1

If a bank mails a credit/debit card in an envelope isn't there a risk that somewhere on its way the envelope will be scanned and the card number, expiration date and CVV code will be extracted?

As far as I can tell there is no protection against scanning an envelope without opening it.

By scanning I mean using light sources in order to read the numbers, the date and the CVV. I do not mean NFC scanning since that probably won't make any sense given that the cards are not activated, although it's not clear if there is an NFC attack vector here.

Even though the extracted data cannot be used immediately, once the owner activates the card there is a possibility that the data might be used fraudulently, provided that internet purchases are enabled for the card. Or am I missing something?

Improve this question
3
  • This question is off-topic because it is discussing risks to a bank. If someone steals your credit card information while it is being mailed to you, that is no different than any other card fraud problem. You will always do the same thing; report the fraud, wait for a new card to come in the mail; rinse; repeat.
    – NL - Apologize to Monica
    Jan 26, 2018 at 22:11
  • 2
    @NathanL but it's your card, and you allegedly risk having money drained from your account.
    – RonJohn
    Jan 26, 2018 at 22:32
  • @NathanL: the intent of my question is to identify if there is an attack vector — my understanding is that there is, and I wanted to confirm and accurately assess it in order to understand how it can be mitigated, for example, in case if I intend to use the card exclusively for internet purchases, then I might want to get instead a virtual card without any physical card which would eliminate this specific attack vector.
    – ccpizza
    Jan 26, 2018 at 22:53

2 Answers 2

Reset to default
8

As far as I can tell there is no protection against scanning an envelope without opening it.

This would only be true of very thin envelopes. Credit cards are delivered in "business stock" envelopes which are quite opaque. In addition the card is typically attached to a piece of light cardboard stock, which is folded with the card on the inside. Plus, the credit card itself is opaque, which means you can't shine an intense light through the card to try and project the information out the other side.

A more likely attack would be to simply steal the card, learn the victims phone number, and then to activate the card while impersonating a call from that number. Impersonating phone number is unfortunately a pretty common trick for phone hackers.

The whole credit card system is primarily protected by quickly detecting and deactivating cards that are used fraudulently. There is no need to think of elaborate technical hacks to steal cards. Every time you pay with a card at a restaurant you hand over your physical card, and it's whisked out of your sight. There is nothing to stop them from duplicating the card and selling it on the black market. Nothing that is except the fact that the card company will quickly spot the fraudulent usage, and deactivate the card. In fact, this type of theft does happen all the time, and the credit card companies simply charge enough for their services that they can cover the costs of fraud.

Near Field Communication (NFC) isn't supported on most credit cards in the US.

Improve this answer
3
  • Regarding opacity: just got a transparent debit card today, and it has an NFC chip, which is pretty common and widely used in Europe. And the envelope is very basic with a single thin cardboard insert (it's from a 'new style' internet bank). I tested put it against my table lamp and I could see that it is not 100% opaque.
    – ccpizza
    Jan 26, 2018 at 23:34
  • 1
    @ccpizza I'm not sure I'd keep doing business with that bank, since they seem to have a fairly casual approach to security. On the other hand I've updated my answer to point out that sophisticated, technical hacks to steal credit cards are the least of your worries, because they are so easy to copy and steal at restaurant and filling stations. Why take the trouble to pick a lock when you can heft a rock through a window?
    – Charles E. Grant
    Jan 26, 2018 at 23:45
  • Not only are the envelopes for cards not opaque, they often have an extra layer inside that makes it harder to read numbers inside, like this. Also, (at least here in Hungary,) the PIN for the card is always sent separately, in certified mail (only the recipient can get it). Activation is done by either using the card with a PIN for the first time, or by calling a bank and using your banking password, knowing your number is not enough.
    – molnarm
    Jan 29, 2018 at 9:37
2

once the owner activates the card there is a possibility that the data might be used fraudulently, provided that internet purchases are enabled for the card. Or am I missing something?

Above and beyond Charles E. Grant's excellent answer... you'd quickly notice the fraudulent charges (because you regularly check your account balances, right??) and instantly call the bank, which would then cancel the card.

Improve this answer
6
  • 1
    That's of course implied, given that I get mobile notifications for every transaction, but the question is not about how soon I can react to fraud, but about whether there is an attack vector, because the card is travelling over unsecured transportation channels and crossing borders.
    – ccpizza
    Jan 26, 2018 at 22:46
  • @ccpizza "but about whether there is an attack vector" then see Charles' answer (which I upvoted). If you've ever received your own bank card, you'd realize why your worries are unfounded.
    – RonJohn
    Jan 26, 2018 at 23:02
  • 2
    I've previously received a bunch of cards by mail and never had issues with fraud, and never considered security implications, but it does not mean they are non-existent. I believe that being paranoid about security is good.
    – ccpizza
    Jan 26, 2018 at 23:24
  • 1
    @ccpizza paranoia is not good, because -- by definition -- is is a "thought process believed to be heavily influenced by anxiety or fear, often to the point of delusion and irrationality." Besides, it takes so much effort better spent on important things.
    – RonJohn
    Jan 27, 2018 at 0:49
  • 1
    I get your point, but don't agree. I happen to work in software development for many years and I'm well aware about the quality of software, including that deployed by banks because I used to work for one. I watch the infosec news, and have some idea of the scene. I never make assumptions about security, and imo we should avoid any assumptions when it comes to security. To quote a core programming principle: In the face of ambiguity refuse the temptation to guess.
    – ccpizza
    Jan 27, 2018 at 5:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .