WirexOne Visa Card Security Vulnerability

Wirex recently forced all customers to migrate to their WirexOne app which lacks some of the features the old App had. Notably the ability to change the PIN code of the Visa Debit can no longer be done under the WirexOne App.

There documentation and help center is a mixed mess of instructions for the old and new app, however Wirex suggest that as the ability to change PIN code under WirexOne is not available you have to go to a bank ATM to change PIN code there. However the country where I live no bank ATM allows you to change PIN codes through an ATM.

This means the Wirex Visa Debit Cards issued in the APAC region by Novatti are being sent out with a default PIN code consisting of the last four digits of the credit card number. As there is no way to change the PIN code this means;

1) If the physical card is stolen all the funds can be drained from the account as the PIN code is the last four digits.

2) Novatti and/or Wirex are in breach of PCI DSS requirement 3.2 which forbiddens the writing down of the PIN code. As the full credit card number is printed on the card, this indirectly means the PIN code (last four digits) is being written down.

Furthermore Novatti has not responded in my attempts to contact them and report this issue, and Wirex is impossible to get in contact with due to their Chat bot type support. So hopefully someone from these companies sees this post and fixes the core issues by;

1) A random number should be used for the PIN code when being issued.

2) Wirex needs to implement changing of the PIN code in the WirexOne app.