32 ms·
Is your chip card secure? Much depends on where you bank
- im3w1l 6y agoWhat if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? You'd still need a billing address I guess, but you might be able to get that by looking up the name and disambiguating using the location of the terminal.
- Nextgrid 6y agoA lot of merchants are starting to use 3D Secure now which is essentially two-factor authentication.
- Nursie 6y agoStarting to? It's been pretty standard for over ten years... (I'm in the UK, I have no idea how our market compares to yours)
- Nextgrid 6y agoI said "starting" to include the US which I expect to be still far behind. I agree that in the UK it's been standard and in fact EU regulations now make this mandatory anyway.
- ceejayoz 6y ago> It's been pretty standard for over ten years. It's unheard of in the US.
- untog 6y agoI used to live in the UK (and still visit often) but now live in the US. You'd be amazed how far behind US banking is, even compared to the UK ten years ago.
- tricolon 6y agoI'm in the US and have never heard of it.
- kergonath 6y agoIt’s common in Europe (I think it’s even mandatory now, though not necessarily for each transaction).
- Dylan16807 6y agoI've seen it once or twice ever and I didn't know the password it wanted.
- oneplane 6y agoDepends on where you bank I suppose. Also depends on where you credit. I can't use my bank card without mutual validation, same with my credit card. Even if you do it manually we still get a challenge-response that you use a hardware device or an app for.
- ceejayoz 6y ago> What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? Apple Cards have just the name on them, which is a nice step in the right direction. (No contactless, though, which is weird.)
- Nursie 6y agoWhy would you need it, you've got an iPhone right? (semi serious here - I'm sure they want you to use Apple Pay)
- WorldMaker 6y agoIf you want more convenience in your contactless payments, Apple suggest that you get a more recent Apple Watch. (Also semi-serious.)
- SomeHacker44 6y agoThere is a little thing called COVID. All my main payment cards are contactless now. I am not an Apple card customer.
- dhosek 6y agoI'm not an Apple card customer either, but I use Apple pay with my cards usually on my watch, although once in a while it doesn't work at a terminal and I have to pull out my phone (which is annoying since facial recognition doesn't work with a mask on). I understand similar things exist for Android.
- Nursie 6y agoSure, but if you have an Apple card you're going to have an Apple phone, most probably, and that can do the contactless bit for you. Not sure if apple cards and android phones work, but android-pay is the other option for most cards. Both are more secure than using the card directly with contactless - you have verified to your phone that it is you using it, by logging in with face ID, touch ID, passcode, PIN, whatever. It's a form of cardholder verification that is missing when you use the card. That was my (slightly snarky) point - you don't need contactless on the card when you have a smart device that does it better.
- gnopgnip 6y agoVendors get much less protection when doing a card not present transaction. They also usually pay higher fees. There are also cases where an additional layer of security is used, visa secure
- 8K832d7tNmiQ 6y agoAnother method would be a standardised QR code so that you can make a transaction from your app by scanning the qr code. I don’t know about other countries, but this is basically the premise of QRIS Technology [0] used in Indonesia, basically to put an end on competing in QR-based payment method. [0]: https://www.bi.go.id/QRIS/Contents/Default.aspx https://www.bi.go.id/QRIS/Contents/Default.aspx
- gruez 6y agoThe one thing I like about the credit card system (as opposed to "app" pay system) is that the usability is so much better. You don't have to worry about your phone being smashed or running out of battery. It's also less work than a phone, all you need to do is wave your card in front of a reader. No need to get out your phone, unlock it, open the app, wave around your camera so it scans, and finally confirming the payment. Not having to install a potentially privacy invading app is also a plus.
- ravenstine 6y agoWouldn't work in a lot of places where there's no LTE reception, though that will probably change with things like 5G and Starlink. I also wouldn't want my ability to pay to be tied to my phone. Not only do I want to be able to pay for things even when my phone is dead, but it just seems like it would add yet another vector of attack to steal my money.
- cesarb 6y ago> > Another method would be a standardised QR code so that you can make a transaction from your app by scanning the qr code. > Wouldn't work in a lot of places where there's no LTE reception, I happened to read about this recently (https://www.emvco.com/emv-technologies/qrcodes/ https://www.emvco.com/emv-technologies/qrcodes/), since it's going to be the base of Brazil's new instant payment system to be released later this year (PIX - https://www.bcb.gov.br/estabilidadefinanceira/forumpagamentosinstantaneos https://www.bcb.gov.br/estabilidadefinanceira/forumpagamento...). From what I understood, it does have a way to do offline transactions. There are two kinds of QR codes: one which is scanned by the app and used for both online and offline transactions, and a second kind used when offline which is presented by the app and scanned by the POS. This second QR code contains data similar to what a chip card would return to the reader during an offline transaction, so the transaction flow after that point is similar.
- castratikron 6y agoGuessing Visa can "fix" this problem in the same way they fix the fallback to magstripe: make the vendor pay a fee for noncompliance. https://www.cardfellow.com/blog/emv-fallback-fees-definitions/ https://www.cardfellow.com/blog/emv-fallback-fees-definition...
- csommers 6y agoThat’s exactly how it should be: party at fault gets charged.
- aerostable_slug 6y agoThey absolutely could, but I was told by folks there that the merchants were pushing back extremely heavily, hence the moving deadline to get rid of stripes. They were pretty clear that gas pump readers were the biggest issue, as customers dislike centralized outdoor readers or having to go into the establishment, stand in line, and use their counter POS system.
- lmilcin 6y agoHi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have absolutely no idea how cards differ and what the options are.
- whitepoplar 6y agoCan you give any recommendations on banks that really get it right? How about the inverse?
- dddddaviddddd 6y agoWhat features make a secure credit card and how can a consumer verify their presence?
- throwaway_pdp09 6y ago> because consumers have absolutely no idea how cards differ and what the options are Well if there's a time and a place to educate people, it's here and now. Your knowledge would be appreciated, TIA
- cosmie 6y ago> They get away with this because consumers have absolutely no idea how cards differ and what the options are. Do you have any tips/resources for how an interested consumer can become more informed (whether for personal or small business accounts)? Would you be able to get this type of information you'd be able to get to through contacting support, if you know the right way to ask? Or would it be considered too sensitive for the bank to give out implementation details that easily?
- rblatz 6y agoBut also banks take on all the liability for misuse. Customers aren’t liable for fraudulent charges, that’s why America has lagged behind Europe on rolling out chip cards, customers don’t demand it because they don’t pay the price for card fraud.
- Nursie 6y agoSo this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been retired over a decade ago.
- humaniania 6y agoMaybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.
- kevin_thibedeau 6y agoWon't work for gas stations which are the last holdouts.
- lsllc 6y agoThere's no reason why contactless EMV should not be required even at a gas station (not needing a limit).
- aerostable_slug 6y agoGas pump readers are very expensive. The solution for the wise customer is to go inside and use the POS terminal at the counter if possible. Old school gas station attack: many gas stations queue and forward transactions for reconciliation in batches, waiting to do so when they don't have connectivity. People have taken advantage of this fact by climbing up on the roof of stations with satellite connections for their POS terminals, tin-foiling them or otherwise blocking their transmission, then buying a bunch of gas with a stolen credit card. Head down to the next gas station, lather rinse repeat, and by the time things get figured out you've got maybe a hundred gallons of gas and a bunch of candy bars you can trade for meth (this is not a Bond Villain-level crime).
- samblogs 6y agoDoes anyone have a good detailed article on the crypto behind iCVV/dynamic CVV? This article summarizes how it works, but I haven't found a good detailed article after much googling
- bob1029 6y agoI found this from a public FirstData document: "Codes written on the track with equivalent data stored on the chip to prevent fraud. All chip cards are issued with the card security code on the track data stored on the magnetic stripe and chip card security code stored on the chip. Calculated with the same DES key but with a ‘999’ service code" https://www.firstdata.com/downloads/marketing-merchant/EMV-A-toZ.pdf https://www.firstdata.com/downloads/marketing-merchant/EMV-A...
- the_mitsuhiko 6y agoI will never understand why magstripe is still used in the US. Even after EMV became “mandatory” there are still magstripe transactions happening and when you are presented sith a chip reader it’s slow and awkward. Why is it such an inferior experience compared to Europe?
- abrowne 6y agoMy understanding for part of it is that magstip readers were much more common in the US, and businesses (a) didn't want to pay to upgrade all their terminals and (b) don't want to turn away a purchase because a customer doesn't have a chip or the chip isn't working.
- lsllc 6y agoThat may have been the case, but pretty much everywhere I go stores have newer EMV capable terminals (e.g Ingenico etc). The only place I really use mag swipe now is a gas station pump (who have no excuse not to switch to contactless EMV). You'd think with COVID-19, there'd be a rush to move to contactless payments.
- eli 6y agoA lot of people think COVID-19 is indeed the thing that will tip this into the mainstream default: https://www.bankingdive.com/news/will-covid-19-push-contactless-payments-into-the-mainstream/579579/ https://www.bankingdive.com/news/will-covid-19-push-contactl...
- Deathmax 6y agoA Monzo engineer describes nonconformance with specs which might lead some card issuers to be more liberal with what they accept: https://twitter.com/erincandescent/status/1281534456944361472 https://twitter.com/erincandescent/status/128153445694436147...
- Fiveplus 6y agoThat was interesting, thanks for sharing it here.
- bryanthompson 6y agoOn this topic, if anyone can point me toward a US-based issuer where I can open an account and get a card that supports credit pin (not pin for cash advance on a credit card), I'll happily venmo you a pizza or something. The issuers I have spoken to[1] all tell me it is impossible to get such a card in the US, which seems ridiculous. [1]: https://wallethub.com/credit-cards/chip-and-pin/ https://wallethub.com/credit-cards/chip-and-pin/ I discussed each of the cards noted here with the issuers, not one is actually chip+pin credit.
- lotsofpulp 6y agoI have inquired about this also and found no solution. If I use my US based credit cards abroad where chip and pin is the norm, I end up getting asked to sign a printed receipt. I imagine the card networks just don’t want to spend money to change the infrastructure to support chip and pin because the merchant pays for most the losses in the US?
- bryanthompson 6y agoThe liability shift in the US that affected most retailers occurred in October 2015 -- basically, merchants are and have been liable for fraud that occurs on swiped transactions. I'd be curious to find out how the example presented by the parent article could change this -- a valid-looking card that only has swipe would definitely be taken by a merchant for fraud, and if the card doesn't claim to be EMV-capable, it seems like this would not be the merchant's fault. I would think in 2020, however, a mag stripe only card would raise red flags with humans at the counter, but gift cards are this way, so perhaps they would just breeze right through.
- lotsofpulp 6y agoPrevious commenter and I were talking about chip and pin, not just chip (aka EMV). With EMV, someone can still use your card after they steal it. With chip and pin, that is far more difficult. I don’t know if merchant off the hook even with just chip, I presume the card networks kept some weasel language in order to allow them to blame the merchant.
- tzs 6y agoOK, so if I grasp this, the problem is that an EMV skimmer gets the card number and an iCVV. The bad guys make a stripe card with that number and the iCVV. That should not work because banks are supposed to look for the iCVV only on dipped transactions, and look for the CVV on swiped transactions (and the CSC for online/telephone transactions). Some banks apparently left out the logic of matching the type of code to the transaction method, and so using iCVV in place of CVV works for them. Even if all banks got this right, though, it seems to me you could still get fraud. The CVV is only three digits. Once you've got the card number just make a stripe card and guess the CVV. If it fails, try another CVV. As long as you don't do too many guesses too close together and cause the bank to lock out the card, you should eventually find the right CVV. Even if the bank is very trigger happy on fraud lockouts, if your skimmers got several thousand card numbers you are going to have many CVV guesses turn out to be right the first time. Instead of the stripe on cards that have both EMV and stripe being just a copy of the same card that is in the EMV side of things, shouldn't they be separate? The issuing bank should issue two logical cards for the underlying account, with one being EMV only and one being stripe/online only.
- kergonath 6y agoI would hope that a card would be flagged as suspicious before a hundred tries. They’d still could get some transactions through, but that would cut the success rate by a couple of orders of magnitude compared to just hoping that the bank won’t check. What really needs to be done is letting go of the magnetic stripe.
- donarb 6y agoI use my chipped card frequently when going to the grocery store. Pretty much 20% of the time, it won't read the chip, reporting "Chip Malfunction". Even wiping any sort of gunk off the chip contacts doesn't fix it. So you have to go through 3 failed read cycles before it will let you use the mag strip on the back. Going back to the store a few days later and the same machine will work, I wonder how often the machine's readers are cleaned.
- jack_h 6y agoI've had problems with the chips themselves. I had a card whose chip worked perfectly for maybe a year or more before I lost it. The replacement chip worked for about a week then I'd get a chip error every time and everywhere. So I got another replacement which didn't work out of the envelope. So I got a third replacement and it worked exactly one time before breaking. At this point I've just given up and insert the card three times before being forced to use the mag strip. I don't even know what else to do...
- meragrin_ 6y agoA cashier gave me a tip once. Try pushing on the face of the card so the chip end is levered up against the machine tighter. It seems like there is something wrong with the contacts in the reader and do not make appropriate contact with the chip.
- afrcnc 6y agoCan we link to the actual research instead of this people-doxing clown's article? Source: https://geminiadvisory.io/cybercriminals-deploy-emv-bypass-cloning/ https://geminiadvisory.io/cybercriminals-deploy-emv-bypass-c...
- homero 6y agoHard to read this site when it's not responsive and the one time I want chrome to offer reader mode, it doesn't.
- toolslive 6y agoHold on. PIN is not secure either. With the card reader, you can verify the pin locally: You don't need anything but the card and a card reader. No internet, no nothing. Since the verification can be done on the client side entirely it's subject to hacking. You can freeze the chip, slowing it down so you can actually see it run under a microscope. You can make it read-only (so the pin miss is not recorded on the chip, aso aso). There are recorded cases where the card also held a digital wallet and students made it read only so they had an infinite wallet for small expenses ...
- imtringued 6y agoMost credit card fraud happens by cloning an existing card because the victim will stay unaware of the crime. If you physically steal a card it will be frozen by its owner who will also pay close attention to suspicious transactions.