Nowadays, any credit/debit card transaction made online (at least for mine) requires one to enter the card details (Account No., Expiry Date, CVV etc). In the end, a OTP (One Time Pass) is sent to the mobile number linked to that Credit/Debit card for 2-Factor Authentication.
In this process, if someone (other then the owner) possesses the correct Card No. and CVV of the card, can he gain access to the account and make any transactions?
This assumption is made while keeping in mind that the device on which the OTP is being sent is not compromised.
It seems like this method of authentication is not that predominant. If one has to pay a sum of 100$ via his account, the person goes through this process:
Enter the Credit/Debit Card number, enter the Expiry date of the card and the CVV (a 3 digit code)
For Complete Authentication of the User, an OTP is sent to the mobile number registered to that account.
Now the user has to enter the OTP (this is the final step)
If all the aforementioned details are valid, the transaction is made.
Certain things to keep in mind:
I get redirected to the bank account's site when i have to enter the OTP. i.e. The OTP isn't entered at the merchant store, rather it is entered at the bank site, which the merchant redirects us to
If the entered OTP is wrong, the site provides an option for resending a new OTP to the same number
OTP is 6 digits