The Core

Starting with just the first six digits of a card, the system guessed the remaining details and tried the combinations on many sites at the same time.

Moreover, if  individual merchants we re  trying to improve their security by  adding more payment fields  to  be verified on their site , they  potentia lly  inadvertently weaken the whole  system by creating an opportunity to guess the value  of another  field , as  explained later in the article

vulnerabilities described in this article apply to cards that do not enforce centralised checks across transactions from different sites. Our experiments were conducted using Visa and MasterCard only. Whereas MasterCard’s centralised network detects the guessing attack after fewer than 10 attempts (even when those attempts were distributed across multi ple websites) , Visa ’s payment ecosystem does not prevent the attack ( see Section VI. D ). Because Visa is the most popular payment network in the world, the discovered vulnerabilities greatly affect the entire global online payments system.

Guessing an expiry date takes at most 60 attempts(banks typically issue cards that are valid for up to 60 months), and subsequently,guessing the 3-digit CVV2 takes fewer than 1,000 attempts. Hence, expiry date and CVV2 are guaranteed to be obtained within 60 + 1,000 = 1,060 guesses.