Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed?
Context: A guy I know was cheated via the usual social engineering routes (dumb I know!) into revealing his Credit Card details & a fraudulent transaction was made. The bank says an accurate OTP was entered and hence their liability ends. I tend to agree with them.
The victim OTOH insists that although he did give his Card Number, Expiry date & CVV to the phishers over the phone, he never gave them the OTP received via his cellphone SMS (text message). I find that hard to rationalize.
That's why I'm wondering if there really could be channels of attack that somehow defeat the OTP-SMS protection? The only possibility I could brainstorm is some variant of SIM card cloning.
What do people think? Know any exploit reports like this in the wild? (Normally I'd have not believed the victims insistence that he never revealed the OTP but I'm just playing devils advocate for a bit)
In case it matters, Verified by Visa uses a 4-6 digit OTP sent via text message & it is supposed to expire in 180 secs.