3 ms·

Do “swipe” terminals require CVV? Also there mentioned: “The data breach did not affect online purchases, the company said.”

yeukhon 13y ago
Oh I took that part for granted. Sorry. I don't know how it is implemented, and this source is not a scholar paper, but worth looking. http://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3-demystifying-credit-card-data-12/ http://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3-... > Swipe transaction are perhaps easiest to describe. The data encoded on the magnetic stripe is static, formatted according to ISO7813 in three tracks, with the third one typically unused. One of the fields in this track layout is the Card Validation Code (CVC) or CVC1. which serves as a cryptographic integrity check on the track contents. I think that makes sense from someone who doesn't understand how the security of credit card works. But if online purchase requires one to give up the cvv code, then verifying a physical card would also require one to be able to read that code.
- sigsergv 13y ago
  Back side of the card contains CVV2 code, I'm pretty sure that it's not recorded on magnetic tape. Probably, in the original article should be mentioned that difference.
  - jon-wood 13y ago
    The CVV2 is intentionally not stored on the card to make shopping online or over the phone with a skimmed card more difficult. If Target has the CVV2 included in this data dump they're in for a whole world of hurt from the credit card companies since storing that number for any longer than it takes to verify a transaction is utterly forbidden.
    - unclebucknasty 13y ago
      I was thinking the same: why would they store the CVV2 data? Makes me wonder if they were keying it for verification and the fraudsters were somehow intercepting the traffic in real-time.
    - pionar 13y ago
      They would not be storing the CVV2, as they would not collect that at POS (and if someone does ask you for that when you swipe your card, be very suspicious). It's the CVV1 that they've stored, which is still utterly forbidden by the PCI standards.

yeukhon 13y ago

Oh I took that part for granted. Sorry. I don't know how it is implemented, and this source is not a scholar paper, but worth looking. http://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3-demystifying-credit-card-data-12/ http://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3-... > Swipe transaction are perhaps easiest to describe. The data encoded on the magnetic stripe is static, formatted according to ISO7813 in three tracks, with the third one typically unused. One of the fields in this track layout is the Card Validation Code (CVC) or CVC1. which serves as a cryptographic integrity check on the track contents. I think that makes sense from someone who doesn't understand how the security of credit card works. But if online purchase requires one to give up the cvv code, then verifying a physical card would also require one to be able to read that code.

sigsergv 13y ago
Back side of the card contains CVV2 code, I'm pretty sure that it's not recorded on magnetic tape. Probably, in the original article should be mentioned that difference.
- jon-wood 13y ago
  The CVV2 is intentionally not stored on the card to make shopping online or over the phone with a skimmed card more difficult. If Target has the CVV2 included in this data dump they're in for a whole world of hurt from the credit card companies since storing that number for any longer than it takes to verify a transaction is utterly forbidden.
  - unclebucknasty 13y ago
    I was thinking the same: why would they store the CVV2 data? Makes me wonder if they were keying it for verification and the fraudsters were somehow intercepting the traffic in real-time.
  - pionar 13y ago
    They would not be storing the CVV2, as they would not collect that at POS (and if someone does ask you for that when you swipe your card, be very suspicious). It's the CVV1 that they've stored, which is still utterly forbidden by the PCI standards.