1

Two properly placed $200 HD cameras are able to make close pictures of both sides of a credit card used while shopping. When you insert the card to the card reader, both sides get exposed, including the credit card number, name, expiry, CVC. That's far enough to get your money stolen.

I think this is a pretty big risk most of people are not aware of. Is there any way to cover the sensitive data, at least the CVC without having to worry about a sticker being peeled off and stuck in an ATM for example? Or cover the card with a translucent layer? Has anyone done something like this?

  • 2
    You can remove most of the information from a card without affecting the normal use, but I think "pretty big risk" is possibly a bit strong... It also wouldn't expose the PIN for Chip+PIN cards, which you should be able to cover when entering. – Matthew Jan 26 '17 at 15:10
  • 2
    To add to @Matthew's point, the fact that card data isn't regularly stolen this way is a perfectly objective way to determine that this is, in fact, not a pretty big risk, but quite a small risk instead. There are so many easier (and better) ways to steal card data that any actual increase in overall risk is probably negligible. – Xander Jan 26 '17 at 15:35
  • 1
  • you can rub off the foil on the embossed numbers to make them harder to see. – dandavis Jan 26 '17 at 17:36
5

Is there any way to cover the sensitive data, at least the CVC without having to worry about a sticker being peeled off and stuck in an ATM for example?

Paranoid people remove the CVC* from the card using ablation ("they scrape it off"). There is no need for the CVC to actually be on the card, provided you write it down somewhere safe and/or remember it.

For all other values, the standard protections are to cup the card in your hand as much as possible and be alert for suspicious environmental cues, such as a new fascia on the ATM. There's no golden fix.

As @RápliAndrás points out in the comment, the CVC can still be brute-forced. If this interests you, there's a fascinating paper called Does The Online Card Payment Landscape Unwittingly Facilitate Fraud that you must read. Specifically, it shows that the vulnerability to guessing operations varies from site to site, and that overall there is no systemic limit to prevent multiple sites from being used together to optimize the guessing. And not only do the card brands not have systemic limits to block CVC guessing, but many card transactions do not require the CVC to complete in any case.

But in general, people scraping the CVC are defending against a low-level physical access attack. They are making it so that the waiter that takes their card into the back room can't jot down their PAN (card number) and CVC. They are not defending against the case of an attacker who wishes to brute force card parameters given the PAN.

Remember that credit cards are not designed for security - they are designed for commerce. The entire credit card industry has a tolerance for acceptable levels of risk, which is to say, if a single-digit percent of transactions are fraudulent, then that's considered the cost of doing business. Small tweaks - such as the CVC and EMV - have been made to improve the statistics, but not to eradicate risk.

*Card Verificaton Code or Value is also known as CVC, CVV, CSC, CID, CAV, or "That number on the back of your card."

  • If it's not on the card anymore, it can still be bruteforced in <1000 tries, no? Do CC companies have some kind of restriction against bruteforce? – Rápli András Jan 26 '17 at 15:13
  • @RápliAndrás updated to address your comment. – gowenfawr Jan 26 '17 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.