (VAU) Mastercard: Automatic Billing Updater (ABU) American Express: Cardrefresher General: Recurring Payment Tokenization

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by 8note on Friday May 01, 2026 @08:25PM (#47982048)

if it was a 0 or 1 dollar auth, its likely a fraud check done by said company to make sure you still exist.

one or more of those digital wallets are some subscription supporting thing, and if that auth failed or had an address mismatch or wrong kind of card, they will disable your account until you update your card.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by bmitch3020 on Saturday May 02, 2026 @06:29AM (#47985130)

It's a shame that a disputed charge doesn't result in the credit card company reviewing how the charge was processed, invalidating only the single saved token with a single merchant. That would save everyone a lot of time and money.

[ Parent | on HN ]