Gnosis Pay has made 3D Secure verification mandatory for all online card payments after detecting unauthorized access to its legacy consumer card system. The crypto payments provider identified the intrusion on November 3, 2026, and disclosed the incident publicly on November 6, confirming that some customer information was exposed. It reported no loss of customer funds.

The added verification checks will remain in place until December 20, when Gnosis Pay plans to retire the legacy consumer system. The company said its separate enterprise card platform, which powers white-label card programs for partners, was unaffected by the security incident.

Extra Verification Remains Until December Shutdown

Gnosis Pay said its security team began containment within two hours of detection. The company replaced affected credentials and addressed the underlying vulnerability. It has also increased monitoring of cards and wallets for fraud and attempted access to customer funds.

Mandatory 3D Secure adds an identity-verification step to online card purchases, requiring the cardholder to confirm a transaction with their card issuer before it can be completed. The mechanism is a widely used card-payment authentication standard, intended to make stolen card details insufficient on their own to complete an online purchase. The safeguards apply during the remaining life of the legacy consumer operation. Gnosis Pay had already announced plans to discontinue consumer interfaces and shift users toward partner applications. The company said its enterprise platform was unaffected, a distinction that limits the confirmed exposure to the older consumer system rather than every Gnosis Pay integration.

Company Notifies Customers and Privacy Authorities

Gnosis Pay said it emailed each affected customer on November 6. Those messages detailed the information accessed from individual accounts. The public statement did not specify the number of affected users or all categories of exposed data. It also did not identify the intruder or explain how the unauthorized access was obtained.

The company has notified partners and begun communicating with relevant data protection authorities and its card issuer. It is reviewing the incident and arranging specialist monitoring for possible misuse of the exposed information.

Gnosis Pay warned customers to be cautious of unexpected messages containing personal details or references to genuine card purchases. It said legitimate support would never request seed phrases, private keys, PINs, or complete card numbers. The advisory reflects a common pattern in payment fraud, where references to real purchases and personal details make fraudulent messages harder to distinguish from legitimate ones.

Data Obligations Continue After Consumer Card Retirement

The December shutdown does not mean Gnosis Pay will immediately erase all customer records. According to its published data guidance, identity and transaction records remain for five years after account closure, while support correspondence is retained for six years.

Customers can export card transaction histories through the consumer web app until December 20. After that date, they must request records directly from the company. Gnosis Pay noted that blockchain explorers cannot show merchant names or card-level transaction details, meaning customers cannot replace a card-history export with on-chain records.

The disclosure concerns customer information only and is separate from the June smart-contract exploit affecting Gnosis Pay wallets. Gnosis previously confirmed in its post-mortem that it restored the funds lost in that incident.

Source: Blockonomi