4

I understand why credit cards with embedded chips are more secure (since they generate one time codes), but does this affect the added security benefits provided by the chip? Can cards still be cloned as long as they have magnetic strips, even if a chip is present, because of this?

Obviously some locations don't have chip-enabled terminals yet, so embedded chips can't be used for transactions everywhere. However, because of this, the card is still able to be read via magnetic strip (and thus able to be copied, since all the magnetic strip does is provide the card information unencrypted, no?).

For example, couldn't a thief install a credit card reader of his own at the point-of-sale, accumulate card data from people that way, and then duplicate people's cards to use? How can the chip prevent scenarios like this if it's not required (and magnetic strip can be used instead)?

Edit: The article suggested that answers this post, doesn't. It touches on the subject but doesn't provide a full answer. It says:

"..the magnetic stripe and the chip are used in two different ways, and having both does not mean that the security is lowered to the security of the weaker of the two. ...chips are better, because they are more efficient (no need to handle a network call) and harder to clone (statistics show a fraud rate divided by about 10)."

It explains why most transitional cards have both, but doesn't provide many details about security advantages or disadvantages of pin/chip (separately or together). Why doesn't the magnetic strip compromise the security provided by the chip, especially if the chip is compromised somehow? It seems to, so my question still remains. The article suggested as answering this post, just simply doesn't.

Also, korockinout13's answer (https://security.stackexchange.com/a/136416/52840) seemed to tell me what I wanted to know, but it seems to have been downvoted a lot, which seems odd considering it seemed to answer my question.

Improve this question
3
  • 1
    If you don't hand-over the card to the merchant and use PIN, then it's not going to be cloned (presumably). So it's not nullifying.
    – Aria
    Commented Sep 10, 2016 at 0:31
  • 1
    The chip provide security benefits for card issuers and merchants. It is not designed to protect cardholders. Instead, it pushes a good chunk of fraud liability back to cardholders.
    – KristoferA
    Commented Sep 10, 2016 at 3:08
  • Also, I don't believe this question is a duplicate because the other related post only discusses why cards have both a magnetic strip and chip. I specifically want to know if the magnetic strip negates the security added by the chip. I can see where the confusion comes from since my OP wasn't so clearly written. Question should be more straightforward now, sorry for any confusion. Not sure if I should ask a new question (to receive new answers), but will check back soon.
    – Netside
    Commented Jan 9, 2017 at 4:34

2 Answers 2

Reset to default
4

Most terminals that are pin and chip enabled will force the user to use the chip when it is present on the card. The transition will be long in the usa, so the magnetic stripe is there for backward compatibiliy.

Improve this answer
3
  • 2
    Yes, that's a good summary. But note that you can still exploit it: a fraudster with a stolen card will tkinter with the chip to render it unusable; a terminal will notice a "broken" chip and ask the merchant for a fallback transaction with the magnetic stripe.
    – grochmal
    Commented Sep 10, 2016 at 1:13
  • Also, some things cannot read chips, such as smartphone credit card readers (Square/Stripe, etc.), and it seems a chip isn't required in those cases even for cards that have both strip/chip. This is what originally prompted my question.
    – Netside
    Commented Jan 9, 2017 at 4:55
  • I think grochmal's comment answers my question with a solid "Yes", but correct me if I am wrong (and I know this is an outdated, marked as duplicate post - although it isn't a duplicate IMHO, since a search may miss the posts suggested answer this one because of the title, etc.). The magnetic strip is obviously a security hazard, and not as secure as the chip (like if the card only had the chip but no traditional magnetic strip, it would be more secure).
    – Netside
    Commented Jul 1, 2017 at 1:11
1

Not all POS machines are PIN and Chip ready. Magnetic strip is available for the transition period

Improve this answer
1
  • Yes, thanks for saying this, because this makes me reask my question: Doesn't this make cards with both pin and chip less secure than if you had a card with only a chip, and no traditional magnetic strip at all?
    – Netside
    Commented Jul 1, 2017 at 1:08

Not the answer you're looking for? Browse other questions tagged .