I'm working on designing a credit card payment form whose core functionality is provided by a payment processing company ("upstream").
Upon some transaction errors the upstream returns the detail (*one kind at a time) of the user-provided data that was wrong, for example "Invalid CVC" and "Invalid expiry year."
With this in regard, I have three questions:
Why aren't the error messages obscured like login failures? According to OWASP, an application should respond to authentication failure in a generic manner. Authentication and Error Messages | Authentication - OWASP Cheat Sheet Series
Should I implement a custom error message obscuring the details e.g. "Invalid expiry date or CVC?"