The 3DS Oracle: BIN Attack via the Network
EMV 3-D Secure (3DS) requires a client-visible continuation boundary in browser-mediated flows; in some deployments, that boundary exposes a pre-authorization classification channel. This paper studies 3DS as a protocol, integration surface, and governance problem, combining standards analysis, architectural reconstruction, formal modeling, a documentation audit, disclosure history, and a bounded live evaluation. We show that client-visible integrations can reflect routing and authentication state before financial authorization, allowing 3DS to function as a profiling and screening channel for issuer controls and cardholder/account state rather than only as a defense. In the tested browser-channel Braintree/Cardinal path, the first client-visible result separated researcher-owned anchor cards from bounded adjacent same-range comparison PANs in six of seven distinct ACS/card-range cohorts; separate public evidence, including openly accessible attacker tooling, rotating-proxy support, and illicit paid 3DS card-testing services, shows that comparable signals are already operationalized in the wild. Our live study was deliberately bounded for ethical reasons, so the empirical ceiling reported here reflects researcher restraint rather than an attacker-side scalability limit, although we do not claim network-wide prevalence or candidate issuance. The deeper issue is systemic: decoupled pre-authorization authentication, weak requestor-boundary assumptions, identifier-linked routing invariants, and fragmented accountability let the exposure persist even when individual actors appear locally conformant. Meaningful remediation therefore requires consortium-level reform, including stricter minimization of client-visible pre-authorization responses, more uniform continuation behavior, and stronger client authenticity and session binding.