SBI and HDFC Credit Cards used Fraudulently

[phoenix003]

I have 2 credit cards and both were used on flipkart but I didn't get any otp neither sms.What can be the reason?

 

[SSV]

I have 2 credit cards and both were used on flipkart but I didn't get any otp neither sms.What can be the reason?

So , you are saying you used both the cards successfully for Flipkart transactions without OTP.. right?? I haven’t heard this before.. let’s see if anyone had this experience

 

[VasukiVasuki is verified member.]

I have 2 credit cards and both were used on flipkart but I didn't get any otp neither sms.What can be the reason?

If any transaction happens without otp
There is 100 % chance of approval of charge back

But a domestic transaction happening without otp is next to impossible even if card details is saved & no cvv required

Even then otp comes

 

[Kushagra_]

So , you are saying you used both the cards successfully for Flipkart transactions without OTP.. right?? I haven’t heard this before.. let’s see if anyone had this experience

It's possible with hdfc if you have swipe to pay enabled 👀 it's stupid but there's a glitch in their system, one can basically call the transaction api with specific headers and say it was a swipe to pay transaction and it's approved no otp required but I'm unsure how it can be done for sbi

 

[AlgoTrader]

It's possible with hdfc if you have swipe to pay enabled 👀 it's stupid but there's a glitch in their system, one can basically call the transaction api with specific headers and say it was a swipe to pay transaction and it's approved no otp required but I'm unsure how it can be done for sbi

Now this is scary

 

[Kushagra_]

Now this is scary

Not that scary someone will have to test the specifics of it

When I was experimenting with it I could only do it with my own device and my own card and not some other cards but it feels like it should be possible with enough know how

 

[harsh_ujjwal]

It's scary.. Shall we keep our card saved on specific App??

 

[rrsji]

It's scary.. Shall we keep our card saved on specific App??

I don't belive any app other than samsung pay in that case

 

[AlgoTrader]

Not that scary someone will have to test the specifics of it

When I was experimenting with it I could only do it with my own device and my own card and not some other cards but it feels like it should be possible with enough know how

if common folks like this can go this far, what about pro hackers bro ? definitely scary

 

[Kushagra_]

if common folks like this can go this far, what about pro hackers bro ? definitely scary

I'm an engineer who codes for fun and a living so not just common but also not a problem hacker, that's the thing looking at it I feel someone with more knowledge could probably misuse it

 

[iamdhamo]

It's possible with hdfc if you have swipe to pay enabled 👀 it's stupid but there's a glitch in their system, one can basically call the transaction api with specific headers and say it was a swipe to pay transaction and it's approved no otp required but I'm unsure how it can be done for sbi

How to check this swipe to pay?

 

[tachniki]

It's possible with hdfc if you have swipe to pay enabled 👀 it's stupid but there's a glitch in their system, one can basically call the transaction api with specific headers and say it was a swipe to pay transaction and it's approved no otp required but I'm unsure how it can be done for sbi

Did that work for tokenized card?

 

[Kushagra_]

How to check this swipe to pay?

Inside payzapp if you don't have payzapp you don't have it on

 

[Kushagra_]

Did that work for tokenized card?

I am unsure, it was my debit card

 

[jk51]

Instances like this make the old fashioned 20 sec memorized inputs look more sound.

 

[tachniki]

Ideally OTP should become a matter of past now. If sim binding and device binding is done correctly, and transaction happens from the device, it is safer than OTP.

 

[SSV]

Ideally OTP should become a matter of past now. If sim binding and device binding is done correctly, and transaction happens from the device, it is safer than OTP.

The only problem is when the device is lost and was accessed immediately

 

[aniketkr.sharma]

I have 2 credit cards and both were used on flipkart but I didn't get any otp neither sms.What can be the reason?

I too had same issue in 2021, I think flipkart is main culprit to gave data to fraudsters

 

[tachniki]

The only problem is when the device is lost and was accessed immediately

That can happen today with sms also. All app with tokenized cards should have pin / bioauth login too. That may reduce fraud on device loss.

 

[aniketkr.sharma]

The only problem is when the device is lost and was accessed immediately

No, in deep analysis i found my gmail was getting accessed and the otp received on Gmail was used to do the transaction, however when I requested to block that gift voucher purchased from my account, flipkart blocked my account and till now the complain isn't resolved and I also had filed cyber case against that and that case came to my nearest police station after 2 years and they have no clue of what to do