3 ms·

Re: Thieves stealing from thieves ... I worked(*) with a credit-card scammer who brought in a software for creating "yes-cards": Cloned Creditcards that had co

Re: Thieves stealing from thieves ... I worked(*) with a credit-card scammer who brought in a software for creating "yes-cards": Cloned Creditcards that had corrupted chip and pin settings(See https://www.zeit.de/2016/05/kreditkarten-banken-betrug-sicherheit-kriminalitaet https://www.zeit.de/2016/05/kreditkarten-banken-betrug-siche..., sorry its only in german). It was unheard of at the time that you could do this. So we set up a test to clone a credit card of ours. The kicker was, the software didn't work when you disconnected the computer it ran on from the internet. Security mechanism from the creator? Nope, it turns out after tracing/dissassembly it sent the data from the cards to a third party to sell it. Our informant was first confused, then outraged. No honor amongs thieves! (*) journalistically!

TheJoeMan 5y ago
So to encourage merchants using Dip and Tap instead of swipe, brick and mortar cc processor companies said they no longer would cover fraud from cloned swipes. Sounds fine right? Except their own payment terminals after 2 or 3 dips/taps not working just go “fine just use swipe” -_-
- Nursie 5y ago
  That very much depends on the terminal settings and the merchant agreement with the acquirer…
- lelanthran 5y ago
  That's part of the EMV standards; the terminal parameters set by the bank or the merchant are combined with the card parameters set by the issuer to determine threshold for risk. A merchant or bank in a 3rd world country may decide on thresholds that effectively never do a fallback transaction.
- fsckboy 5y ago
  > cc processor companies said they no longer would cover fraud from cloned swipes. Sounds fine right? yes, and it makes sense that it would encourage adoption of the new dip-tap machines. That they can also swipe does not decrease the incented appeal of the new safer system
- syshum 5y ago
  In my experience CC Processors rarely covered fraud anyway (at least in the US). Which is one of the reason fraud is so wide spread Rare is the bank, and/or CC processor on the hook, it is either the consumer or merchant that is left holding the bag, if the Bank and/or CC processor were always on the hook for fraud, fraud would be almost impossible Same is true for so called "ID Theft" if the bank and/or other lenders where on the hook for that type of fraud "ID Theft" would also be impossible, but since consumers have to clean up their own victimization the banks and lenders just play lip service to fixing it
Nursie 5y ago
“Yes” cards were a threat but they had two problems - they could only work with static data authentication (which has hopefully been phased out by now) and the terminal itself would contain 1-in-n goes online regardless checks, plus limits for offline transactions. An oversight in the EMV specs certainly, but not a showstopper. IIRC I made one of these with an ICC Solutions programmable card about 20 years ago (in the context of building an EMV system at the time) I love the story there though :)
- kappuchino 5y ago
  Hey, you would not believe that if I had no proof ;-) ... but the true cause of the "yes cards" was some kind of glitch on side of visa/mastercard AND the banks. So at that time some banks had not even issued chip cards to their customers. If you "cloned"/transformed the data from the magstripe to the chip and tweaked a few bits ... well, that confused the system and defaulted to "yes" due visa/mastercards setup/fallback. Naturally, this problem has sloved itself by now.

TheJoeMan 5y ago

So to encourage merchants using Dip and Tap instead of swipe, brick and mortar cc processor companies said they no longer would cover fraud from cloned swipes. Sounds fine right? Except their own payment terminals after 2 or 3 dips/taps not working just go “fine just use swipe” -_-

Nursie 5y ago
That very much depends on the terminal settings and the merchant agreement with the acquirer…
lelanthran 5y ago
That's part of the EMV standards; the terminal parameters set by the bank or the merchant are combined with the card parameters set by the issuer to determine threshold for risk. A merchant or bank in a 3rd world country may decide on thresholds that effectively never do a fallback transaction.
fsckboy 5y ago
> cc processor companies said they no longer would cover fraud from cloned swipes. Sounds fine right? yes, and it makes sense that it would encourage adoption of the new dip-tap machines. That they can also swipe does not decrease the incented appeal of the new safer system
syshum 5y ago
In my experience CC Processors rarely covered fraud anyway (at least in the US). Which is one of the reason fraud is so wide spread Rare is the bank, and/or CC processor on the hook, it is either the consumer or merchant that is left holding the bag, if the Bank and/or CC processor were always on the hook for fraud, fraud would be almost impossible Same is true for so called "ID Theft" if the bank and/or other lenders where on the hook for that type of fraud "ID Theft" would also be impossible, but since consumers have to clean up their own victimization the banks and lenders just play lip service to fixing it

Nursie 5y ago

“Yes” cards were a threat but they had two problems - they could only work with static data authentication (which has hopefully been phased out by now) and the terminal itself would contain 1-in-n goes online regardless checks, plus limits for offline transactions. An oversight in the EMV specs certainly, but not a showstopper. IIRC I made one of these with an ICC Solutions programmable card about 20 years ago (in the context of building an EMV system at the time) I love the story there though :)

kappuchino 5y ago
Hey, you would not believe that if I had no proof ;-) ... but the true cause of the "yes cards" was some kind of glitch on side of visa/mastercard AND the banks. So at that time some banks had not even issued chip cards to their customers. If you "cloned"/transformed the data from the magstripe to the chip and tweaked a few bits ... well, that confused the system and defaulted to "yes" due visa/mastercards setup/fallback. Naturally, this problem has sloved itself by now.