Serious Security Glitch in ICICI Bank's iMobile Alert

[Private]

Several users have reported being able to view other customers' ICICI Bank credit cards on their iMobile app. Since the full card number, expiry date, and CVV are visible on iMobile, and one can manage international transaction settings, it's easy for someone to misuse another person's credit card for international transactions.

What can you do?
If you can't do anything, and someone has access to your card, they can change settings on iMobile without OTP or even MPIN. The best option is to block the card and replace it; this will provide some temporary relief.

Update:
It seems ICICI Bank has restricted access to credit card details on the iMobile app for everyone.

Update:
ICICI Bank response regarding the issue on mint



Update 26/04/2024:
ICICI Bank has instructed its delivery partners to immediately return all in-transit debit and credit card deliveries to the bank.

@googley :

I have access to someone else’s Amazon Pay CC due to a security glitch on the iMobile app.
Although OTP restricts domestic transactions but I can do international transactions using the details from the iMobile app.
The app even allows me to enable international transactions in case it has been disabled by the actual user.

I have already flagged this to ICICI team they are working on this on priority as multiple customers have reported this. I wanted to alert the community folks too regarding the same.

Several users have reported being able to view other customers' ICICI Bank credit cards on their iMobile app. Since the full card number, expiry date, and CVV are visible on iMobile, and one can manage international transaction settings, it's easy for someone to misuse another person's credit card for international transactions.

What can you do?
If you can't do anything, and someone has access to your card, they can change settings on iMobile without OTP or even MPIN. The best option is to block the card and replace it; this will provide some temporary relief.

Update:
It seems ICICI Bank has restricted access to credit card details on the iMobile app for everyone.

Update:
ICICI Bank response regarding the issue on mint



Update 26/04/2024:
ICICI Bank has instructed its delivery partners to immediately return all in-transit debit and credit card deliveries to the bank.

@googley :

I have access to someone else’s Amazon Pay CC due to a security glitch on the iMobile app.
Although OTP restricts domestic transactions but I can do international transactions using the details from the iMobile app.
The app even allows me to enable international transactions in case it has been disabled by the actual user.

I have already flagged this to ICICI team they are working on this on priority as multiple customers have reported this. I wanted to alert the community folks too regarding the same.

There is amazon pay credit card in attachment ending with 0006.
My amazon pay credit card end with 0006. can you confirm last 8 digit of this credit card.

 

[ak93]

They blocked the newly issued cards now. The reason seems bogus since I did not see any usage!

 

[Private]

can we make payment towards blocked cards ?

 

[imdjay]

it says we are under maintenance for me when i try to log in..

Working fine for me.
I also had applied and received new card last week. Not even generated PINs. What are the chances I am also affected due to this glitch?

 

[thanix]

I don't think it is newly issued cards only. My wife having ICICI Account was checking eligible credit cards, a week ago. Yesterday, she shown the same page to me and it was showing some random name called Jagir. Forgot to take picture. She is not going to touch ICICI cards for some time.

 

[ankitshukla]

I am not able to access my card details on icici application. Seems they have blocked the access to cards.

No I can see all details

 

[Copycat]

I don't think it is newly issued cards only. My wife having ICICI Account was checking eligible credit cards, a week ago. Yesterday, she shown the same page to me and it was showing some random name called Jagir. Forgot to take picture. She is not going to touch ICICI cards for some time.

I agree. I think the ICICI "admission" was just a load of misdirection. A bunch of jargon that sound legit but means nothing. What exactly did they mean by "erroneously mapped"? The card was probably matched to the correct person who had ordered it, but what was shown was probably due to a bug in the code that showed other peoples' card to you. Why else would ak93 have seen 14 cards? https://www.technofino.in/community...n-icici-banks-imobile-alert.25879/post-620666 Surely no new customer would have 14 cards approved at one go? (also the Reddit user who saw 11 cards: https://www.technofino.in/community...n-icici-banks-imobile-alert.25879/post-620676)

 

[Private]

I agree. I think the ICICI "admission" was just a load of misdirection. A bunch of jargon that sound legit but means nothing. What exactly did they mean by "erroneously mapped"? The card was probably matched to the correct person who had ordered it, but what was shown was probably due to a bug in the code that showed other peoples' card to you. Why else would ak93 have seen 14 cards? https://www.technofino.in/community...n-icici-banks-imobile-alert.25879/post-620666 Surely no new customer would have 14 cards approved at one go? (also the Reddit user who saw 11 cards: https://www.technofino.in/community...n-icici-banks-imobile-alert.25879/post-620676)

I blocked my credit card. can't take chance. International transactions doesn't require OTP.

 

[ak93]

I agree. I think the ICICI "admission" was just a load of misdirection. A bunch of jargon that sound legit but means nothing. What exactly did they mean by "erroneously mapped"? The card was probably matched to the correct person who had ordered it, but what was shown was probably due to a bug in the code that showed other peoples' card to you. Why else would ak93 have seen 14 cards? https://www.technofino.in/community...n-icici-banks-imobile-alert.25879/post-620666 Surely no new customer would have 14 cards approved at one go? (also the Reddit user who saw 11 cards: https://www.technofino.in/community...n-icici-banks-imobile-alert.25879/post-620676)

They belonged to different customers, not one. I know a lot of new cards were issued because they had come to our office and atleast 10 of my colleagues applied for the Sapphiro dual card in few days.

But like you said, the bug maybe not with mapping but showing incorrectly! How else would i get sms and email if incorrectly mapped? It could be wrong mapping to customer id as I could not see cards even after it was delivered for few days.

 

[nirmalya]

RBI should take strict actions against banks for such data breaches. In India, there is a strong need of data protection laws to protect consumer data.

 

[credit_noob]

I noticed that ICICI cards transaction are successful, even if you put wrong 3 digit cvv. I complained about this issue, Bank took this casually but unfortunately i did not follow up due to busy schedule.. Did any member face this kind of issue?

Yes even with wrong CVV transaction still successful and everything normal only ICICI is a joke I think it fixed? No idea

 

[vishp]

I had questioned to ICICI whether my card data was also leaked as I got my new card just a few days back. They said the below:
"We inform you that the mentioned issue was due to technical migration at our end. We regret the inconvenience caused. We inform you that your credit card data is safe and secure."

 

[yolofino]

I had questioned to ICICI whether my card data was also leaked as I got my new card just a few days back. They said the below:
"We inform you that the mentioned issue was due to technical migration at our end. We regret the inconvenience caused. We inform you that your credit card data is safe and secure."

I pretty much received a similar response. How to complain to RBI? I asked for replacements (free).

 

[bhavik886151]

There is always problem with ICICI System

today i buy some thing online using ICICI credit card but by mistake i add my debit card CVV and still i received the OTP and transaction successfully completed

few month back also i check out with my debit card CVV and transaction completed

 

[Harry1]

There is always problem with ICICI System

today i buy some thing online using ICICI credit card but by mistake i add my debit card CVV and still i received the OTP and transaction successfully completed

few month back also i check out with my debit card CVV and transaction completed

Many people have reported that it goes through with wrong expiry also in case of icici. Only OTP is verified.

 

[bhavik886151]

Many people have reported that it goes through with wrong expiry also in case of icici. Only OTP is verified.

yes Look Like only card number and correct OTP is enough for most ICICI cards to do transaction

 

[vishp]

I pretty much received a similar response. How to complain to RBI? I asked for replacements (free).

What did they say when you asked for free replacements??

 

[shrewdoc]

There is always problem with ICICI System

today i buy some thing online using ICICI credit card but by mistake i add my debit card CVV and still i received the OTP and transaction successfully completed

few month back also i check out with my debit card CVV and transaction completed

It is common in foreign transactions as well, not just with ICICI.

I read that geo-locations are tagged from the IP Address and the Device ID and if it matches with the known data pool of the user, the transactions go through without any hassle. Many checks are done in the background, which we are not aware of.

 

[MrJJ]

It is common in foreign transactions as well, not just with ICICI.

I read that geo-locations are tagged from the IP Address and the Device ID and if it matches with the known data pool of the user, the transactions go through without any hassle. Many checks are done in the background, which we are not aware of.

Jinke credit cards aise hi sab ke paas access ho jaayein vo kya check krte honge sab samajh sakte hain...

Never be naive and fully trust your banks, they just want to make money by following minimum guidelines given to them by RBI. If RBI wasn't there they wouldn't even give a shit about security.

On that note, ICICI's netbanking is least secure in my opinion, it let's you login with just username and password, there is no 2FA or OTP verification etc.

 

[shrewdoc]

Jinke credit cards aise hi sab ke paas access ho jaayein vo kya check krte honge sab samajh sakte hain...

Never be naive and fully trust your banks, they just want to make money by following minimum guidelines given to them by RBI. If RBI wasn't there they wouldn't even give a shit about security.

On that note, ICICI's netbanking is least secure in my opinion, it let's you login with just username and password, there is no 2FA or OTP verification etc.

I assume you have some beef with ICICI. I am not here to defend any bank, but about the post you quoted, it is followed by institutions worldwide was what I meant to say.