A friend of mine was phished for his credit card details and driving license. Very foolish, I know. The criminals then bought bitcoin. The fact is his card is VbV. He claims not to have received any OTP message, while it was obviously sent. I checked his phone, no trace of any malware, plus he told me that he hadn't been installing any apps for a couple of months at least. None of his apps can read text messages.

How is this possible?

  • 1
    Your friend could be lying if they are embarrassed. The human factor is often the weakest link, seeing as he was phished once already. – Daisetsu Oct 9 '19 at 23:01
  • 1
    VbV doesn't necessarily use a SMS message. That's just one of the more common implementations. Has he always received a text message when making online purchases in the past? – Daisetsu Oct 9 '19 at 23:04

The fact is his card is VbV. He claims not to have received any OTP message, while it was obviously sent.

There is nothing obvious about that.

As far as I know Verified-by-Visa isn't mandated by the card alone, it also has to be supported by the Merchant where the card is used for payments.
When the Merchant doesn't support VbV then none of the extra authentication steps that VbV supports are taken and only the basic card details (Card Holder Name - Card Number - CVC) will be used to process the payment.

It stands to reason that a criminal with stolen credit card details would prefer such a Merchant to buy their bitcoin and then obviously no SMS message with an OTP would have been sent to your friend.

Merchants not supporting VbV run a greater risks of charge backs and not receiving their payment when the charges are disputed by the card holder, which will be the case when your friend disputes this charge with his card issuer.

Also the online documentation suggest that even when a merchant does support Verified by Visa you won't be prompted for the additional verification with every transaction, but only occasionally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.