How could criminals use stolen EMV credit cards in 2011?

Question

I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory introduction in the USA. I live in Europe anyway.

This question is directly related to the specific fraud and must be contextualized into year 2011, as this technique is mitigated. This means that the question is not actual.

Summary

By adopting a sophisticated MITM technique, physically implanting a proxy chip onto a real stolen card's chip, criminals were able to completely disable user authentication via PIN code and perform transactions using stolen credit cards.

After the fraud was discovered and cryptoanalyzed, a number of fraud prevention enhancement were deployed to POS system and card protocol to defeat this technique.

Interesting quote from the article

The reason we started our research was that people came to us again and again claiming that their cards had been stolen and used in store transactions which the banks swore proved that they'd been negligent with their PINs, while the customers were certain they could not have been.”

My question

How was it ever possible that a stolen card was usable for months?

Since the very introduction of EMV cards (a long time for us Europeans) all banks getting reports on stolen cards would first disable the card itself, and in real time. Credit cards could be physically stolen (like the 2011 fraud), or their PIN compromised, namely coerced.

In both case, a POS machine from year 2011, while accepting a card that passed PIN verification, would get a clear rejection from the payment processor, as the card is supposed to appear in the blacklisted cards, or not in the list of enabled cards.

How was it possible that those transactions were accepted and processed? The article clearly speaks about stolen cards, and I don't think that all 40s of cards were stolen without the cardholder knowing that. And also I am not talking about a card stolen and used as quickly as possible before the cardholder calls the bank to block the card.

All of our banks since earlier than 2011 offered a free-dial number to report stolen card. The card is blocked immediately (ATMs may also refuse to return the card to the presenter) and the bank will later issue a new EMV card with a new PAN and a new PIN. I had to block my stolen EMV card once, so I have direct experience with this. It was never used by who got it, as it was PIN protected, but anyway I got my old card blocked upon phone call, and after a few weeks a new card with new number and code was issued to me.

I have read the entire paper I linked and could not understand how could that fraud scheme be effective against payment processing banks. Unless at that time the payment processor did not check for the card to be active, relying on its advertised expiry date (stored in the chip) and PIN authentication result.

The sense of this question is that, theoretically, an EMV card with compromised PIN reported stolen could be (or could have been at the time) used further! I know about a small number of PIN coercion cases in my country.

Answer 1

One of the features of EMV is that a transaction can be approved offline by the chip, if neither the chip nor the terminal flags it to go online. The terminal simply stores the chip's response, and sends it to the processor as part of end-of-day settlement. Some terminals aren't even capable of online approval, although I don't know how common that is.

This is an advantage for the merchant, because they can process transactions faster and/or without having to dial into a processor to approve it online. The only advantage to the cardholder is speed. I presume the issuing banks have some advantage, but I'm not sure what it is. If you assume that EMV cards cannot be copied, or used by someone else if stolen, it's just as safe as approving online.

All this is to say, if they were using the stolen cards for amounts below the floor limit configured in the terminal, it is very possible that they were not authorized online, and thus not flagged as stolen at the time. It's only at the end of the day that the merchant would discover that it was a fraudulent transaction.

In recent years, has connections to the processor have gotten better in Europe, more transactions are being processed online anyway. I know that Visa recently mandated that the floor limit for visa cards should be reduced to zero, forcing every visa transaction to be authorized online if possible.