Revolut cards blocked by Dutch OVPay system
A clever exploit caused by OVPay resolving debits using a nightly batch process:
The exploit is simple. The OVpay processes travel expenses during the overnight hours. Passengers can avoid payment by using a virtual card if they then delete it after checking out, but before the charge has been finalized. That prevents the money from being debited from their account. Public transport workers cannot detect this, as they only see the check-in time and location.
Since July 1, all virtual cards from the online bank Revolut and the payment services Paysafe and Vivid have been blocked at NS. Paysafe’s virtual cards have also been blocked at all other public transport companies, NOS reports.
Fraudsters used the virtual cards to check in and out, but removed them after the trip and before the fare could be deducted. Because people can check in and out normally using this method, they are issued a valid ticket, and conductors can’t detect the fraud.
The OVPay system for using public transport with a debit card is technically designed so that the travel expenses are only debited after checking out, not immediately. This is to ensure that the public transport system runs smoothly. An immediate debit would mean that each check-in and check-out takes 10 to 15 seconds, a spokesperson for Translink, the company behind OVPay, told NOS.
Tags: revolut payment credit-cards virtual-cards ovpay paysafe vivid infosec security banking