Visa customers have reason to worry as a new research paper in the academic journal IEEE Security & Privacy revealed a weak spot in online credit card security that allows hackers virtually unlimited hacking attempts at Visa accounts. What's worse, the vulnerability lies in the way merchants accept online payments, meaning that there's little the average Visa card customer can do to protect themselves.
The vulnerability lies in the fact that the Visa payment system allows users to attempt all possible permutations and combinations of expiration dates and CVV numbers across hundreds of websites. To exploit this vulnerability, hackers can use a technique called Distributed Guessing Attack (which is similar to a DDoS attack). When this technique is executed properly, a hacker can recover a credit card's security information in as little as six seconds.
How Does Distributed Guessing Attacks Work?
At the heart of the issue is the fact that an online Visa payment system allows a maximum of 20 attempts per card in order to guess credentials like card numbers, expiration dates, and CVV numbers. That number may sound reasonable enough, but considering that all of the various payment websites do not coordinate their security efforts regarding the attempted use of a particular credit card, nothing stops a hacker from simultaneously running number combinations through the payment system on several websites until a working expiration date and CVV number is found.
Considering that it only takes 1,000 attempts to crack a three character CVV number and only 60 attempts to guess the correct expiration date, a hacker doesn't have to attempt their guesswork on many sites before successfully gaining access to the funds associated with that Visa account. Essentially, it plays out like a twisted version of the classic game 20 Questions.



