OnePlus Disables Credit Card Processing After Customers Report Fraudulent Activity

"Card payments are handled by CyberSource, the processing form is still hosted on the OnePlus infrastructure," said Fidus. "If an attacker had write access to this page, JavaScript could have been inserted to compromise data entered into CyberSource’s payment form on the client-side."

While OnePlus at first remained quiet regarding the matter, it has since opened up with a FAQ posted on its discussion forum. The company initially provided the following statement on Monday morning:

At OnePlus, we take information privacy extremely seriously. Over the weekend, members of the OnePlus community reported cases of unknown credit card transactions occurring on their credit cards post purchase from oneplus.net. We immediately began to investigate as a matter of urgency, and will keep you updated.

After doing further digging into the reports of credit cards being compromised, the following update was posted:

As a precaution, we are temporarily disabling credit card payments at oneplus.net. PayPal is still available, and we are exploring alternative secure payment options with our service providers.

According to an informal poll posted in the original thread that shed light on the fraudulent activity, over 200 customers have seen unauthorized charges appear on their credit cards after using them on OnePlus' website.

"Same here, [purchased] phone beginning of December 2017 I was informed yesterday by my Credit Card issuer that they had detected what looked like fraudulent transactions," wrote vobemarsh. "Over £1000 of fraudulent transactions added to my account over the weekend. Card now cancelled waiting for replacement."

OnePlus vows to keep customers in the loop and provide updates on its findings after it completes a thorough audit of its payment processing service.