3 ms·

You are confusing a few things here. First, the chip cards are still vulnerable to man-in-the-middle attacks, which is what the modern intermediate devices now

by rsj_hn 6y ago

You are confusing a few things here. First, the chip cards are still vulnerable to man-in-the-middle attacks, which is what the modern intermediate devices now do, even though many still call them "skimmers" out of habit (some are advocating for the similar-sounding "shimmer" to describe these devices). They are quite effective at stealing from Europeans just as well as they can steal from Americans, except Americans are not on the hook for the stolen funds whereas Europeans are. Here's a Krebs on Security article that has pics of a shimmer found in Europe in 2015: https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip-based-cards/ https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip... There was 1.8 Billion in chip card fraud for cards issued in Europe in 2018, with the highest rates of fraud in France and the UK in Europe in 2018, although only 20% is at Point of Sale and 80% is online. But the real difference vis-a-vis the US and Europe is not chips in cards but the massive epidemic of wholesale identify theft in the U.S. The vast majority (in terms of dollar amounts) of credit fraud in the US is part of identity theft, something the US suffers from due to lack of consistent ID cards and ID card enforcement - and very little todo with chip and pin technology. The US has 24 B in credit fraud, the majority of which is identity theft, and the largest amounts related to entire bank accounts and fraudulent loans being taken out, lines of credit being issued in someone else's name, etc, and not some illegal transactions stolen at gas stations with intermediate devices.

sixbrx 6y ago
Chip cards are vastly safer. From the article you linked about shimmer attacks: “The only way for this attack to be successful is if a [bank card] issuer neglects to check the CVV when authorizing a transaction,” I'm betting the European cc fraud is mostly from residual magnetic stripes or online forms being used, not the chip usages. Do you have a specific breakdown?
- rsj_hn 6y ago
  I think you are misreading the article, so let me be clear: If you enter your card in a compromised device, then you lose control over 1) how many transactions are being made 2) who you are paying 3) how much Because the chip has no way of asking you for confirmation about the identity and amount of the transaction. There is no secure keypad entry connected to the chip or secure bus going out. All you have is physical presence. The chip can prove to the input device that it is present, and the input device cam forward that proof to the bank. That is all the chip does. It does not prevent you from paying the wrong person, and it does not prevent you from paying the wrong amount. This is why compromised input devices are created, so that you can be charged the wrong amount and to the wrong party when you think you are buying gas. The chip only guarantees physical presence. Checking the CVV is only when there is no presence and you are trying to milk the attack into an offline attack rather in addition to the MITM attack. Why are offline attacks also possible? Because vendors want to support online purchases, where there is no physical presence. But that' not the MITM attack I was describing. Offline (card not present) transactions are a second issue, and indeed they are much larger (80-20) not present:present in terms of card fraud, but you don't need shimmers to conduct card not present fraud, although you can certainly use them for that. Finally, not verifying CVV is not an abuse of the protocol, it's how you do a card not present transaction, which is also supported in the same payment protocol. It's not some weird form of protocol violation vendors are all mysteriously doing. It is not "doing it wrong".
  - deleted 6y ago
    [deleted]
Nebasuke 6y ago
There's also a reason it's much higher in the UK (I don't know about France) and it's the online component. The UK has long card numbers for debit cards, often usable online with just your credit card number + CVV, similar to how US credit cards work. This is not the case for debit cards in a good number of other European countries. For example, my Dutch card can only be used physically at an ATM using your PIN, or online by using a payment system like iDEAL for which you need bank login details + password (which is not stored on the card). It does not have a long card number like most US debit/credit cards.
- rsj_hn 6y ago
  In both the US and EU, credit card fraud is 20% POS and 80% online.

by rsj_hn 6y ago

sixbrx 6y ago

Chip cards are vastly safer. From the article you linked about shimmer attacks: “The only way for this attack to be successful is if a [bank card] issuer neglects to check the CVV when authorizing a transaction,” I'm betting the European cc fraud is mostly from residual magnetic stripes or online forms being used, not the chip usages. Do you have a specific breakdown?

rsj_hn 6y ago
I think you are misreading the article, so let me be clear: If you enter your card in a compromised device, then you lose control over 1) how many transactions are being made 2) who you are paying 3) how much Because the chip has no way of asking you for confirmation about the identity and amount of the transaction. There is no secure keypad entry connected to the chip or secure bus going out. All you have is physical presence. The chip can prove to the input device that it is present, and the input device cam forward that proof to the bank. That is all the chip does. It does not prevent you from paying the wrong person, and it does not prevent you from paying the wrong amount. This is why compromised input devices are created, so that you can be charged the wrong amount and to the wrong party when you think you are buying gas. The chip only guarantees physical presence. Checking the CVV is only when there is no presence and you are trying to milk the attack into an offline attack rather in addition to the MITM attack. Why are offline attacks also possible? Because vendors want to support online purchases, where there is no physical presence. But that' not the MITM attack I was describing. Offline (card not present) transactions are a second issue, and indeed they are much larger (80-20) not present:present in terms of card fraud, but you don't need shimmers to conduct card not present fraud, although you can certainly use them for that. Finally, not verifying CVV is not an abuse of the protocol, it's how you do a card not present transaction, which is also supported in the same payment protocol. It's not some weird form of protocol violation vendors are all mysteriously doing. It is not "doing it wrong".
- deleted 6y ago
  [deleted]

Nebasuke 6y ago

There's also a reason it's much higher in the UK (I don't know about France) and it's the online component. The UK has long card numbers for debit cards, often usable online with just your credit card number + CVV, similar to how US credit cards work. This is not the case for debit cards in a good number of other European countries. For example, my Dutch card can only be used physically at an ATM using your PIN, or online by using a payment system like iDEAL for which you need bank login details + password (which is not stored on the card). It does not have a long card number like most US debit/credit cards.

rsj_hn 6y ago
In both the US and EU, credit card fraud is 20% POS and 80% online.