4 ms·

> This is the cardholder’s name and all of the track one and track two data7. These records provide all that’s needed to clone an EMV smart card. See appendix s

by gergles 12y ago

> This is the cardholder’s name and all of the track one and track two data7. These records provide all that’s needed to clone an EMV smart card. See appendix section 0 for complete records. It provides all that you need to create a magstripe card from the PAN stored in the Chip. That is ALL you can do. You can't clone the card and can't get cryptograms. Any sane issuer will decline transactions made with the magstripe at a chip-capable terminal, so this doesn't help much. In any event, a lot of the information you need to clone the magstripe is... on the magstripe. The rest of the attacks are on the offline functionality of the card which won't be used in almost any US implementations and is being phased out of most of the other places where it is in use.

emptybits 12y ago
You're right, obviously, about having everything needed to clone a magstripe on the magstripe itself. > Any sane issuer will decline transactions made with the magstripe at a chip-capable terminal, so this doesn't help much. Regarding this... Where I live and use Chip-and-PIN cards every day (Canada), it's extremely common for a chip-capable terminal to fail on a chip card for a variety of reasons and immediately instruct the cardholder and/or merchant to "please swipe card". Customer swipes and places a signature-resembling mark on paper. Merchant and issuer accept this. And so it goes. Anecdotal data: We've had Chip-and-PIN for years here. Currently, despite my Amex being Chip-and-PIN, more than 50% of terminals fail with the chip ("it's an Amex thing," we're told, years into this) and revert to swiping, and my Visa Chip-and-Pin still fails as a chip card and falls back to a swipe transaction approximately 10% of the time. So the easy fraud vector is still there with magstripes even in a mature Chip-and-PIN environment.
- derefr 12y ago
  Actually, those "failures" are (here in Canada) caused by merchants who have upgraded their hardware to chip-and-pin, but haven't actually switched chip-and-pin processing on for their POS merchant account. Or, more commonly, they're with a POS provider that bought, and then rolled out, chip-and-pin terminals as part of its standard four-year-replacement cycle, but who don't even support chip-and-pin yet. Either way, usually the merchant knows ahead of time that their terminal won't accept your (or anyone's) chip, and could put up a sign to that effect.
  - emptybits 12y ago
    What you say makes sense for Amex failures... I have heard merchants say "chips work with everything but Amex." But for the Visa chip failures I experience, it's generally happening at my regular haunts where chip cards work (mine and others). The occasional chip failure is accompanied by the stock service industry script of, "oh, yeah, that terminal has been having problems all day -- just swipe it and sign, sorry." I do wonder if the merchant is charged higher discount rates or fees on those transactions because of higher fraud likelihood.
    - pricechild 12y ago
      In the UK at least, if the card is swiped rather than chip & pin then the card company may refuse to cover fraud losses and the merchant must swallow it. If the same fraud happenned via chip & pin, the merchant would've been "insured". http://www.theukcardsassociation.org.uk/cards-transactions/card-present-transactions.asp#content_1312 http://www.theukcardsassociation.org.uk/cards-transactions/c...
    - derefr 12y ago
      > oh, yeah, that terminal has been having problems all day There is a phenomenon related to this, that I would almost describe as being like an inorganic physical virus. Sometimes plastic or lint from a wallet solidifies onto the chip on your card—and then rubs off on the contacts inside the POS terminal when you insert it. Now the terminal can't read the card, because there's goop in the way. So you take your card out (which is now slightly cleaner, and thus likely to work on the next terminal.) Next, someone else puts theirs in. Now the gunk is on the terminal contacts, and gets rubbed onto that person's card, and once again, the card doesn't work. Now that person's card is dirty as well. It seems that there's less card->terminal gunk transfer than terminal->card gunk transfer, but every once in a while you'll take your card out of one non-working terminal and then it won't work in any other terminal—until you notice there's a smudge on the chip, rub it off, and then it starts working again. Perhaps they need "cleaning cards" for these terminals that are like the old VHS head cleaners.
      - 12y ago
semi-extrinsic 12y ago
Regarding declining magstripe transactions: a friend of mine had a card with a literally broken (in half) chip. The magstripe still worked fine for many purchases in the UK, in particular, he never had any issues withdrawing cash from ATMs. So my guess is that cloning the magstripe onto a card with a deliberately broken chip will work in many situations.

by gergles 12y ago

emptybits 12y ago

You're right, obviously, about having everything needed to clone a magstripe on the magstripe itself. > Any sane issuer will decline transactions made with the magstripe at a chip-capable terminal, so this doesn't help much. Regarding this... Where I live and use Chip-and-PIN cards every day (Canada), it's extremely common for a chip-capable terminal to fail on a chip card for a variety of reasons and immediately instruct the cardholder and/or merchant to "please swipe card". Customer swipes and places a signature-resembling mark on paper. Merchant and issuer accept this. And so it goes. Anecdotal data: We've had Chip-and-PIN for years here. Currently, despite my Amex being Chip-and-PIN, more than 50% of terminals fail with the chip ("it's an Amex thing," we're told, years into this) and revert to swiping, and my Visa Chip-and-Pin still fails as a chip card and falls back to a swipe transaction approximately 10% of the time. So the easy fraud vector is still there with magstripes even in a mature Chip-and-PIN environment.

derefr 12y ago
Actually, those "failures" are (here in Canada) caused by merchants who have upgraded their hardware to chip-and-pin, but haven't actually switched chip-and-pin processing on for their POS merchant account. Or, more commonly, they're with a POS provider that bought, and then rolled out, chip-and-pin terminals as part of its standard four-year-replacement cycle, but who don't even support chip-and-pin yet. Either way, usually the merchant knows ahead of time that their terminal won't accept your (or anyone's) chip, and could put up a sign to that effect.
- emptybits 12y ago
  What you say makes sense for Amex failures... I have heard merchants say "chips work with everything but Amex." But for the Visa chip failures I experience, it's generally happening at my regular haunts where chip cards work (mine and others). The occasional chip failure is accompanied by the stock service industry script of, "oh, yeah, that terminal has been having problems all day -- just swipe it and sign, sorry." I do wonder if the merchant is charged higher discount rates or fees on those transactions because of higher fraud likelihood.
  - pricechild 12y ago
    In the UK at least, if the card is swiped rather than chip & pin then the card company may refuse to cover fraud losses and the merchant must swallow it. If the same fraud happenned via chip & pin, the merchant would've been "insured". http://www.theukcardsassociation.org.uk/cards-transactions/card-present-transactions.asp#content_1312 http://www.theukcardsassociation.org.uk/cards-transactions/c...
  - derefr 12y ago
    > oh, yeah, that terminal has been having problems all day There is a phenomenon related to this, that I would almost describe as being like an inorganic physical virus. Sometimes plastic or lint from a wallet solidifies onto the chip on your card—and then rubs off on the contacts inside the POS terminal when you insert it. Now the terminal can't read the card, because there's goop in the way. So you take your card out (which is now slightly cleaner, and thus likely to work on the next terminal.) Next, someone else puts theirs in. Now the gunk is on the terminal contacts, and gets rubbed onto that person's card, and once again, the card doesn't work. Now that person's card is dirty as well. It seems that there's less card->terminal gunk transfer than terminal->card gunk transfer, but every once in a while you'll take your card out of one non-working terminal and then it won't work in any other terminal—until you notice there's a smudge on the chip, rub it off, and then it starts working again. Perhaps they need "cleaning cards" for these terminals that are like the old VHS head cleaners.
    - 12y ago

semi-extrinsic 12y ago

Regarding declining magstripe transactions: a friend of mine had a card with a literally broken (in half) chip. The magstripe still worked fine for many purchases in the UK, in particular, he never had any issues withdrawing cash from ATMs. So my guess is that cloning the magstripe onto a card with a deliberately broken chip will work in many situations.