Credit Card Fraud Could Peak In 2015 As the US Moves To EMV 449
dkatana writes Some analysts expect fraud to increase this year as thieves will step up their efforts to capture more credit card details before the Europay, MasterCard and Visa (EMV) standard conversion goes into full throttle. The next time U.S. cardholders receive a new card it will probably be equipped with an EMV chip, and most likely be contactless. The U.S. is finally making the transition to secure cards based on the European EMV standard, mostly because the liability shift imposed by the three big credit card brands — Visa, MasterCard and American Express. The European Union, where EMV became standard ten years ago, has the lowest level of credit card fraud in the world, while the U.S. accounted for 47.3% of the worldwide payment card fraud losses but generated only 23.5% of total volume.
someone explain for the ignorant (Score:2)
Re:someone explain for the ignorant (Score:5, Informative)
Re: (Score:3)
I've already got two, both of which I acquired this week after switching from a card that yielded a lower cash back reward percentage. Neither have a contactless component (which I assume means some kind of RFID/NFC chip.)
Haven't yet seen any vendors with an ISO7816 reader though. Last time I used one of those for a payment method was when I was in the Army, and that was over 13 years ago. Obviously the technology hasn't caught on anywhere besides AAFES stores.
Re:someone explain for the ignorant (Score:5, Informative)
EMV is NOT contactless. If your new card(s) include electrical contacts, It's EMV .
Re: (Score:3)
EMV is not contactless in the same way that TCP/IP is not wireless. EMV is a payment specification, it can be done contact or contactlessly. There are contactless specifications based on EMV from all of the big card brands.
Re:someone explain for the ignorant (Score:4, Informative)
A hole punch in what? Did you kill the chip? There's better ways.
Simply hold the card up to the light and you'll see the antenna connections run around the outside of the card. A simple cut through the antenna will render the contactless payment inoperable without affecting the chip and the ability to use the chip+pin features.
Re: (Score:3)
This is an RFID only card - "VISA PayWave" - not a smart card so there's no chip+pin. Using the hole-punch on the RFID chip was very satisfying. Contact-less CCs are a gimmick to encourage thoughtless purchasing.
Re:someone explain for the ignorant (Score:4, Informative)
I'm in Argentina. My CC terminal (VeriFone VX520, issued by Visa since visa has this racket that you can only rent, and not own, CC terminals from them or Mastercard) has an EMV reader. Only really new cards in Argentina have this, and out of pure curiosity I tried it with a client's instead of the mag stripe and it worked fine.
Visa has been issuing these units for a couple of years and before that they had another model which also had an EMV reader. It's right under the keyboard. You stick the card in (like you do on an ATM) and you feel it "clicks" on a little switch that enables the chip.
So probably you have seen EMV readers. You just don't know you have.
Re: (Score:3)
Just about a month ago I got a emv chipped card from my bank. The grocery stores and a few other shops near me have that same type slot reader under the keypad you mentioned. I've been sticking my card in all of them when it prompts for an insert/swipe but I don't know if they're just not enabled around here or what because it never works and I always have to fall back to the mag strip.
The thing I don't like about it, is on the signature block on the back of the card I just write check id, then I put clear
There's no concern using RF (Score:3)
if you're using one-time pad encryption, which Apple Pay does.
Re:someone explain for the ignorant (Score:4, Informative)
Further, you DON'T WANT it to operate by NFC, or anything RF for that matter. RFID, NFC, and other RF technologies have all been broken for some years now. I can't imagine what Apple is thinking, with its Apple Pay, but maybe they think they've gotten around the security holes in NFC. Remains to be seen.
There is plenty of information around about how Apple Pay works. All the communication can be in clear text and recorded by a dozen hackers, it doesn't make a difference, because the actual data sent through the insecure channel is safely encrypted.
Re: (Score:3)
Your info is a couple of generations out of date. Contactless EMV cards do ECDSA on chip.
Re:someone explain for the ignorant (Score:5, Interesting)
Saying NFC has been "cracked" is like saying that ethernet has been "cracked". It doesn't make any sense. NFC is just a transport layer, it doesn't have any encryption or security at all. You have to build that in at the application level that uses NFC to transfer its data.
NFC payment cards are secure. They have been in use in other parts of the world of ~15 years now. Japan started using them around 2000. There have been no mass thefts by people with big antennas or readers hidden under their jackets. The hacks you heard about were attacks on the phone's NFC software stack, similar to a bug in the TCP/IP stack of some desktop operating systems. Again, we didn't say that ethernet was "cracked" when that happened, we recognized that the implementation of the TCP/IP stack was broken.
Apple Pay = One time card numbers (Score:5, Informative)
NFC was first cracked on cell phones.
It doesn't even matter. NFC can send the number in plaintext for all I care. The Apple Pay app generates a one-time card number. After it hits the reader, it is useless.
http://techcrunch.com/2014/09/... [techcrunch.com]
Re: (Score:3)
EMV includes a contactless variation that Apple Pay implements.
Re: (Score:3)
"EMV is going to render a lot of crappy, insecure technologies obsolete (things like Coin, LoopPay, NFC, and many of the smartphone based "wallet" apps.)"
WAT? Yes, LoopPay and maybe Coin will be rendered obsolete, since I know LoopPay is magstripe based and hence it's going obsolete in October.
But for the rest, "EMV is going to render itself obsolete" - makes NO sense whatsoever. Apple Pay, Google Wallet, and all other known NFC payment methods ARE EMV!!!! In fact many of them are more secure than the "p
Re: (Score:3)
BBC newsnight - UK chip and pin credit and debit cards are insecure Feb2010 [youtube.com]
Part of the flaw is that the pin is confirmed by the card and not the sellers equipment / card network. That seems like an odd way of doing things since a fake card can simply lie about the pin.
Re:someone explain for the ignorant (Score:5, Informative)
Chip yes, PIN, no. In the US, "Chip-and-signature" is what we get, with extremely rare exceptions. It is more secure than the magstripe to stop massive hacks such as Home Depot and Target, but does nothing to stop stolen card fraud. Note that if your card does not support chip-and-PIN (it can support it even if it's not the default, but US banks aren't doing this), then you can't use the card at many automated kiosks (train stations, etc.) outside the US.
I disagree with the summary that contactless goes along with the chip - it doesn't. There are some banks offering contactless payment cards, but this is not common right now.
Re: (Score:3)
One thing that I wonder about is the definition of "fraud".
If C&P isn't as secure as banks say [cam.ac.uk], can the bad guys steal people's money but the banks deny it, saying that C&P is secure?
Re:someone explain for the ignorant (Score:5, Informative)
Chip & PIN is a liability shift. You're expected to protect your PIN, so if your account is compromised, you're assumed to be at fault.
Britain has had a lot of trouble with this.
Re: (Score:2)
so if your account is compromised, you're assumed to be at fault.
Even if C&P isn't secure. That's what I was afraid of.
Re: (Score:2)
Even if C&P isn't secure. That's what I was afraid of.
You missed part of what GP implied here. It ISN'T secure, and yes the banks HAVE hushed it up. When that didn't work very well, they tried shifting the responsibility.
They do have known vulnerabilities which have been exploited by fraudsters for years. It might be a while before U.S. fraudsters catch on to the new tricks, but you can count on that being a short time indeed. All they have to do is buy the information if they don't want to figure it out themselves.
Re: (Score:3)
It's still better than the magnetic stripe. But I agree - it's not as secure as it can be.
Compromised card readers are one item that can be used to spoof cards.
Re:someone explain for the ignorant (Score:5, Informative)
Chip & PIN is a liability shift. You're expected to protect your PIN, so if your account is compromised, you're assumed to be at fault.
This is not at all the case in the US.
When TFS says liability shift, they're referring to the merchants (at least, in the context of the US anyways.) The merchants have an agreement with visa, mastercard, et al (and the banks) that determines who is liable in the event of fraud. Presently mastercard/visa/amex assume most of the liability (and they very well better for the transaction fees they charge.)
Visa and mastercard have issued an ultimatum of sorts to the merchants saying that this will only continue for magnetic stripe until the end of 2015, after which the merchant assumes liability for fraud. The merchant can avoid that by simply replacing their POS systems with a chip and pin system, in which case visa/mastercard assume most of the liability.
For you as the card holder however, nothing has changed in that regard: The law in the US still stipulates that credit card holders can only be liable for up to $50 (which most banks waive these days.)
Liability shift to merchants (Score:5, Interesting)
My wife has a small company that accepts credit cards. As the parent comment points out, the credit cards want to push liability for fraud onto the merchants. This has two aspects
- First, the physical card: Chip and pin is standard here, which would be fine, but don't think your fees go down when they hand you the liability. My wife has, to my knowledge, never had a case a fraud in 20 years, but that doesn't matter either. Mastercard/Visa are completely in collusion, there is no competition, they can demand whatever fees they want.
- Second, the Internet: I wrote her first web-shops, including the payment processing. This has become completely impossible. The credit card companies impose ever more impossible rules. Ultimately, if you handle credit card numbers electronically, they began insisting on quarterly audits of your IT infrastructure. We used an ISP - so they were going to insist on auditing the ISP infrastructure. Our ISP was - shockingly - actually ok with this, but the whole nightmare just got too complicated. In the end, the rules appear to be nothing but a way of forcing you to use their approved payment processors - yet another way to suck money out of merchants.
Will some Internet payment service please, please spring up and actually give Mastercard/Visa some real competition? Paypal has been largely co-opted, Bitcoin is a joke - we need something that your average Joe can and will use. So far, nothing...
Re: (Score:3)
You might think Bitcoin is a "joke" but it's all you're gonna get. PayPal wasn't co-opted - they settled down into the state you would expect given that they have little competition and ultimately still rely on the banking / credit card infrastructure. Why do you t
Re: (Score:3)
Chip & PIN is a liability shift. You're expected to protect your PIN, so if your account is compromised, you're assumed to be at fault.
You sort of imply that this shouldn't be the case? I'm no expert but just wondering how a crook could get a PIN other than lack of reasonable protection from the owner? It seems a whole lot more secure than a scribble which is extremely trivial to imitate.
Re: (Score:3)
I stand behind you in the line, see you type your PIN into the terminal, wait for you outside, mug you, then use your card.
Really? You couldn't think of that one? It is that easy. They sell little "shades" for CC terminals to avoid this, but they are accessories. Most CC terminals don't have them.
Re:someone explain for the ignorant (Score:4, Interesting)
Yes, in fact they can, and this has happened in Europe. One problem with C&P is the "offline PIN" mode which doesn't exchange data with the bank. In the UK, at least, the consumer is liable for any fraud with a C&P card as it is assumed that if the PIN was entered correctly it was by the cardholder. In the US, all the card issuers assume liability for fraud, no matter what, so there is less incentive to require a PIN.
The article you linked to is informative, but as the US transitions to EMV, it will become harder for thieves to use magstripe cards.
As I noted earlier, the biggest benefit of EMV, with or without PIN, is that merchants and payment processors aren't holding on to vast quantities of card numbers, and card skimming becomes far more difficult.
Re: (Score:3)
One problem with C&P is the "offline PIN" mode which doesn't exchange data with the bank. In the UK, at least, the consumer is liable for any fraud with a C&P card as it is assumed that if the PIN was entered correctly it was by the cardholder.
Fairly sure this is not so in Norway, liability is put on the merchant because they are the only ones who can invest in systems to bring and keep terminals online. Even waiters at the table generally have online wireless terminals for this, apart from one bus company that apparently haven't updated their terminals in ages, a few old parking meters and a few remote cabins selling coffee and snacks to cross country skiers it's all online. I've used it if their line is down, but then it's in their interest to
Re:someone explain for the ignorant (Score:5, Informative)
As at the 1st of August last year you were no longer able to sign for purchases on your credit card in Australia. A pin became required for every transaction.
With regards to a contactless payment system, it is referred to here universally as paywave (even though that is Visa's name for it) and my AMEX, Visa and Mastercards all support that functionality. They contactless system allows an up to $100 purchase just by tapping your card on the reader. Kinda scary if you lose your wallet but soooooo convenient. Total transaction time is around 1 second.
Re: (Score:3)
Re: (Score:3)
Chip & pin is more secure than chip and signature. Simply because your average pleb can't tell a genuine signature from a forgery.
The setup in Australia means a pin is not required for transactions of under $100 but is required for transactions over. I assume that the risk assessment from the card companies is that under a $100 exposes them to a small risk for the increased usage that using contactless creates. Anecdotal evidence is that when my mastercard went contactless but my amex wasn't I pretty
Re: (Score:2)
Hmmmmm. I wonder how I would have responded to that when I was a checkout operator back in the day. My understanding is that the signature on the authorisation had to match what was written on the card. If it said CHECK ID and you hadn't signed like that I'm not sure I would have been comfortable putting the transaction through without getting my boss to authorise it.
Re: (Score:2)
Sadly, most clerks these days will even look at the "CHECK ID" on the back of my card and ignore it anyway. It pisses me off, but it's actually the rare person who will check it, so pointing it out just gets tiring.
Re: (Score:2)
In the 8 years I worked in a supermarket I never saw Check ID written on a card. In fact I had never heard of the practice till now, so I think it must be a US centric thing. But I potentially would have refused the card as the card says Authorised Signature. That would have ESPECIALLY been the case if you were getting cash out with the transaction.
Re: (Score:2)
And you'd have the signature. One on your pad or paper, and one on my license. It's much harder to fake the signature on my license, that's an official government document, whereas the signature on the back of my card was something I just did myself on my desk at home. If I was a crimina
Re: (Score:3)
Maybe it is a state or region thing then. Everyone I know in Brisbane calls it PayWave. PayPass is the Mastercard brand name
Re: (Score:3)
No idea. What do they do for people that are blind currently?
All I know is that you can't sign any more and have to use a pin. Also I wouldn't have though numeric dyslexia would stop you entering a pin in the same what normal dyslexia doesn't stop you writing. The challenge comes in the reading.
Re: (Score:2)
but does nothing to stop stolen card fraud
i guess you are talking about physically stealing a card. that's almost almost zero percent of the problem. that requires physical theft which criminals don't want to risk for the most part.
Re: (Score:2)
I received an updated CC from Bank Of America, and it's got a chip-looking thing, but didn't receive a PIN, and don't remember seeing anything where I had to request one.
Re: (Score:2)
Your next creditcard (in a couple years) will probably have a chip-and-pin system
most likely chip and signature. the difference being what you'd expect ... no pins, but signature verification required. the reason being that the big three are afraid people will spend less if they are forced to remember a PIN (yes, really).
chip and signature is arguably less secure, but it does prevent credit card cloning ... you can't clone the chip.
Re: (Score:2)
Yeah, I don't get this either. I choose debit just about everywhere because it's faster and more secure. It would be tempting for me to move my bank account specifically to get chip and pin if a bank were using that as a competitive advantage, but I don't know if that's even possible given the standard they've adopted.
Re: (Score:2)
Sad thing, the PIN part here in the US is optional. However, it does stop the sales clerk who swipes the card and uses it for mail order stuff.
As for mail order, I'm sure Visa/MC will continue to have a web object that pops up, asks for a PW or PIN, which is used for shopping via the Internet.
Is this a security increase? Yes, and much needed. Cloning a chip is a heck of a lot harder than writing down numbers or writing a magnetic strip on a blank.
However, because PINs are an option in the US, it won't be
Re: (Score:3)
As for mail order, I'm sure Visa/MC will continue to have a web object that pops up, asks for a PW or PIN, which is used for shopping via the Internet.
This is truly where credit card fraud is going to go in the next few years. As EMV rolls out in the US (finally!) credit card fraud is going to move online. Card not present transactions will be the next target and participation in multifactor authentication schemes like Verified By Visa and MasterCard SecureCode will become critical and possibly even mandatory.
Env is hacked, story is wrong (Score:2)
Chip and pin is an obsolete solution. Sure point of sale in person fraud went way down in Europe but online and telephone fraud went way up making total fraud almost the same. Meanwhile merchants lost the ability to contest fraud and had to pay for card readers. Bits expensive to replace lost cards. And it's been hacked multiple times already so it's not secure .
The only silver lining here is that forcing merchants to pay for new point of sale terminals will force an upgrade that can slipstream in apple p
Re:someone explain for the ignorant (Score:5, Interesting)
I got a warning message in Spanish when I took out money from the ATM in Cartagena, Colombia (Caribbean edge of northern South America). Since my money came out ok I didn't pay it much attention. My buddy who spoke Spanish, however, was pretty amused.
He said,
"Did you see that warning message," "Yeah?" "That warning message is telling you your card only has a magnetic stripe, and no secure chip-and-pin system which is really insecure and you should ask your bank to upgrade it for you. This is the same system the Europeans use. Fuckin' Colombia's banks, in South America is a decade ahead of the United States banking system when it comes to technology. Typical."
Re:someone explain for the ignorant (Score:4, Funny)
Re: (Score:3)
Driving through the gulf coast from Houston to Miami was a real eye-opener for me. I've been to 20+ countries and the closest thing I can compare their standard of living is to rural Peru.
Re: (Score:3)
Honestly, it means what Europe was using 20 years ago, and what much of the world has been using for at least 10 years is slowly being adopted by American banks.
In the mid 90's we talked about chip-and-pin cards in a crypto class, and I knew people from France who had them. I've had one in my pocket for at least 10 years.
Essentially American banks move at glacial speed, and are taking up what is now fairly old technology.
Why American banks move so slowly? I can't say.
Re: (Score:2)
Re: (Score:2)
Chip and pin: You enter a pin with each transaction and the chip on the card generates a separate key for every transaction.
But in the US we'll get chip and signature most of the time.
Worry it not... (Score:2)
Re: (Score:2)
Well they never did steal from "minions" using this method anyways. For the last 40 years or so, the law has put a limit of $50 on credit card liability, but almost all banks these days just give you zero liability (technically as a courtesy, but if they don't, their competitors do, which is why almost all of them offer zero liability anyways. You have to have really absolutely terrible dog shit credit to not be able to find somebody that offers it.)
Well... (Score:4, Insightful)
Re: (Score:2)
Just because it has the chip and pin portion doesn't mean it has to have the contactless part as well. My debit and credit card for years (in Canada) were chip and pin, but not contactless. I just recently got cards that are contactless. Given that the maximum transaction size is $50 and it's a one time thing, I'm not really that worried about it, especially when it comes to my credit card where I have $0 liability.
Re: (Score:2)
You dont need to make one, just buy one of the many varieties of metal credit card wallets already on the market that do the job of blocking the cards just fine.
Re:Well... (Score:4, Informative)
Re: (Score:2)
Honestly speaking, those little sleeves are snake oil products sold by people praying on your fears of "them hacker kids." Much in the same vein as those "radiation blocking" stickers for cell phones.
Sure, it can be used to pull the card numbers on the older contactless cards, but those alone aren't sufficient for a transaction. On the newer ones it has to establish an active two-way communication with a card, and at some point a PIN has to be entered as well in order for an actual transaction to happen.
Sti
Re: (Score:3)
Re: (Score:2)
The readers are very low powered so unless you actually put your wallet against the reader with multiple cards in it this isn't a issue. Just pull the card you want to use from the wallet. Yes, I have multiple contact less cards on me. A couple of credit cards and travel cards.
Re: (Score:2)
Actually I don't think you need to. All my cards have contactless capability and the net effect is that the readers seem to be unable to separate 1 card from the other. It is also the most common cause of failure of the contactless systems that I have encountered. It picking up more than 1 chip.
Re: (Score:2)
I've added a full wallet sized sheet of Mylar. I need to test that theory since it isn't fully enclosed, but maybe an easy solution. I'd much rather not have any stupid RFID cards at all, not that I'm even sure any of them are such, as I don't use it to pay.
Re:Well... (Score:4, Informative)
Time to make a Faraday Cage wallet.
Time to permanently disable contactless payment [hackaday.com] on all your cards.
Apparently the banks and credit card companies in some countries will send you a new card without the RFID on request. But here in Canada at least one company simply refuses to do this. My bank DID disable contactless payment on my new debit card in their records, but of course the RFID is still physically intact so there's no guarantee that it won't suddenly start working as a result of some administrative fuckup. I'm going to call about my new credit card, but I'm pretty sure they'll tell my politely to piss off. At that time I plan to get out my drill, put a hole in the appropriate place, and test. If it disables Tap and Pay, then all of my cards will get the same treatment.
Re: (Score:3)
EMV has nothing at all to do with RFID cards
Yes, it does [emvco.com]. EMV specifies both a contactless and a direct chip contact method. It just so happens that contactless EMV matches the specifications of PayPass and PayWave. Which makes sense, considering they are the M and V of EMV.
Captial One started awhile ago... (Score:2)
When I got my 2nd new card in a year (Target & Home Depot hacks) it came with the chip. Also the numbers are no longer the pressed-in type and are on the back. Every time I've used it I have to let the person know the last 4 numbers are on the back.
I'm still hoping more NFC in terminals and more support for Apple Pay. The handful of times I've used that, it's been much fast
Re: (Score:3)
Re: (Score:3)
Because maybe I know that MITM attacks aren't the only way things become compromised.
Software flaws are becoming increasingly attractive attack vectors for criminals.
Also perhaps its also because Apple has a terrible track record for taking responsibility for stuff ups and blaming the user when it all goes horribly wr
Re: (Score:2)
The handful of times I've used that, it's been much faster and it is more secure.
and how did you determine that?
Efficiency and Progress! (Score:2)
As the US demonstrated during the recent massive-clusterfuck-in-a-casino financial meltdown, advances in technology and worker productivity now allow the production of enough fraud to supply the entire industrialized world by a relatively small number of highly trained knowledge workers!
Why, then, should we have an inefficient, unproductive, labor force of blue collar criminals laboriously committing fraud, by hand, like some sort of pre-industrial master/apprentice
Black Hat 2014: A New Smartcard Hack .. (Score:2)
Re: (Score:3)
The difference is that because these cards are "fraud proof" the bank will refuse to reimburse you for the fraud, and will instead leave you on the hook for the bill. In some cases the banks have actually had people arrested for daring to say that they were the victims of fraud.
The credit card companies aren't doing this for you, they aren't doing it for security, they're doing it to shift the risk.
Re:Black Hat 2014: A New Smartcard Hack .. (Score:5, Informative)
Rubbish.
I have had credit card fraud on a card of mine that had a chip and pin. The crim racked up $25k in flights in a couple of hours. I got a call from my bank asking me about the transactions as it had set off alarms, I said it wasn't anything I had done. Card got cancelled immediately, new card arrived 3 days later and the $25k was immediately refunded. The bank then went through every transaction for the last 3 months and flagged ones they thought were suspicious and once I confirmed they were nothing to do with me those too were refunded.
My experience has always been very positive when it comes to issues with my cards.
Re: (Score:2)
once I confirmed they were nothing to do with me
You have a computer and it's the second decade of the 21st century. How did you not see them?
Re: (Score:2)
Because I have a wife whose card hits the same account and I don't go through my back statements each month. I put EVERY transaction on my credit card, from buying a coffee to parking to supermarket and everything else in between. That means my credit card statement is LONG. Yeah I know I should keep every receipt and check it against the statement at the end of the month but no.
Re: (Score:2)
In the US the maximum fraud liability for any fraud reported within 24 hours of discovering the card is lost (not from when it was lost) is $50.
This is federal law, they try to stick you with anything more than $50 and they would be up for some serious penalties and as a result they won't. Most just wave the transactions because alienating a customer for $50 isn't worth it.
It doesn't matter what the technology or fraud prevention is because they simply can't charge the customer if the customer reports the f
What about the online use of these cards? (Score:2)
Same 16 digit code, expiration date and CCV?
Re: (Score:2)
Yes no change.
Australia has had chip and pin systems for the best part of a decade. And prior to that were magstripe and pin. Purchasing online is still just the numbers. same with ordering over the phone.
Re:What about the online use of these cards? (Score:4)
Not that it matters - US vendors will fight this to the bitter end. I already have cards with a chip in them (not sure about the "pin" part, since I certainly don't know any pin to use with them), one of which I've had for over five years. And I have *never* found a merchant that it works in any mode other than "swipe and sign". My local supermarket actually has readers compatible with them - And have intentionally disabled that feature because it "confuses" people - Damned straight, it confuses people! It confuses the hell out of me that you've intentionally made your readers insecure, and that after a major breach a few years ago!
Fuck the PCI, and fuck merchants. Give me security or pay me real penalty-money when your latest data breach results in my identity getting stolen. None of this "$50 maximum liability" bullshit - You lose my identity, BAM, $100k in my pocket. Anything less, and we'll keep hearing about the latest record-breaking breach-of-the-week.
Re:What about the online use of these cards? (Score:5, Informative)
My bank has an additional layer of security for when you purchase online. When you purchase with the credit card it spawns a page that comes from my bank. I gave it a personal statement that it uses to show that it is real - ie "Your wife's favourite food is potato chips" and then it asks for a password. If I give the correct password the transaction will go through.
Re: (Score:3)
Bruce Schneier (IIRC) described the obvious hack for that the day Visa came out with it...
The attacker (whether a fake merchant, or a MitM) waits for a request for you to verify your identity. It then presents your information to the real site (keep in mind the attacker builds this connection, so encryption doesn't mean a damned thing). The real site responds with your known prompt-
Re: (Score:2)
It a combination of things. Sure you can photocopy a card if you can get access to it for long enough but
requiring a pin forces the customer to go to the card reader or the card reader to be brought to you. This
reduces the window when the card can be photocopied or the magstrip being fraudulently read. Add to
that the CC# is tagged as requiring a pin so you can't just put the details onto a blank and use it.
Online transactions still need the CCV.
No security is perfect.
Re: (Score:3)
Got one of those cards (Score:2)
Chase Visa Freedom sent me one of those chipped credit cards a month after I thought about asking for it for upcoming trip to Europe on vacation.
The instructions that came with it said that there is no pin code for the card and that it still comes with the magmatic strip and can be used normally like that. So it appears that the presence of the chip is only for compatibility and compliance with a new standard not actual security since it falls back to the insecure magmatic strip or even less secure numbers
Translation (Score:3)
US businesses are as incompetent and insecure as Sony, but can be provoked into taking absolutely minimal action when their profits are under direct threat by sufficiently powerful financial organizations. You mean nothing, you never have, you never will. You have no say, you have no power, you have no rights, you cannot walk away. You aren't the customer, merely the product. Easily replaced if damaged.
You aren't getting security because security matters. You aren't getting security because you matter. You're getting it because two vendors and a trading bloc said so.
It's no wonder fraud is rife in the US (Score:3)
So it's hardly surprising if the US receives the highest amount of fraud. It's trivial to skim the details because it's all stored on the magstripe, stores hold the info in arcane systems, there is no authentication and there is no financial burden on the store if fraud occurs.
Chip and pin isn't perfect but it's FAR better than the US system. In Europe every business has a chip and pin device. Restaurants have a portable chip and pin device. Supermarkets and stores have one at the cashier. You pay by sticking the card in the device and authenticating with it. There is less scope for the card to be skimmed because the card never leaves the customer's hands. There is less scope for a malicious store because authenticating and authorisation is via a secure payment system.
Ideally cards wouldn't even have a mag stripe any more. Give businesses 5 years to replace their decrepit equipment and banks to upgrade their ATMs and then get rid of them. Chip and pin and NFC cover the same use cases and provide better security into the bargain.
There's not copying only (Score:4, Insightful)
I'm from Europe and I have had such cards for 10 years.
I was hit twice by thieves, once an hotel reception guy in Rome copied my card details and bought stuff for 4500€ online, another time it was a restaurant in London who did it the same thing.
Both times a simple email was enough to avoid having to pay, but chips don't help there.
They only make copying the cards themselves a bit more difficult.
You still have to check your account carefully each time.
Re:US: Welcome to the present (Score:5, Insightful)
Ya, no shit. As someone who is from downunder, holy CRAP America is in the dark ages when it comes to its banking and communications systems.
Jesus christ.
And the funny thing is, they are so blissfully unaware things are better elsewhere in the world because none of them ever go anywhere anymore.
Re: (Score:3)
Lol. Given that chip and signature is no longer allowed in Australia it seems kinda funny that the US is moving to a system that was abandoned because it wasn't secure enough.
Re: (Score:2)
The premise behind chip & signature in the US being the initial deployment is that card holders are not ready to abandon their signature for credit transactions.
Having seen what passes for a signature leads me to doubt this will last very long.
Re: (Score:2)
They did the same here. Chip and signature or pin for a 2 year period and now pin only. It just strikes me as funny / odd that it hasn't rolled out to the US already.
Re: (Score:3, Interesting)
Re:US: Welcome to the present (Score:4, Insightful)
Re: (Score:2)
Having seen what passes for a signature leads me to doubt this will last very long.
This. I've been signing various cards with a smiley face for years. Or George Bush. Or just an 'x'.
Nobody cares.
Re: US: Welcome to the present (Score:2)
Re: (Score:2)
Yeah, different societies are sort of weird that way, with varying levels of technology in specific areas, even if they're otherwise roughly equivalent. One example: I've heard that many Japanese homes use minimal insulation and don't have central heating [wideislandview.com]. Instead, they use portable kerosene heaters or heated tables called a "kotatsu", which always struck me as rather primitive, if somewhat quaint. Then again, they'd probably laugh at how primitive our toilets are [youtube.com], despite all our other high-tech gadgets
Re: (Score:2)
When EMV is fully deployed in the US, then fraud detection will be most effective for card-not-present transactions. You know, Amazon, PayPal, your water bill. Those are the databases to go after.
And eventually most merchants will go to tokenization, converting the card data to an encrypted version that requires a key to decrypt, and said key and encryption method being limited to the intended parties. It can work well.
Re: (Score:2)
Actually, RFID with no PIN is a massive step backwards from mag-stripe, sure mag-stripe could be easily copied, but RFID doesn't even have to leave your pocket to get copied, and there are many proof of concepts in the wild for this already.
I live somewhere where ALL credit and debit cards have chip and pin, unfortunately almost all the credit cards also have RFID. I've had long arguments with my banks and finally managed to get non-RFID cards, but it's really hard to get back up to the level of security pr
Re: (Score:2)
There is NO CONTACTLESS EMV. That is something else, RFID or NFC.
And not at all the same thing.
Shortwave frequencies = over-the-horizon snooping? (Score:3)
Unfortunately, peak fraud is ahead of us with the widespread adoption of a poor implementation of RFID. The EU and ROW were wise to jump to chip and pin while the US dragged its feet for a decade with cashiers expected to be CSI signature verification specialists. But the move to pinless RFID rolls security back to the days when cashiers were expected to peer through lists of bad credit card numbers. Actually it's worse than that because card dup information is conveniently broadcast on 13.5 MHz, in the 22