3 ms·
> I'm more than a bit irritated with this since without the pin you can 'skim' chip cards just as easily as you can magnetic cards. Huh. I assumed that the chi
by function_seven 9y ago
> I'm more than a bit irritated with this since without the pin you can 'skim' chip cards just as easily as you can magnetic cards.
Huh. I assumed that the chip had a secret it used to pass a challenge-response type of thing. Can you skim a chip just by observing the data bits that go in and out of it?
- ChuckMcM 9y agoKrebs on 'shimmers' : https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip-based-cards/ https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip...
- function_seven 9y agoThanks. From that link: The reason shimmers exist at all is that some banks have apparently not correctly implemented the chip card standard, known as EMV (short for Europay, Mastercard and Visa). Ok, so my assumption was right—in theory—but of course they screw up the implementation!
- lightedman 9y agoSay I'm a cashier at a retail location. All I need to do is say our system is down, carbon-copy-swipe your card number, CCV, and expiration date. You'll give me your Zip code and billing address when I ask for them "to verify the transaction with the card issuer later on when the system comes back online." I don't need your signature since that requirement is gone now. I can sell that CC info for money or I can make a few fraudulent purchases online where no card is required to be present. Card fraud is embarrassingly easy in the USA if you're in the right position of employment, even in lower rungs of employment.