3 ms·

This is a great example, I'll give you the details: If USA had adopted EMV technologies, when the criminals attempted to perform a transaction with their mag s

This is a great example, I'll give you the details: If USA had adopted EMV technologies, when the criminals attempted to perform a transaction with their mag stripe fraudulent cards, the system would recognize it as an EMV enabled card based on the mag stripe track data. The fraudster would be forced to use the chip on the card, and their whole scheme fails. In short: Because the EMV wasn't accepted at these machines, mag stripe is used as a backup. If they had used EMV, they would have forced that option and not accepted mag stripe. The two-part attack is only how they stole the cards in such a mass manner and increased their limits - They could have stolen all the mag stripe data with skimmers and cameras. Even though others are working hard to protect payment technologies, it does nothing to help countries who fall behind. EDIT: Program a BLANK CARD? I'm sorry, are you suggesting that it would be easy to obtain encryption keys from Visa/Mastercard/Interac etc? Do you know what you're suggesting?

woobar 13y ago
I am not suggesting, I am asking. Banks issue chip & pin cards all the time. These guys already breached a bank. I'd guess programming chip & pin cards will cost thieves more than magstripe cards, but is doable. Also, you keep insisting that if USA adopted EMV, this would not have happened. But this operation was global, thieves used ATMs in Russia, Japan, Britain, and Canada among others.
- JimmaDaRustla 13y ago
  Not every machine has enabled it yet, but the merchant services provider is responsible for the damages of not facilitating the chip card. This operation would not have been as successful if the only ATMs available were the off-branded machines found in the corner of bars. To answer your question though, I guess it would be possible, but they would need to skim the card data RIGHT at the time of card production in the personalization machine as it holds the proper encryption keys - nearly impossible. Banks typically don't do their own manufacturing (I don't know of any bank that does) and these systems are typically disconnected. This is worlds apart from what they actually did - dumping or generating mag stripe data, including the PIN Offset and writing the data onto cards like library cards, or hotel room cards. In addition, with EMV, the card is encrypted and verified using the issuer's public key, as well as the Certificate Authority's public key. Even further, Visa/Mastercard have their own multi-tier encryption that gets applied to the cards. I'm really getting over my head in the manufacturing process, but it is incredibly more complicated and secure than the old mag stripe days.

woobar 13y ago

I am not suggesting, I am asking. Banks issue chip & pin cards all the time. These guys already breached a bank. I'd guess programming chip & pin cards will cost thieves more than magstripe cards, but is doable. Also, you keep insisting that if USA adopted EMV, this would not have happened. But this operation was global, thieves used ATMs in Russia, Japan, Britain, and Canada among others.

JimmaDaRustla 13y ago
Not every machine has enabled it yet, but the merchant services provider is responsible for the damages of not facilitating the chip card. This operation would not have been as successful if the only ATMs available were the off-branded machines found in the corner of bars. To answer your question though, I guess it would be possible, but they would need to skim the card data RIGHT at the time of card production in the personalization machine as it holds the proper encryption keys - nearly impossible. Banks typically don't do their own manufacturing (I don't know of any bank that does) and these systems are typically disconnected. This is worlds apart from what they actually did - dumping or generating mag stripe data, including the PIN Offset and writing the data onto cards like library cards, or hotel room cards. In addition, with EMV, the card is encrypted and verified using the issuer's public key, as well as the Certificate Authority's public key. Even further, Visa/Mastercard have their own multi-tier encryption that gets applied to the cards. I'm really getting over my head in the manufacturing process, but it is incredibly more complicated and secure than the old mag stripe days.