Loopholes in Verified by Visa & Secure Code

Summary: Trend Micro's Rik Ferguson documented that the password reset function in Verified by Visa and MasterCard SecureCode asks for card number, ZIP code, birth date and other data, three of four verification items being printed on the card itself or held in its magnetic stripe. Krebs notes a carding forum administrator posted a tutorial on circumventing this added card security on Halloween 2009, and that no email notification is sent when a cardholder's account is accessed or modified.
Key Takeaway: The reset flow leaves date of birth as the only non-card secret, and that is available in public records and on social networks - so anyone holding stolen card data can set a new passcode and authorize transactions without the cardholder knowing until they check a statement.

Read the original at Krebs on Security ↗

Topics: Data Breaches
Related: TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026
Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026
City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026