Slashdot Mirror
Credit Card Chips Have Failed to Halt Fraud (So Far) (fortune.com)
An anonymous reader quotes Fortune:
New chip-enabled credit cards, which were rolled out to U.S. consumers starting in 2015, were supposed to put an end to rampant credit card fraud. So much for that. A new report from the research firm Gemini Advisory has found that, of more than 60 million cases of credit card theft in the last 12 months, a whopping 93% of the stolen cards had the new chip technology...
In theory, EMV should reduce fraud because every card transaction requires an encrypted connection between the chip card and the merchant's point-of-sale terminal... But while the EMV standard is supposed to ensure the card data cannot be captured, many merchants are failing to properly configure their systems, according to a Gemini Advisory executive who spoke with Fortune... The upshot is that criminals have been able to insert themselves into the transaction data steam, either by hacking into merchant networks or installing skimmer devices in order to capture card information... The report concludes by noting that big merchants have begun to tighten up their implementation of the EMV system, which will make them less of a target. Instead, criminals are likely to begin focusing on smaller businesses.
The report estimates that in just the last twelve months, 41.6 million records have been stolen from chip-enabled cards.
In theory, EMV should reduce fraud because every card transaction requires an encrypted connection between the chip card and the merchant's point-of-sale terminal... But while the EMV standard is supposed to ensure the card data cannot be captured, many merchants are failing to properly configure their systems, according to a Gemini Advisory executive who spoke with Fortune... The upshot is that criminals have been able to insert themselves into the transaction data steam, either by hacking into merchant networks or installing skimmer devices in order to capture card information... The report concludes by noting that big merchants have begun to tighten up their implementation of the EMV system, which will make them less of a target. Instead, criminals are likely to begin focusing on smaller businesses.
The report estimates that in just the last twelve months, 41.6 million records have been stolen from chip-enabled cards.
Well, no winning against the bogeyman in your cyberspaces, eh.
All this fraud is online where the chips aren't used.
The chip prevents someone from skimming the information on the magnetic strip, and reusing that to pay for stuff. Of course someone can steal your credit card details, which are conveniently embossed right on the card for anyone to see.
...except, this was not about online purchases.
Swing and a miss there, Champ.
Without a PIN, and without a chip reader for online purchases the whole exercise has been a waste of time.
How much of that 93% stole was done at retailers who still use the non chip info? I have a chipped card and had my card skimmed and it was used a dozen locations that didnt require a PIN. All chipping a card did was shift who pays for the fraud. If its chipped/pin then bank eat the fraud, chipped no pin the retailer eats the fraud.
So, in 2018, one of the biggest economies, most technologically advanced country in the world still cannot use a 40 year old technology to authenticate a payment ? I know it might not be 100% failproof, but still... Even countries in eastern europe manage to do that...
1. The chip does nothing to crooks from using the card number, type, expiration date and 3 digit code on the back.
2. Many retailers I use my chip card at don't even use the chip reader functionality in their terminals, taping it off and indicating that the card needs to be swiped instead.
3. Most retailers never check my sig (even if indicated on the card).
4. I can run my card as 'credit' and can bypass the pin entry, totally rendering that useless.
The point of chip and pin is that the cards details don't go through merchants system at all. Instead the card is authenticated / authorized through a secure device that talks directly to the payment service. All the merchant gets is a token of the transaction. Of course if the merchant stupidly allows cards to be swiped instead then they're just as vulnerable to skimming / hacking / database theft as non chip and pin devices.
all you have to do is exactly what they did in europe and make the retailer liable for the fraud if they swipe
Having some cash with you can also save your life if robbed, a thief will just run away happy with your cash
It is safe (no risk of card skimming)
you are noot feeding the bank (2% transaction fee)
it is private (big brother does not knowwhat you buy)
Think, big brother loves the plastic card for a reason....
Meanwhile in the rest of the world, cards with chips have been used for decade(s) and the sky didn't fall there.
First, make the trader liable for problems at their end.
Second, the U.S. is over a decade behind Europe on this technology, meaning hackers have had ten years to figure out problems. It's the equivalent of running Windows XP or an unpatched Windows 7 on a modern network.
Third, why the hell is anyone expecting a trader to understand network security? These systems should be proof against even ingenious idiots. Plug it all in and it works, autoconfiguring. No default passwords, no default security holes, just something that works. Are the credit card companies and banks really this incompetent?
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
If the majority of the cards have a chip, then the majority of fraud cases will be cards with chip. The point of moving from a magnetic strip to a chip, is that others cannot gain access to your card simply by swiping it. After chip conversion, that vector of attack is mostly gone, and criminals move on to other methods. For which cards with chip are just as good/bad as any other card.
Well there's your problem.
If you rely on the merchant you have already lost. That is not the fault of the chip.
Let's apply the same design to securing out IT:
- Secure Boot enabled, locked down and unable to be changed.
- Fully encrypted HDDs with decryption tied to user authentication.
- Tamper proof case, encryption keys destroy themselves if the computer is opened.
- No password.
I was mocking the USA when they decided to 40 years late adopt Chip+Pin, a technology which caused credit card fraud to plummet in the rest of the world... and then they only adopted half of the technology.
As this EMV technology (protocol) is also used by ING bank (and perhaps others) for their implementations of contactless payments ('contactloos betalen') I wonder what implications this article brings to ING's case.
Anybody who can share their insights here?
on purchases at most stores! I'd hate to think that my financial security was entrusted solely to a chip in a credit card.
There's a lot of misinformation here.
Chip cards aren't meant to prevent card breaches. For card-present transactions (in person at the store), the exact same encryption and cardholder data protection requirements are in place from the reader to the bank whether its EMV or old mag-stripe. For card-not-present transactions (online and e-commerce) EMV makes no difference at all.
Chip cards do one thing. They make it harder to make a fraudulent physical card. With mag-stripe it is trivial to take another credit card or even a subway gift card and recode its mag-stripe to use a stolen card number, so I can walk into a merchant and use that card.
The author appears to be confusing EMV standards with the PCI P2PE (point to point encryption) standard, which is meant to prevent breaches by doing many of the things the author describes.
This is really no different then when EMV rolled out elsewhere, except hackers have more access to the interconnectedness off things.
EMV in EU also rolled out with loose rules to start - merchants want cards to work - so fall back to mag stripe was allowed, and the bad guys figured out they could smash the chip on a stolen or cloned card. When fallback was removed, fraud went away.
The USA is also a different beast. Besides having to upgrade older infrastructure, the problem of customers with multiple cards having to remember multiple pins has to be solved. But keep in mind, if mag stripe fall back is removed, most of the fraud goes away. No one has yet to clone the chip, and if the EMV data is protected properly, there should not be enough information to use online (card not present).
PIN protects against card theft. Removing Mag stripe function protects against cloned cards - where most of the fraud is. It took EU time to get everything right, it will take USA time too.
Hypenosis! Now that's a word that ought to exist.
I've had to have all my cards replaced at least once in the past year due to failed chips. Additionally, all merchants take cards without chips anyway, so what's the point?
When I visited New Zealand I marveled at how easily the metric system had pervaded everyday life. Although the UK formally switched to metric in 1965, it is still in the process of slowly seeping through popular culture. The general public still travels in miles, quotes Fahrenheit temperatures, and weighs people not even in imperial but in the Neolithic unit that preceded it. In the US, the public attitude is that if some little snowflake somewhere would be offended by switching over, we can't even contemplate doing it.
When I asked the Kiwis how difficult the transition had been, they replied: the government just named a date, there was a certain amount of grousing, but we all just did it out a general sense that the time had come.
So sorry, world, but the financial system will be leaking bank fraud through American mag stripes and signatures for all time to come.
The thief steals. Not murders. Murderers murder. And they get chased, unlike "petty thieves", so thieves don't kill their marks, just threaten to and take the money.
Fucking snowflake idiot...
Chips are only effective when your buying in person at retail brick and mortar stores. Much of the fraud occurs from hackers getting into online merchants stored information for customers. Also I have seen many merchants fail to properly use chip authentication because they have been unwilling to install new transaction hardware.
As so many others have said, instead of chip and PIN we have "Smile and Sign" - actually we don't even have that - since chip cards are so much more "secure" many retailers process transactions of $200 with no signature required! Brain dead idiots - I really don't mind you reading my card while I have to enter a PIN, honest I don't.
I keep reading stories about U. S. shops lacking the necessary chip-n-PIN reading terminals, forcing shoppers to default back to that awfully archaic magnetic strip technology from 1955.
...many merchants are failing to properly configure their systems
Those humans who tried unsuccessfully to implement the chip-based cards have failed. Human error, who would have ever thought that to be a cause of failure?
The security rationale behind smartphone payments is that the transaction is done with a temporary card, and your real card is never exposed to the retailer. The counter-argument is that theft and hacking of phones is common enough to negate this benefit. Is anyone studying whether phones are the safer option now?
My first CC to incorporate a chip was compromised in less than a week. The wait staff ( my best guess due to it's limited use based on the length of time I had it ) simply copied the name, CC numbers and security code and voila, they have everything they need to make an online purchase or provide to a third party who is paying them to collect such things due to their access to so many.
I was somewhat puzzled when the transaction alert hit the phone that I had just paid for dinner for four to go about 1600 miles away :|
( People are awfully ballsy with many banks moving to the ability to instantly send text alerts for any purchases for any amount made from any of your accounts )
Called the bank a moment later to let them know the card was compromised.
( Dunno if the folks who used my card got to enjoy their dinner or not )
They marked the transaction as such, invalidated the card and sent me a new one within forty eight hours.
( I keep one other CC in the safe for exactly this reason. If one is compromised, I can easily switch to the other. )
As time has gone by, the bank knows what my typical purchases look like. When an oddball one shows up ( say an overseas one or out of State ) they
block it by default. I have to call them up, validate who I am and authorize the unblock so the charge can go through.
My best guess for the delay in chip + pin is the cost of implementing the system due to the sheer scale of the US CC market. From what I've read, the estimated cost to shift over to the chip + pin tech will be somewhere in the vicinity of $8-10B USD and end retailers, banks and CC folks like Visa and Mastercard are fighting over who is going to foot the bill. ( The US has somewhere North of ~1B Credit Cards in circulation )
We may get there one day . . . . lol
I had a credit card get punched back in the late 1980's. Someone was trying to buy airline tickets in London and it got blocked.
After that I never had a problem with the card which was re-issued. Was using the same card up until 2014 when I was forced to get a "New" more protected chip card. Shortly after the very first use of the chip card I got a all that someone was trying to buy a computer.
Now 4 years later the same thing happened again.
27 years of no problems without the chip... now 2 problems in 4 years with the chip.
Have gone to using apple pay with my new phone. Hope that helps a bit, but too many vendors don't use apple pay still.
I had a credit card get punched back in the late 1980's. Someone was trying to buy airline tickets in London and it got blocked.
After that I never had a problem with the card which was re-issued. Was using the same card up until 2014 when I was forced to get a "New" more protected chip card. Shortly after the very first use of the chip card I got a all that someone was trying to buy a computer.
Now 4 years later the same thing happened again.
27 years of no problems without the chip... now 2 problems in 4 years with the chip.
Have gone to using apple pay with my new phone. Hope that helps a bit, but too many vendors don't use apple pay still.
"EMV should reduce fraud because every card transaction requires an encrypted connection between the chip card and the merchant's point-of-sale terminal."
This is not how EMV works. This channel is not and was not intended to be encrypted by design.. EMV is about authentication, not encryption.
For encryption at the POI, look to validated P2PE.
..use plastic any more than absolutely necessary, and use cash and checks as often as possible.
Several years ago a breach of a payment system hit locations I used to use plastic at. Prior to that I had my eye on the news, week after week, of escalating rates of breaches of payment and data systems. Luckily for me none of my accounts or identity information was affected by the payment system breach at places I then frequented, but it was clear that no merchant or payment system provider was capable of safeguarding me and my accounts, therefore I had to take matters into my own hands, instituting an aggressive program of paying cash whenever possible, using plastic only when I have no other choice, and writing checks when possible.
The Equifax breach just cemented my opinion: if a company that large and important to our financial infrastructure can't even secure their systems against criminal activities, then perhaps nobody can. I continue to use cash for everything possble, and continue to look for ways to stop using electronic payment systems entirely.
I have and will continue to urge people who care about protecting themselves and their accounts to wean themselves off using plastic as soon and as much as possible, until the day comes that the financial sector can effectively secure them against criminal intrusion.
It appears that none of the major cards are requiring signatures any more:
https://www.creditcards.com/cr...
So instead of Chip+Signature, it's just Chip vs. Chip+PIN.
There's a lot of misinformation here.
Chip cards aren't meant to prevent card breaches. They are meant to move the responsibility from the bank to use client. In case of fraud they can proof the client is at fault because there are no cloned chip-cards.
Chip cards do one thing. They make it harder to make a fraudulent physical card. With mag-stripe it is trivial to take another credit card or even a subway gift card and recode its mag-stripe to use a stolen card number, so I can walk into a merchant and use that card.
The author appears to be confusing EMV standards with the PCI P2PE (point to point encryption) standard, which is meant to prevent breaches by doing many of the things the author describes.
The article summary is dreadfully inaccurate and most of the comments are likewise inaccurate.
EMV does not support end-to-end card to issuer, or issuer to card encryption. The PCI data security standards (separate to EMV) do provide for point to point encryption, but that's not end to end encryption. EMV does nothing to ensure that "card data cannot be captured" (actually, it's quite easy to capture it; even the PIN can be transmitted in the clear in certain card simple card configurations; more complex card configs use enciphered PIN's). EMV does support three security levels (SDA, DDA, CDA) and only with SDA is it possible to clone publicly-accessible card data onto another card. Cards supporting DDA and CDA (SDA is deprecated in many countries outside the US) require more terminal processing and the data on the card cannot be cloned to another card.
EMV does provide what's effectively a DES-based transaction hash using a card-unique key which the card generates (to hash the transaction details) and which the terminal then sends to the cardholder bank which first tries to authenticate the hash, before checking if the rest of the transaction is good to go. And if all's good, the cardholder bank then generates a response hash which authenticates the transaction response back to the card. That stops man-in-the-middle attacks. Cards also use a sequential transaction serial number (ATC) to stop replay attacks. The card's unique key used to hash request and response data cannot be accessed and is one of three different keys used to hash different classes of request and response data.
There's a lot more there and most of it is publicly available from books one to four of the EMV standards, freely available from http://www.emvco.com/
Signatures allow me to say "I didn't sign this", not "I did". It's to protect us from banks. Chip and pin has been broken since 2010. For example, see https://www.lightbluetouchpape... Banks in the UK successfully scammed the courts for years with chip-and-pin, claiming that it was poor user security that allowed all frauds.
davecb@spamcop.net
Let's think about this, in the US banks/payment processors/etc were so brilliant to not to include PIN numbers in the technology, and they don't let consumers disable the mag stripe. So what are you expecting. additionally we still put the signature next to the card itself (signature strip), of course this was going to happen.
If they want to fix it, then we need to consider.
1. At restraunts payment processing at the table - similar to europe
2. Implement PIN numbers
3. Require consumers request mag stripe cards, by default ship without imprint and mag stripe.
4. Allow consumers to do chip-pin at home (basically enable card authentication for payments online), or do something similar with mobile phones.
5. Allow consumers to use 2FA for verification for certain transactions - doesn't work for all environments - but for those that it doesn't like would be limited
So "Gemini Advisory" says card fraud is up, huh? But Visa says that fraud is down. Who's right? I don't know, and don't feel like looking into the details of both reports. It's likely that both are right, and they're talking about different types of fraud. My understanding is that overall, fraud is down significantly, but some types of fraud are up, such as card skimming at gas pumps (since the chip conversion deadline for those is still in the future and very few of them support chips right now.)
OK it's pure BS that anyone claimed it would end fraud. How can you jerks start off an article with a fat juicy lie like that? Nobody would have claimed something like that! Reduce fraud yes, but nobody would have claimed it would end it!
...stop fraud, their purpose is to place the blame on the cardholders instead of the banks and credit card companies.
Give it another 12 months before getting judgy about whether or not chip & PIN is making a difference.
Visa spent years defining the standard. Because our commercial card processing network is provided by the a monopoly, they never considered compatibility with PCs or the reality that the majority of commerce now occurs over the internet. Even if you have a card reader on your computer, your computer likely does not know what to do with a credit card. If they had chosen FIPS-140 for their standard, computers everywhere would have been instantly compatible and we could use our cards over web. Currently over half of all commerce can't take advantage of the chip. Visa created this situation through their own monopolistic myopia. Visa's solution requires a $50 adapter in order to work with cell phone (squareup.com). They could have easily have engineered a card that would have worked with a cell phone directly, they just didn't consider it because it had nothing to do with their network.
There are plenty of terminals, it's just that 5% or so of them have tape over the chip slot or a note to swipe the stripe (though without such catchy wording). If there is fraud when the chip is not used, the cost is now on the business, but if they think it's not bad enough, there is still nothing to force them to make the chip slot work, 3 1/2 years later.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }