In a "card not present" transaction, is the credit card number, expiry date & CVV considered as a "What you have" or a "What you know"?

Question

Is the credit card number, CVV & expiry date considered to be a secret? If so, then the physical credit card is incidental & the info about the card is something "you know". OTOH, if you don't think that it's a secret, then the credit card is a "what you have".

From the 3D Secure description on Wikipedia https://en.wikipedia.org/wiki/3-D_Secure

The newest variant of 3D Secure, which incorporates one time passwords, is a form of software-based strong authentication. However, the legacy variant with static password does not meet the European Central Bank's (ECB) January 2013 requirements.

If you think a credit card is a "what you have" then a static password (what you know) is a better 2nd factor. If you think it's a "What you know", then an OTP is a better 2nd factor.

I am getting a little confused about this. Also I think there will be similar considerations for debit cards also.

Answer 1

A requirement for "what you have" based authentication is that ownership can be clearly assigned to a single specific entity. This specifically means that this information/device can not be (easily) cloned and that access to the information requires access to the original device.

But credit number, CVV & expiry date are static information which can be easily cloned. Once you've entered these pieces of information somewhere they are not any longer what only you have. Thus they cannot be used as "what (only) you have" authentication. One-time passwords (OTP) are different. As the name suggests these are one time and cannot be reused, so access to a specific already used OTP is of no use for the attacker. Instead one needs to have access to the device generating the OTP, i.e. "what (only) you have".

In the case of the credit card: when you pay or get money by using the Chip and Pin functionality (EMV) you use the uncloneable part of the card, i.e. the "what only you have" part. If instead you use only the old magnetic stripe or the information written on the card (number, CVV...) you deal with easily cloneable information. This means this information is "what you have and others might have too" and thus can not be used to prove ownership of the card.

Answer 2

The number written on the back is actually the CV2. It is designed to be "something you have" because it is physically printed on the card but not encoded on the magnetic strip, or in the chip. It is also forbidden by the rules of the card processors for any merchant to store the CV2 value.

Of course in reality it does not necessarily prove physical access to the card as the number can be copied, written down, or stored electronically even if it is against the rules; and anyone attempting fraud is by definition not going to play by the rules.

By contrast the PAN and expiry date are "something you know" and in fact these values can in some circumstances be given out by the card issuer to interested parties.

Answer 3

1. All information is supposed to be more or less secret, including the card number, your PIN, etc. Even the name of cardholder.
2. No static (that is, usable more than once) information can be considered "what you have", they're all "what you know".
3. "what you have" could only be something physical that's not easy to duplicate. The proof of having what you have is usually one time password generated using such physical object. Examples:
   • an indication of a hardware token (proof of having the token)
   • a communication with secure element, chip (proof of having chip card in a reader)
   • a one time password generated on the server side and delivered via side channel (proof of having access to that channel). In 3d-secure the object is your mobile phone (your SIM card, to be specific) which it gives you access to the channel (your phone number). The channel is reasonably secure and access to it is reasonably limited, so it can be assumed that you having access to the channel to read the one time password is good enough proof that you physically have the SIM card.

Now, to have 2-factor you're supposed to both know the secrets AND prove your recent access to the physical object. The "recent" part can be implemented in many ways, eg by the token having internal clock that changes indication every few seconds, or via challenge-response mechanism.

Ultimately one can say that even the physical object is just information: the secret keys hardcoded in chips. But in security the difference between information and object is that information can be easily copied, while an object cannot. Fun fact: keys to your house are more information than objects, as it's quite easy to make copy of them.

If you want to do only MOTO transactions, the card doesn't even need to exists physically. There are examples of banks issuing "virtual cards" for internet use only, and those "cards" are just a bunch of letters printed on a paper: card number, expiry date, cardholder name, etc. Because they're not supposed to be used in card reader, there is no need nor use for mag strip, chip or embossed letters.

Answer 4

Retailers have different relationships with the card provider for "card not present" transactions. Their liability, and transaction costs are usually higher. This is because card not present transactions are (obviously) much more prone to fraud than card present, especially with Chip and PIN.

This is why online retailers will often only deliver to your registered address on first order; or will be limited in amount; or be limited to transactions where they will meet you at some point (e.g. ticket bookings).

Basically, because it's an easy to get secret, retailers have to make a choice whether to take the risk, and mitigate that risk in whatever way suits their trading environment.