> the bits stating the card has Chip-and-PIN can be turned off from the magstripe This is true, but it's not the last line of defence, right? The bank could st

> the bits stating the card has Chip-and-PIN can be turned off from the magstripe This is true, but it's not the last line of defence, right? The bank could still reject the transaction if it sees a chip card used to do a magstripe transaction on a chip-capable reader. That relies on the reader providing that information to the bank, though, and while I believe the EMV protocol can do that, I don't know if that's used for magstripe transactions (talking purely reader to bank here, not reader to card). I don't think it can be fairly considered a security issue that the “I'm a chip card, why are you swiping me” bit is on the magnetic stripe. It's obvious that doesn't protect against modification, but it's not supposed to! Hell, it's probably only meant to be a reminder anyway, as you can subvert it by making the card reader think the chip isn't working.