Credit cards are vulnerable to brute force attacks

The author details a credit card brute force attack exploiting PCI DSS masking rules that expose the first 6 and last 4 digits alongside expiration date. Attackers brute-forced the remaining digits and CVV using payment gateway response codes that leaked validation state, then abused 3D Secure exemptions to withdraw funds. The article argues PCI DSS standards are minimums that enable known vulnerabilities.