Slashdot Mirror
Credit Card Fraud Could Peak In 2015 As the US Moves To EMV
dkatana writes Some analysts expect fraud to increase this year as thieves will step up their efforts to capture more credit card details before the Europay, MasterCard and Visa (EMV) standard conversion goes into full throttle. The next time U.S. cardholders receive a new card it will probably be equipped with an EMV chip, and most likely be contactless. The U.S. is finally making the transition to secure cards based on the European EMV standard, mostly because the liability shift imposed by the three big credit card brands — Visa, MasterCard and American Express. The European Union, where EMV became standard ten years ago, has the lowest level of credit card fraud in the world, while the U.S. accounted for 47.3% of the worldwide payment card fraud losses but generated only 23.5% of total volume.
Time to make a Faraday Cage wallet.
Your next creditcard (in a couple years) will probably have a chip-and-pin system, which can not be easily cloned as the magstripes of today can. The analysts cited believe fraud will escalate soon, while most people still DON'T have a chip-and-pin card, since defrauding those people will be harder in a couple years.
Ya, no shit. As someone who is from downunder, holy CRAP America is in the dark ages when it comes to its banking and communications systems.
Jesus christ.
And the funny thing is, they are so blissfully unaware things are better elsewhere in the world because none of them ever go anywhere anymore.
You can tell how powerful someone is by the magnitude of the crime they can commit and be able to get away with.
Chip yes, PIN, no. In the US, "Chip-and-signature" is what we get, with extremely rare exceptions. It is more secure than the magstripe to stop massive hacks such as Home Depot and Target, but does nothing to stop stolen card fraud. Note that if your card does not support chip-and-PIN (it can support it even if it's not the default, but US banks aren't doing this), then you can't use the card at many automated kiosks (train stations, etc.) outside the US.
I disagree with the summary that contactless goes along with the chip - it doesn't. There are some banks offering contactless payment cards, but this is not common right now.
As at the 1st of August last year you were no longer able to sign for purchases on your credit card in Australia. A pin became required for every transaction.
With regards to a contactless payment system, it is referred to here universally as paywave (even though that is Visa's name for it) and my AMEX, Visa and Mastercards all support that functionality. They contactless system allows an up to $100 purchase just by tapping your card on the reader. Kinda scary if you lose your wallet but soooooo convenient. Total transaction time is around 1 second.
EMV is NOT contactless. If your new card(s) include electrical contacts, It's EMV .
deleting the extra space after periods so i can stay relevant, yeah.
Chip & PIN is a liability shift. You're expected to protect your PIN, so if your account is compromised, you're assumed to be at fault.
Britain has had a lot of trouble with this.
deleting the extra space after periods so i can stay relevant, yeah.
Great question! I had wondered about this myself - How does C&P really make the card more secure if you still basically just need a photocopy of it to use it? Or do they have an entirely different mode of operation when used online (like easy generation of disposable one-use card numbers)?
Not that it matters - US vendors will fight this to the bitter end. I already have cards with a chip in them (not sure about the "pin" part, since I certainly don't know any pin to use with them), one of which I've had for over five years. And I have *never* found a merchant that it works in any mode other than "swipe and sign". My local supermarket actually has readers compatible with them - And have intentionally disabled that feature because it "confuses" people - Damned straight, it confuses people! It confuses the hell out of me that you've intentionally made your readers insecure, and that after a major breach a few years ago!
Fuck the PCI, and fuck merchants. Give me security or pay me real penalty-money when your latest data breach results in my identity getting stolen. None of this "$50 maximum liability" bullshit - You lose my identity, BAM, $100k in my pocket. Anything less, and we'll keep hearing about the latest record-breaking breach-of-the-week.
Yes, in fact they can, and this has happened in Europe. One problem with C&P is the "offline PIN" mode which doesn't exchange data with the bank. In the UK, at least, the consumer is liable for any fraud with a C&P card as it is assumed that if the PIN was entered correctly it was by the cardholder. In the US, all the card issuers assume liability for fraud, no matter what, so there is less incentive to require a PIN.
The article you linked to is informative, but as the US transitions to EMV, it will become harder for thieves to use magstripe cards.
As I noted earlier, the biggest benefit of EMV, with or without PIN, is that merchants and payment processors aren't holding on to vast quantities of card numbers, and card skimming becomes far more difficult.
Rubbish.
I have had credit card fraud on a card of mine that had a chip and pin. The crim racked up $25k in flights in a couple of hours. I got a call from my bank asking me about the transactions as it had set off alarms, I said it wasn't anything I had done. Card got cancelled immediately, new card arrived 3 days later and the $25k was immediately refunded. The bank then went through every transaction for the last 3 months and flagged ones they thought were suspicious and once I confirmed they were nothing to do with me those too were refunded.
My experience has always been very positive when it comes to issues with my cards.
My bank has an additional layer of security for when you purchase online. When you purchase with the credit card it spawns a page that comes from my bank. I gave it a personal statement that it uses to show that it is real - ie "Your wife's favourite food is potato chips" and then it asks for a password. If I give the correct password the transaction will go through.
I got a warning message in Spanish when I took out money from the ATM in Cartagena, Colombia (Caribbean edge of northern South America). Since my money came out ok I didn't pay it much attention. My buddy who spoke Spanish, however, was pretty amused.
He said,
"Did you see that warning message," "Yeah?" "That warning message is telling you your card only has a magnetic stripe, and no secure chip-and-pin system which is really insecure and you should ask your bank to upgrade it for you. This is the same system the Europeans use. Fuckin' Colombia's banks, in South America is a decade ahead of the United States banking system when it comes to technology. Typical."
moox. for a new generation.
Maybe because Americans carry 10 cards? How the fuck are they supposed to remember which PIN goes with which, not very secure to set the PIN the same for all them
Chip & PIN is a liability shift. You're expected to protect your PIN, so if your account is compromised, you're assumed to be at fault.
This is not at all the case in the US.
When TFS says liability shift, they're referring to the merchants (at least, in the context of the US anyways.) The merchants have an agreement with visa, mastercard, et al (and the banks) that determines who is liable in the event of fraud. Presently mastercard/visa/amex assume most of the liability (and they very well better for the transaction fees they charge.)
Visa and mastercard have issued an ultimatum of sorts to the merchants saying that this will only continue for magnetic stripe until the end of 2015, after which the merchant assumes liability for fraud. The merchant can avoid that by simply replacing their POS systems with a chip and pin system, in which case visa/mastercard assume most of the liability.
For you as the card holder however, nothing has changed in that regard: The law in the US still stipulates that credit card holders can only be liable for up to $50 (which most banks waive these days.)
I'm in Argentina. My CC terminal (VeriFone VX520, issued by Visa since visa has this racket that you can only rent, and not own, CC terminals from them or Mastercard) has an EMV reader. Only really new cards in Argentina have this, and out of pure curiosity I tried it with a client's instead of the mag stripe and it worked fine.
Visa has been issuing these units for a couple of years and before that they had another model which also had an EMV reader. It's right under the keyboard. You stick the card in (like you do on an ATM) and you feel it "clicks" on a little switch that enables the chip.
So probably you have seen EMV readers. You just don't know you have.
By many measures including inequality, public infrastructure, primarily exporting agriculture, bought and paid for politics, etc the US *is* a third world country
Further, you DON'T WANT it to operate by NFC, or anything RF for that matter. RFID, NFC, and other RF technologies have all been broken for some years now. I can't imagine what Apple is thinking, with its Apple Pay, but maybe they think they've gotten around the security holes in NFC. Remains to be seen.
There is plenty of information around about how Apple Pay works. All the communication can be in clear text and recorded by a dozen hackers, it doesn't make a difference, because the actual data sent through the insecure channel is safely encrypted.
My wife has a small company that accepts credit cards. As the parent comment points out, the credit cards want to push liability for fraud onto the merchants. This has two aspects
- First, the physical card: Chip and pin is standard here, which would be fine, but don't think your fees go down when they hand you the liability. My wife has, to my knowledge, never had a case a fraud in 20 years, but that doesn't matter either. Mastercard/Visa are completely in collusion, there is no competition, they can demand whatever fees they want.
- Second, the Internet: I wrote her first web-shops, including the payment processing. This has become completely impossible. The credit card companies impose ever more impossible rules. Ultimately, if you handle credit card numbers electronically, they began insisting on quarterly audits of your IT infrastructure. We used an ISP - so they were going to insist on auditing the ISP infrastructure. Our ISP was - shockingly - actually ok with this, but the whole nightmare just got too complicated. In the end, the rules appear to be nothing but a way of forcing you to use their approved payment processors - yet another way to suck money out of merchants.
Will some Internet payment service please, please spring up and actually give Mastercard/Visa some real competition? Paypal has been largely co-opted, Bitcoin is a joke - we need something that your average Joe can and will use. So far, nothing...
Enjoy life! This is not a dress rehearsal.
A hole punch in what? Did you kill the chip? There's better ways.
Simply hold the card up to the light and you'll see the antenna connections run around the outside of the card. A simple cut through the antenna will render the contactless payment inoperable without affecting the chip and the ability to use the chip+pin features.
'rewards'. Yeah, right...
Non-Linux Penguins ?
Saying NFC has been "cracked" is like saying that ethernet has been "cracked". It doesn't make any sense. NFC is just a transport layer, it doesn't have any encryption or security at all. You have to build that in at the application level that uses NFC to transfer its data.
NFC payment cards are secure. They have been in use in other parts of the world of ~15 years now. Japan started using them around 2000. There have been no mass thefts by people with big antennas or readers hidden under their jackets. The hacks you heard about were attacks on the phone's NFC software stack, similar to a bug in the TCP/IP stack of some desktop operating systems. Again, we didn't say that ethernet was "cracked" when that happened, we recognized that the implementation of the TCP/IP stack was broken.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
I'm from Europe and I have had such cards for 10 years.
I was hit twice by thieves, once an hotel reception guy in Rome copied my card details and bought stuff for 4500€ online, another time it was a restaurant in London who did it the same thing.
Both times a simple email was enough to avoid having to pay, but chips don't help there.
They only make copying the cards themselves a bit more difficult.
You still have to check your account carefully each time.
NFC was first cracked on cell phones.
It doesn't even matter. NFC can send the number in plaintext for all I care. The Apple Pay app generates a one-time card number. After it hits the reader, it is useless.
http://techcrunch.com/2014/09/...
Grammer Nazis - I mod you "troll" unless you actually add something on-topic. Yes, I know I have mispellings in my sig.