3DS browser flows can reveal card state before authorization
Original title: The 3DS Oracle: BIN Attack via the Network
In six of seven ACS cohorts, a Braintree/Cardinal browser path separated researcher cards from nearby same-range PANs.
A paper argues that some EMV 3-D Secure browser integrations expose routing and authentication state before financial authorization, turning 3DS into a profiling channel. In a bounded live test of the Braintree/Cardinal path, the first client-visible result separated researcher-owned anchor cards from adjacent same-range PANs in six of seven ACS or card-range cohorts. The authors cite public tooling, rotating proxies, and paid 3DS card-testing services as evidence that similar signals are already used, but they do not claim network-wide prevalence. They say remediation needs consortium changes to client-visible responses, continuation behavior, and session binding.
Unconfirmed: The authors do not claim network-wide prevalence, and the live evaluation was deliberately limited.
- The live separation held in six of seven distinct ACS or card-range cohorts.
- The study was ethically bounded and does not estimate attacker scalability.
- Authors call for less client-visible pre-authorization data and stronger session binding.
Impact: Pre-authorization profiling of issuer controls and card state
| Product | Affected |
|---|---|
| EMV 3-D Secure | — |
| Braintree/Cardinal browser path | — |
- Vendors
- Braintree
- Products
- EMV 3-D SecureCardinal
From the original article
1 min read at arxiv.orgEMV 3-D Secure (3DS) requires a client-visible continuation boundary in browser-mediated flows; in some deployments, that boundary exposes a pre-authorization classification channel. This paper studies 3DS as a protocol, integration surface, and governance problem, combining standards analysis, architectural reconstruction, formal modeling, a documentation audit, disclosure history, and a bounded live evaluation.
By Wasif Faisal · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.