Key barrier to online fraud can be bypassed for pennies, say researchers