> No, there's not enough time for online authorizations at transit turnstiles. They do the online auth as fast as possible, and if it does not go through they p

> No, there's not enough time for online authorizations at transit turnstiles. They do the online auth as fast as possible, and if it does not go through they put the card on a denylist [1]. But since it would be possible to just make up random valid card numbers on the spot, they do enforce successful offline authentication – using asymmetric cryptography. Yes you’re correct. Although as it happens there is a very easy way to get hold of randomly generated valid card numbers. Which is Apple Pay, and is a huge problem for TfL. But again the asymmetric crypto here is just to validate the identity of the card, and to secure the communication between card and terminal. It doesn’t actually secure the transaction itself in any meaningful way. > That's true, but doesn't change the fact that offline authentication is an integral part of EMV. Also, the "then thrown away" part could relatively straightforwardly be changed by the networks if ever necessary. The CDA output provides actual non-repudiation. You ever been part of a network rule change of that magnitude before? I can tell you with some confidence there is nothing easy about. I’ve seen much smaller changes take decades to implement. Making rules change is easy, getting all the participants to implement the change, that’s an entirely different kettle of fish. > I do suspect that this could change, with EMV becoming more and more accessible for very small merchants using cheap mobile terminals or even regular contactless-capable smartphones. But as I've mentioned, it's not too hard to address these issues using policy. Nah I doubt it’ll change. There’s already policy level protections to protect against these cases. The standard chargeback process and the removal of merchants with high chargeback rates already prevents this behaviour. Malicious merchants already exist, but they defraud people mostly through social engineering, putting people in positions where they approve transactions they don’t want to, and make it extremely embarrassing for them the victims to report the crime. From the issuers perspective the only type of fraud where are our hands are completely tied, is the variety where customers refuse to admit they’ve been defrauded. Which does happen.