Slashdot Mirror
Credit Card Chips Have Failed to Halt Fraud (So Far) (fortune.com)
An anonymous reader quotes Fortune:
New chip-enabled credit cards, which were rolled out to U.S. consumers starting in 2015, were supposed to put an end to rampant credit card fraud. So much for that. A new report from the research firm Gemini Advisory has found that, of more than 60 million cases of credit card theft in the last 12 months, a whopping 93% of the stolen cards had the new chip technology...
In theory, EMV should reduce fraud because every card transaction requires an encrypted connection between the chip card and the merchant's point-of-sale terminal... But while the EMV standard is supposed to ensure the card data cannot be captured, many merchants are failing to properly configure their systems, according to a Gemini Advisory executive who spoke with Fortune... The upshot is that criminals have been able to insert themselves into the transaction data steam, either by hacking into merchant networks or installing skimmer devices in order to capture card information... The report concludes by noting that big merchants have begun to tighten up their implementation of the EMV system, which will make them less of a target. Instead, criminals are likely to begin focusing on smaller businesses.
The report estimates that in just the last twelve months, 41.6 million records have been stolen from chip-enabled cards.
In theory, EMV should reduce fraud because every card transaction requires an encrypted connection between the chip card and the merchant's point-of-sale terminal... But while the EMV standard is supposed to ensure the card data cannot be captured, many merchants are failing to properly configure their systems, according to a Gemini Advisory executive who spoke with Fortune... The upshot is that criminals have been able to insert themselves into the transaction data steam, either by hacking into merchant networks or installing skimmer devices in order to capture card information... The report concludes by noting that big merchants have begun to tighten up their implementation of the EMV system, which will make them less of a target. Instead, criminals are likely to begin focusing on smaller businesses.
The report estimates that in just the last twelve months, 41.6 million records have been stolen from chip-enabled cards.
Without a PIN, and without a chip reader for online purchases the whole exercise has been a waste of time.
The US opted for chip+signature, rather than chip+PIN like the rest of the world. Since no one ever checks signatures properly, stolen cards can easily be used for fraud in the US, without needing to shoulder surf for a PIN first.
So, in 2018, one of the biggest economies, most technologically advanced country in the world still cannot use a 40 year old technology to authenticate a payment ? I know it might not be 100% failproof, but still... Even countries in eastern europe manage to do that...
And for those of us in the rest of the world, the US is also the cause of fraud on our credit cards. For backward compatibility, our cards still have a magstripe, but the bank's won't authorise payment in local country. So we get our cards cloned, and then used in the US!
1. The chip does nothing to crooks from using the card number, type, expiration date and 3 digit code on the back.
2. Many retailers I use my chip card at don't even use the chip reader functionality in their terminals, taping it off and indicating that the card needs to be swiped instead.
3. Most retailers never check my sig (even if indicated on the card).
4. I can run my card as 'credit' and can bypass the pin entry, totally rendering that useless.
The point of chip and pin is that the cards details don't go through merchants system at all. Instead the card is authenticated / authorized through a secure device that talks directly to the payment service. All the merchant gets is a token of the transaction. Of course if the merchant stupidly allows cards to be swiped instead then they're just as vulnerable to skimming / hacking / database theft as non chip and pin devices.
If the majority of the cards have a chip, then the majority of fraud cases will be cards with chip. The point of moving from a magnetic strip to a chip, is that others cannot gain access to your card simply by swiping it. After chip conversion, that vector of attack is mostly gone, and criminals move on to other methods. For which cards with chip are just as good/bad as any other card.
Only a decade?
The uk had chip and pin in 2006 when i lived there. Not sure when they rolled it out out.
And in 2014 australia stopped accepting signatures at all.
Now though im pretty much 100% contactless and done mainly via my phone.
Checking signatures is worthless anyway, real peoples signatures never look exactly the same whereas a criminal can easily copy what he sees on the back of the card, or in the case of cloning the cards he can just sign the cloned card himself and thats what the merchant will compare against.
At least with a pin, the pin is either correct or not, and not displayed on the card itself.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
The summary talks about merchant system misconfiguration.
That would imply that the chip simply isn't used.
Well, who would have thought that a purely decorative chip that is never used actually has no effect!
Obviously we all expected the gold shininess to make fraudsters run away...
Having some cash with you can also save your life if robbed, a thief will just run away happy with your cash
If a thief knows you have cash he is more likely to rob you, cards are less useful to a thief, especially less organized ones. A thief will also be happy with your phone or jewellery, and will probably take your wallet and run rather than open it and inspect it in your presence.
It is safe (no risk of card skimming)
You instead have the risks of it being lost, stolen or damaged, not to mention forged cash.
you are noot feeding the bank (2% transaction fee)
Yes you are, businesses pay a lot to banks for the ability to accept cash payments, often more than the transaction fees associated with cards.
Banks charge businesses fees for processing their cash deposits, which have to be counted by both the bank and the retailer, the cash has to be transported to the bank and will usually require protection while in transit, banks charge retailers for providing large bags of small change, your insurance liability goes up if you have cash on the premises as it's an attractive theft target or could be destroyed in the event of fire or flood etc.
For the customer, the cost is the same wether paying by cash or card but many cards also offer benefits to the cardholder which they wouldn't get if using cash.
it is private (big brother does not knowwhat you buy)
It's private if your careful, and also don't have explicit surveillance being carried out against you.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
And for those of us in the rest of the world, the US is also the cause of fraud on our credit cards. For backward compatibility, our cards still have a magstripe, but the bank's won't authorise payment in local country. So we get our cards cloned, and then used in the US!
Here in Norway they've fixed this quite easily because around 2010 most the banks introduced regional blocks, the defaults vary a little but my bank's card by default only works in Norway. To expand the coverage you must log in to the online bank and enable it. You can permanently enable it for our neighboring countries in Scandinavia, but for the other regions (rest of Europe, North America, South America, Africa, Asia) you can only enable it for three months at a time. That has pretty much stopped international scams dead in their tracks, even if it is enabled the crooks don't know until they try and while the occasional tourist will forget and enabled it after being declined it will stand out as a sore thumb.
Combined with 2FA using the cell phone/one time codes for online purchases fraud here is extremely low. I found a page that said total credit/debit card fraud in Norway is around 150 MNOK/year, that's $17 million. Divided by 2.4 million households that's about $7, the average household income is about $51k so 0.013% is lost to fraud. Basically that's noise level, people lose more money on grocery prices due to shoplifting than that. I don't think these numbers include robbery where you're forced to enter/hand over the PIN though, just shoulder surfing and such.
Live today, because you never know what tomorrow brings
There's a lot of misinformation here.
Chip cards aren't meant to prevent card breaches. For card-present transactions (in person at the store), the exact same encryption and cardholder data protection requirements are in place from the reader to the bank whether its EMV or old mag-stripe. For card-not-present transactions (online and e-commerce) EMV makes no difference at all.
Chip cards do one thing. They make it harder to make a fraudulent physical card. With mag-stripe it is trivial to take another credit card or even a subway gift card and recode its mag-stripe to use a stolen card number, so I can walk into a merchant and use that card.
The author appears to be confusing EMV standards with the PCI P2PE (point to point encryption) standard, which is meant to prevent breaches by doing many of the things the author describes.
This is really no different then when EMV rolled out elsewhere, except hackers have more access to the interconnectedness off things.
EMV in EU also rolled out with loose rules to start - merchants want cards to work - so fall back to mag stripe was allowed, and the bad guys figured out they could smash the chip on a stolen or cloned card. When fallback was removed, fraud went away.
The USA is also a different beast. Besides having to upgrade older infrastructure, the problem of customers with multiple cards having to remember multiple pins has to be solved. But keep in mind, if mag stripe fall back is removed, most of the fraud goes away. No one has yet to clone the chip, and if the EMV data is protected properly, there should not be enough information to use online (card not present).
PIN protects against card theft. Removing Mag stripe function protects against cloned cards - where most of the fraud is. It took EU time to get everything right, it will take USA time too.
The US opted for chip+signature, rather than chip+PIN like the rest of the world. Since no one ever checks signatures properly, stolen cards can easily be used for fraud in the US, without needing to shoulder surf for a PIN first.
You can't clone the cards and use them in online transactions. They are skimming the cards and using them for online transactions, most likely. Though the chip does generate a new CVV when used with the chip. If you run the magnetic stripe through, you get the real CVV which can be used online. Also there are tons of restaurants, fast food joints, gas stations, and banks that still use the magnetic stripe instead of the chip.
Believe it or not, yesterday.
I'm not saying that's the norm, though.
A lot of fraud comes from Poland too.
Citation needed.
Here in Poland we have EMV and 99% of cards issued by banks operating in Poland have magstripe and chip, and all transactions are authorized by a PIN. The only popular scam I've heard of here was to record the magstripe & PIN using a rigged ATM (with skimmer and camera over the pinpad), send the magstripe & PIN data to some other country (ie. in South America), and then try to grab cash using a cloned card there. The only time I have ever had to sign my card payment was when using my employer-issued lunch card, that had no chip and was magstripe&signature-only.
Banking technology in Poland is way ahead of the one in US because we have skipped a lot of now-dead technologies, like cheques, pagers, etc. Also, nowadays most points of sales accept contactless card payments, which, while they have their own problems (easy low-value PIN-less transactions after stealing the card, limited to some low numbers), at least are safe from skimmers, because the card doesn't need to touch the point of sale.
Chip+PIN is not invincible either. In the Netherlands there are gangs operating right now that can skim the information from Chip+PIN and the banks aren't willing or at least giving a really hard time to reimburse the fraud because "fraud is impossible". Moreover chip implementations in the EU are rampantly being abused especially across public transportation where people are cloning chips to get onto trains and busses.
The truth about EMV (and I've seen and implemented EMV systems across both US and EU) is that it was an 'old' standard by the time it came out. There were no less than 2 papers that discussed exploits in the EMV system prior to the chip implementations in the EU (and the EU went all out implementing chips for health care, public transportation, drivers licenses, passports and ID cards).
You can, right now, read plain text all the 'important' information from a chip (card number etc) simply by querying it's offline capabilities which is one of the primary ways fraud is happening - thieves implement a skimmer and do an offline authorization against the chip (basically: Hey, our Internet broke, here's a transaction for you to sign) and then a few days or even weeks later (some banks allow up to 6 weeks) they "finish" the transaction elsewhere.
Custom electronics and digital signage for your business: www.evcircuits.com
Since no one ever checks signatures properly, stolen cards can easily be used for fraud in the US, without needing to shoulder surf for a PIN first.
Some notes on this... Merchant agreements PROHIBIT merchants from asking for ID and DO NOT REQUIRE that merchants check signatures. In fact Visa et al actually essentially PUNISH vendors who do. Famously, Wal-Mart used to have a policy to check signatures and VISA successfully argued that they should not be on the hook to cover fraudulent purchases that Wal-Mart should have caught via signature checks (ie, they said Wal-Mart's employees were inconsistent). So over 10 years ago Wal-Mart changed their corporate policy and cashiers are instructed to NOT check signatures. The same amount of fraud happens, but VISA et al are now on the hook and can't blame Wal-Mart employees.
In Europe, the card vendors were forced by law into Chip+Pin. VISA has more profit that the GDP of many countries and they don't even loan out money. They don't care about a little fraud. Their concern in the USA was users might periodically forget their PINs and pay with cash instead. So they lobbied to keep signatures, and of course our congress persons don't listen to security experts if corporate interests disagree.
Strictly speaking - not defending this practice, just explaining it - merchants should decline to take your card if you've done this, per their agreement with the card issuers. The signature is there as a promise to pay, not as a means of identification. Yes, this is stupid. A better practice is the banks that allow you to put your picture on the card.
Help save the critically endangered Blue Iguana
The summary talks about merchant system misconfiguration.
That would imply that the chip simply isn't used.
Well, who would have thought that a purely decorative chip that is never used actually has no effect!
Obviously we all expected the gold shininess to make fraudsters run away...
In the US, most shop merchants (the kind without IT departments) get their payment terminals from banks or payment processors who offer zero configuration options. All misconfiguration is by the banks.
What is going in on a scam called PCI-DSS where they demand that you use PCI certified hardware that is so fragile that leaving them on an open network will get them pwned - so they will require you to pay them to 'scan' your website to check it's ok, even if that makes no sense, like you are serving a web site, and then charge you extra for not doing so because you aren't 'compliant'.
By these scams they have pointed the blame at the merchants who had no hand in designing the whole shitty system.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.