Slashdot Mirror
US Chip Cards Are Being Compromised In the Millions (threatpost.com)
According to a study from Gemini Advisory, some 60 million U.S. cards were compromised in the past 12 months. "Of those, 93 percent were EMV chip-enabled," reports Threatpost. "Also, crucially, 75 percent, or 45.8 million, were records stolen from in-person transactions." From the report: These were likely compromised through card-skimming malware and point-of-sale (POS) breaches at establishments like retailers, hotels and restaurants, the likes of which continue to make headlines. Further results show that the U.S. leads the rest of the world in the total amount of compromised EMV payment cards by a massive 37.3 million records. In the past 12 months, about 15.9 million compromised non-U.S. payment cards were posted for sale on the underground, split between 11.3 million card-not-present (online transaction) records and 4.6 million card-present records, of which 4.3 million were EMV enabled. This means that the theft level of EMV-enabled card data in the U.S. is 868 percent higher than the rest of the world combined.
The reason for this state of affairs, according to Gemini, is the lack of U.S. merchant compliance -- too many of them still use the mag-stripe function at PoS terminals. Gemini also said that card-present data "is also collected via a more manual method by skimmer groups, who are utilizing custom made hardware known as 'shimmers' to record and exfiltrate data from ATMs and POS systems. The firm also found that while most large U.S. merchants have fully transitioned to EMV, gas pump terminals and small/medium size businesses are emerging as the main targets for cybercriminals going forward.
The reason for this state of affairs, according to Gemini, is the lack of U.S. merchant compliance -- too many of them still use the mag-stripe function at PoS terminals. Gemini also said that card-present data "is also collected via a more manual method by skimmer groups, who are utilizing custom made hardware known as 'shimmers' to record and exfiltrate data from ATMs and POS systems. The firm also found that while most large U.S. merchants have fully transitioned to EMV, gas pump terminals and small/medium size businesses are emerging as the main targets for cybercriminals going forward.
too many of them still use the mag-stripe function
If this is mostly happening via the old magnetic strip than what does the chip even have to do with this story?
This is the mecca for fraud in Europe.
Why aren't the payment processors issuing and responsible for the POS card processing hardware? Why is it left to the retailer to implement whatever patchwork they manage to come up with?
The last couple of times I bought groceries, the chip was rejected three times, then fell back to magstrip.
Turns out relying on chip and PIN is unreliable.
Honestly, this doesn't make me too upset, since consumers will always get their money back at the end of the day.
Anything that reduces the profits of the card companies, card-using merchants, and card-issuing banks doesn't make me the slightest bit sad. Think of it as the world throwing some sand into the gears of the transition to a cash "free" (aka privacy-free) economy. Anything that creates just a little bit more friction is a net positive.
So to get this straight, you get a plastic card, it supports both the newfangled way and the old-and-busted way (or else people would be up in arms that it wasn't compatible with 100% of readers). By the way, the new hotness is just the old version plus a transaction-unique cryptographic token. Now, when this is deployed, people figure out -- they skim the new way and then use it to create mag-stripe cards that can be used only at places that don't require a chip. But somehow this is a problem with the chip cards?
Nooooo, it's a problem with places that don't require a chip. We've known since the 80s that you can copy a magnetic strip with a 2-tape boombox (seriously, it will work).
TLDR: There's nothing wrong with the chip cards themselves. But there is something wrong with merchants that haven't upgraded to EMV, and definitely something wrong with /. editors that write a completely ass-backwards headline.
And that is why the banks are interested in crypto debit cards. They don't want to deal with security issues. with crypto, they can pass those issues to the card user.
The headline is misleading. It is not the transactions by chip that are being compromised. The fact that a card swiped the old fashioned way happened to have a chip is moot - it is the same attack vector on the legacy magnetic strip.
There must be significant expense involved for merchants to switch to the chip readers, as most of the POS now systems have chip readers, but some retailers don't support them. More than likely it is price gouging by the vendors that configure and manage the POS units.
Finally, in my area, Lowes Home Improvement has the totally bizarre setup where if I want to use my bank card as a debit card (requiring PIN) I must swipe, and if I want to use it as credit card (requiring signature) I must insert it. However, it asks you AFTER you have inserted or swiped, so if you choose the wrong option then you have to remove or re-swipe the card. The local store has resorted to putting handwritten notes on the POS terminals advising which to do (insert or swipe) depending on whether you want credit or debit. That leads me to believe there is some recurring per-transaction cost using chip with debit.
Better known as 318230.
You're caught impersonating me c6gunner (your name's the submitter signing "APK") https://linux.slashdot.org/com... as you ALTERED /.ers PRAISE of my work (not yours you don't even HAVE, lol).
(You shouldn't throw stones when you live in a glass house boys - especially vs. me: RIGHT, ZIP? https://developers.slashdot.or... CAUGHT LYING TOO (you DO have a registered /. acc't. but STALK me anonymously instead - punk) https://news.slashdot.org/comm... )
HOWEVER: In your "impersonations" trying to make me "look bad" or a liar (like your kind is)? Hope you're RIGHT (considering I'm only sure hosts stop portsmash vs. Spectre/Meltdown) https://tech.slashdot.org/comm...
APK
P.S.=> GROW UP weezils - you do it to yourselves trying to "take me on" & FAILING like you always do (especially on tech) + so then you start STALKING me by UNIDENTIFIABLE anonymous posts OR by IMPERSONATING me (weak BITCH tactics only a HOMO would do, lol)... apk
Whenever I travel to the US, one of the first things that I notice is different is the lax approach to card security. In most of Western Europe, pretty much every card transaction uses the chip. I can disable the mag-stripe on some of my cards (through the banks' online systems), and using magstripe anywhere increases the chance of a transaction being picked up by the banks' automated fraud detection systems. Then when you get to the US, you go into a restaurant, settle up by card with no signature and no pin, and then the restaurant can manipulate the transaction later to add whatever tip you wrote on the bill. Madness!
the retailers put up with allowing mag stripe because the banks do
if EMV actually made the retailer liable for fraud then they would make sure you use pay wave/pass (NFC) and a PIN
by using a CHIP and PIN it first of all verifies LOCALLY on the chip then generates a One Time Code that gets sent to the issuing network (bank) There is ZERO
repeat ZERO ways to skim chip and PIN its all down to the Mag Stripe
before some bright spark complains about having to input the numbers into ecommerce sites... Yes this can be secured by 2FA that the banks in europe ask for (you get redirected during the payment process to the banks website that then ask's for your 2FA details )
basically its american banks being lazy and dont care about loosing customer details... its just a cost of business to them and they dont care about the retailers experience either otherwise they would have made made NFC cheap and easy
basically banks need to reduce they fee's they charge retailers in return for securing things 0.5% is common in Europe
Yet another reason cash will always be best. Itâ(TM)s in-hackable.
If one uses Google or Apple Pay, which takes advantage of virtual card numbers (not your real card number), does this make you safe from the described card attacks?
Yes, as reported by Fortune anyway.
I started using my watch, samsung pay, because, as I understand it, between my bank & the watch/phone/app, it sends a ONE TIME token through the POS reader, instead of the card information. If that is exactly how it works, even if they get a "card number" it won't do a thief any good because it's only good for a one time use.
sigh. I'd like to type in pages but I won't.
long story short, I got a text from wells saying they thought something was 'up' with some purchases. I never check sms (I use email and ignore sms) but I later found that text and called wells to check if it was real. it was real and there were thousands of dollars of charges I didn't make. I never lost my card and it was never out of my posession.
I called wells and we went thru the charges. I told them which were mine and which were unknown to me. I thought that was it and waited to hear back. weeks later, I get a letter in the mail from them saying that they 'investigated' it and since the card was never lost and it was a CHIP BASED CARD, it could NOT BE THEIR FAULT and I was told I had to pay the thousands of dollars of charges!
I was shocked. I was a member of that bank for over 20 years (yeah, I know, I should have left years ago when wells first had issues reported against them).
the weeks that they let it sit were weeks that evidence was starting to fade away (video 'tapes' being recycled at stores, etc). I think that was also part of wells' plan, to delay me and make me miss some deadlines.
I forced them to re-open the 'closed' case and I filed a police report. I was not asked to at first, but when I went to the bank in person and made an issue of this, they asked that I make a formal police report, which I then did.
get this: one week later, I get letters in the mail from the local court system. they caught 2 people and I was informed that sentencing was going to happen in 1 week and I was allowed to attend, if I wanted. (I suspect that the forged card had my name on it or receipts from stores had my name on it).
here's the kicker: it took ALL OF THIS in order to convince my bank that it was not me. their line, all along was 'it was a chip card and it never left your possesion, in your own words, and chip cards are PERFECT, so pay up, it was you!'. that was their line and until I showed them court papers, they would not give in.
tell everyone you know about this. the chip cards are less than useless in the US and banks are still putting their fingers in their ears and saying 'I cant hear you, its still your fault, pay up!'.
their security system is at fault and yet they blame us.
it took me MONTHS to get this all cleared out. did I get anything for my time? no. of course not.
wells fargo can eat shit and die. anyone still with them should leave immediately. I was a 20+ year member and they threw me under the bus for a few thousand dollars. they don't deserve to have a single customer. please leave if you are with them.
and be very careful with your 'chip' card. there's nothing secure about it. the thieves have it all worked out already ;(
--
"It is now safe to switch off your computer."
The merchants are liable for card fraud if a magstripe is used.
Most of the merchants don't own the terminals, they're leased.
It didn't take long for the full rollout of emv chip+pin.
The only annoying thing now is all the terminals support NFC, but a lot of merchants don't have it enabled because the fees are higher. If contactless transactions cost the same as credit cards I wouldn't need to carry my wallet around when I go out for lunch.
I knew an independent merchant a few years back and the problem was the middlemen were taking a higher percentage of transactions if you got the fancier equipment, and either didn't allow outright hardware purchase or gouged on it claiming the backend processing was higher.
End result merchants didn't want to lose the extra percentage points in their transaction fees and went with the equipment that wouldn't (at the time) cost it.
The whole equipment situation is a mess too, because most of them were sending unencrypted data, either over telephone lines, or via http (not https!) Whole thing was an ugly mess.
nt
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
When I visited the US a couple of years ago, I was surprised to see how backwards everything was. I had to constantly explain that although my card has a magnetic strip, it does not tap into any of the data on the card. It's chip, or nothing. I had to leave stores more than once, because their terminals didn't support chips. Strips are not used at all anymore where I live, they are simply considered too insecure, so no data are stored on them, they are only there because the cards themselves are produced that way. And this is the exact reason why we have stopped using them.
The reasons why banks have implemented it, is because they are responsible for fraud with the cards, as long as they cannot prove that the owner of the card has been careless with their pin. If they authorize payment without PIN, all the owner has to do is say they didn't make that purchase. Guess that gave the banks an incentive to fix their security issues.
I know It has already said enough, but I am also suprised by this info. I starting to notice last couple of months, that we are not behind America regarding the usage of technologie, but America is way behind the modern world, with a lot of technologies.(Like your Robocall issues)
Maybe these are the cons of a free society?
Itâ(TM)s not that I am mad, or disapointed, but really supprised, always was in the illusion America is high tech, and I should move to there to be in touch with the latest and greatest. But now realizing it would set me back almost 10 Years. And maybe they are high tech but low tech in the implementation. The higer (lobby) forces to strong to fight?.
People interested in Tech and Politics - yall should be doing something to lift US to the next level man. Stop with only substracting value feom people (Mass data new gold), and start giving something back. (Good secure systems, which do not allow tracking, stalking and stealing)
Never meet your heroâ(TM)s - starting to understand what it means now :P sorry little disapointed still. Donâ(TM)t want to believe this story.