4 ms·
Chip based systems don’t prevent card skimming, in fact you also get the pin with those since you can still read the track 2 data and also get the pin with a sk
by dogma1138 7y ago
Chip based systems don’t prevent card skimming, in fact you also get the pin with those since you can still read the track 2 data and also get the pin with a skimmer that is placed on top or even inside of the pin and chip reader.
This is essentially the same exploit as ATMs with often lower risk since gas station pumps aren’t inspected for skimmers.
The only way to prevent track2 skimming is to remove the magnetic strip however there are also many skimmers today that don’t read the track 2 data but rather scan both sides of the card giving you the CC number, exp date, CVV/CVV2, issuer code (if present) and the card holder details then you can usually perform a card not present transaction fairly easily at best you’ll only have to match the card holder with a post code or a billing address however most issuers will let you pass security with any address that was tied to the card for the past 5 years so your google search results on the name doesn’t even have to be super up to date.
Basically anything but a bulletproof wireless E2EE system will allow skimming. And I’ve seen PoCs for near IR photographic skimmers that try to photograph the card from within the wallet or sleeve with moderate success.
- miohtama 7y agoI believe the goal of chip based system is to get rid of "your username is your password" problem of credit cards in the long run. Is the world ready to remove the magnetic stripe and numbers on the card? Only expose them through your online bank and keep them separate from the card. Then only some online payments will be vulnerable - like hotel bookings. For example Revolut cards still have the stripe, but the card details are hard to read, almost invisible for the eye unless under proper light