Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When it comes to fraud screening for card not present transactions (credit card / debit card) there are a number of techniques / services that can be utilized to mitigate risks from fraudulent transactions. Examples being:

  • BIN validations
  • Device Profiling
  • Geo validations

My question however is about card present transactions that is available for all cards? (This excludes EMV for the most part) What are the techniques that are utilized to deal with this flavor of fraud prevention? Are there any resources one can use to learn more about this?

share|improve this question

The industry's answer to this is Chip-and-PIN (as it's known in the UK), where the card holder must enter their personal identification number into the card terminal for every card-present transaction. It has reduced card-present fraud by around 80%. Unfortunately, it has not yet seen widespread deployment in the US, which is causing problems for US card holders trying to use their cards in Europe.

share|improve this answer
Thanks Mike - this is however issuer-based security and is not available globally, or on every card. I am wanting to see if there are rules that can be run (by a CSP / PSP) to score transactions according to risk. – Kyle Rozendo Oct 6 '11 at 8:20
Note there is a growing body of research, case law and indeed policy to demonstrate that chip and pin is not a completely reliable solution / implementation varies even within UK – symcbean Oct 6 '11 at 13:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.