ICICI iMobile Security Glitch - Credit Cards Section In app is Under Update

Qubit

Qubit

Beginner
Just noticed ICICI credit card section in IMoble app is not loading and there is a notification that sever is under maintanance.

Upon checking twitter it seems there might be a larger security issue:

"Several users have reported being able to view other customers' ICICI Bank credit cards on their iMobile app. Since the full card number, expiry date, and CVV are visible on iMobile, and one can manage international transaction settings, it's easy for someone to misuse another person's credit card for international transactions."

Be alert if there are any unauthroized transactions in your ICICI CC.

Source:
https://www.technofino.in/community...ty-glitch-in-icici-banks-imobile-alert.25879/
https://hastebin.com/share/eduzilesiq.swift

https://twitter.com/x/status/1783343847390724587
 
  • Wow
  • Haha
Reactions: Crazy_Eddy, kalph09, gokul.ece22 and 1 other person
That's nuts. All it takes is seconds for someone experienced to turn on international txes and max out your card on some CSGO skin website. That money is gone forever. And without ICICI admitting their fault, RBI won't help you recover it from them either. Also, how insanely insecure is your backend to even allow the possibility of one user's credentials retrieving and decrypting another user's CC data?
 
Happened with Axis mobile app as well. I personally noticed it a few years ago.

variablevector said:
Also, how insanely insecure is your backend to even allow the possibility of one user's credentials retrieving and decrypting another user's CC data?
Click to expand...
It's a bug with data migration where the card itself is assigned to the wrong user. So technically the card is owned by the caller as seen from authentication point of view.
 
Last edited:
  • Like
Reactions: variablevector
sandeepsachin said:
Is it advisable to block the cards immediately?
Click to expand...
Block international transactions as they use 2D gateway which doesnt require OTP, Indian transactions mostly use 3D gateways, will require OTP to complete transactions.

Live mint article claims 0.1% credit cards are impacted. We can't be sure if its correct as there is no official statement from icici on this.

www.livemint.com

ICICI Bank app glitch: Alert raised, netizen says sensitive card info visible

Users of the TechnoFino platform raised an alarm about a security glitch in ICICI Bank's iMobile app, which enables access to other customers' credit card details. Bank restricts access to credit card information, admits about 17,000 new credit cards were erroneously mapped to the wrong users.
www.livemint.com www.livemint.com
 
Alright, I panicked and blocked both my cards . There was a pop-up to choose a reason for blocking and if re-issuance was required. I chose damaged (the other 2 options were lost and stolen ) and closed the pop up. Now, what should be my next course of action? I have outstanding on both cards with due date 10 days from now. Should i call them to re-issue ? What are the chances , they send me a card with the same number ? i don't want a card with same number.
Also, is it possible for someone to use my card details even after it is blocked?
 
sandeepsachin said:
Alright, I panicked and blocked both my cards . There was a pop-up to choose a reason for blocking and if re-issuance was required. I chose damaged (the other 2 options were lost and stolen ) and closed the pop up. Now, what should be my next course of action? I have outstanding on both cards with due date 10 days from now. Should i call them to re-issue ? What are the chances , they send me a card with the same number ? i don't want a card with same number.
Also, is it possible for someone to use my card details even after it is blocked?
Click to expand...
You could have temporarily blocked or turn off card transactions till there is official update/email from icici.
Please reach out to customer care on new card queries. It's not possible to transact once card is blocked.
 
  • Like
Reactions: sandeepsachin
sandeepsachin said:
Alright, I panicked and blocked both my cards . There was a pop-up to choose a reason for blocking and if re-issuance was required. I chose damaged (the other 2 options were lost and stolen ) and closed the pop up. Now, what should be my next course of action? I have outstanding on both cards with due date 10 days from now. Should i call them to re-issue ? What are the chances , they send me a card with the same number ? i don't want a card with same number.
Also, is it possible for someone to use my card details even after it is blocked?
Click to expand...
1) They should send you new cards in a few days, and maybe charge you a reissuance fee. But I would email them to make sure.
2) You should have a new card number within those 10 days. But if you pay using the old card number, worst case scenario, it fails and the money is refunded back.
3) There is absolutely no way anyone can use your old card details now.

Oh and they will never send you a card with the same number as that would defeat the whole point of blocking the card. Relax.
 
  • Like
Reactions: sandeepsachin
Qubit said:
You could have temporarily blocked or turn off card transactions till there is official update/email from icici.
Please reach out to customer care on new card queries. It's not possible to transact once card is blocked.
Click to expand...
If i had blocked the card temporarily , it would still be possible for someone to enable it again in their app and use the card right? Because we still dont know if they've fixed the glitch in their system. Out of nowhere , if tomorrow again people start seeing random cards in their account , it could be misused.
 
You are right
sandeepsachin said:
If i had blocked the card temporarily , it would still be possible for someone to enable it again in their app and use the card right? Because we still dont know if they've fixed the glitch in their system. Out of nowhere , if tomorrow again people start seeing random cards in their account , it could be misused.
Click to expand...
You are right. It's crazy that original post claimed even card controls can be changed.
I trusted on card controls so I didn't block the card as I have already turned off international txns.
 
Screenshot 2024-04-26 at 12.53.15 AM.png
 
As i mentioned earlier , I blocked my cards last night . Today morning i requested new cards which were approved . Now, at around 10 :10 am today, i received 12 mails and a few sms's -"Status of your icici bank credit card usage control " These are for the old card numbers.
 
You people are worrying too much. Only about 17000 cards which were issued to people in the past few days were mapped to wrong customers erroneously.
This was a data migration issue.

So if you have not gotten a new card in the past few days or are not a new customer then you need not worry about this. Stop blocking your cards unnecessarily and creating hassle for yourself.
 
Last edited:
  • Like
Reactions: Simar, Crazy_Eddy and newbie9052
sandeepsachin said:
As i mentioned earlier , I blocked my cards last night . Today morning i requested new cards which were approved . Now, at around 10 :10 am today, i received 12 mails and a few sms's -"Status of your icici bank credit card usage control " These are for the old card numbers.
Click to expand...
I'd like to know, what triggered these mails and sms's? Did someone try to change the usage controls on my card? The card was blocked last night. why would the banks systems change usage control on a blocked card when a new card is already on the way. I reported the incident but as usual , clueless support rep just asked to mail the screenshots to their higher up.
12 emails, 6 for each card and 2 sms's .
 
Top Bottom