You are placing an order with an online retailer. To complete a purchase, your web browser sends a single encrypted, authenticated message to the web site, consisting only of the following information: a) your credit card information, b) the item number and quantity being ordered.

Say an adversary is sitting between you and the retailer, with the ability to intercept traffic and send messages. Describe an attack the adversary could carry out to max out your credit card. What type of attack is this?

What could the retailer do to prevent this attack, simply by changing what data is sent in the single encrypted, authenticated message?