Gnosis Pay Requires 3D Secure After Card Data Exposure

Gnosis Pay made 3D Secure mandatory for every online card payment after discovering unauthorized access to a legacy consumer card system on Nov. 3, according to the company. Exposed records included full card numbers and CVVs.

All online card payments now require 3D Secure. Gnosis Pay scheduled the control to remain in place until it takes the legacy consumer card system offline on Dec. 20, establishing a dated endpoint for the stricter online-payment regime.

What the intrusion exposed

The disclosure identifies four categories of exposed information:

• Card credentials: full card numbers, CVVs and expiration dates.
• Identity data: cardholder names and home addresses.
• Linked records: wallet addresses, email addresses, phone numbers and nationalities.
• Banking details: IBAN and BIC information for some users.

The combination matters because a card number and CVV are not the only exposed fields. The records also linked payment credentials with personal identifiers, contact data and, for some users, banking details. That creates a broader fraud and impersonation risk than the exposure of card data alone, even though Gnosis Pay reports no loss of customer funds.

Gnosis Pay has not disclosed how many users were affected. The disclosure also does not describe the intrusion mechanism or the legacy system’s architecture. Those omissions limit any precise assessment of the incident’s scale and leave customers without a clear measure of exposure.

Operational remediation began within two hours of the discovery. Gnosis Pay replaced credentials associated with the affected system, while customer funds and the company’s enterprise platform remained outside the reported impact.

The control applies across Gnosis Pay’s online card-payment service, rather than only to a limited product or payment type. The company has not described any exemption. For merchants and payment teams, the operative requirement is straightforward: each online card transaction must include the mandated 3D Secure verification step.

What does this change for cardholders?

For cardholders, the immediate change is concrete: every online card payment must clear 3D Secure before approval. Merchants using Gnosis Pay for online card acceptance must support that verification step in their checkout flow. The mandate concerns online card payments; the disclosure identifies no corresponding change to offline card payments, enterprise services or wallet operations.

Exposed data changes the risk assessment even without a reported loss of funds. A party holding card numbers, CVVs and personal contact data could conduct more targeted fraud or phishing attempts, although Gnosis Pay has not said that such attempts occurred.

The same concern applies to linked wallet addresses. Combined with names, addresses, email addresses and phone numbers, those links could make impersonation attempts more credible. The disclosure does not report misuse of any wallet or customer account.

IBAN and BIC details for some users add a further layer of concern because the disclosure links them to the same affected records as card and identity data. Gnosis Pay does not quantify that group or report fraudulent transfers. Its statement that customer funds were unaffected therefore limits the reported financial loss, not the sensitivity of the exposed information.

Gnosis Pay says it replaced credentials associated with the affected system. That action addresses the compromised system’s credentials; mandatory 3D Secure adds a separate check at online checkout. The disclosure does not say whether cardholders must replace physical cards or whether it found unauthorized card transactions.

What remains unresolved

The affected-user count remains the central gap in assessing scale. The other dated checkpoint is Dec. 20, when Gnosis Pay plans to take the legacy consumer card system offline. Until then, mandatory 3D Secure remains scheduled for every online card payment.

The next fixed point is Dec. 20: Gnosis Pay plans to take the legacy consumer card system offline, with mandatory 3D Secure for online card payments remaining in force until then.