I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory introduction in the USA. I live in Europe anyway.
This question is directly related to the specific fraud and must be contextualized into year 2011, as this technique is mitigated. This means that the question is not actual.
By adopting a sophisticated MITM technique, physically implanting a proxy chip onto a real stolen card's chip, criminals were able to completely disable user authentication via PIN code and perform transactions using stolen credit cards.
After the fraud was discovered and cryptoanalyzed, a number of fraud prevention enhancement were deployed to POS system and card protocol to defeat this technique.
Interesting quote from the article
The reason we started our research was that people came to us again and again claiming that their cards had been stolen and used in store transactions which the banks swore proved that they'd been negligent with their PINs, while the customers were certain they could not have been.”
How was it ever possible that a stolen card was usable for months?
Since the very introduction of EMV cards (a long time for us Europeans) all banks getting reports on stolen cards would first disable the card itself, and in real time. Credit cards could be physically stolen (like the 2011 fraud), or their PIN compromised, namely coerced.
In both case, a POS machine from year 2011, while accepting a card that passed PIN verification, would get a clear rejection from the payment processor, as the card is supposed to appear in the blacklisted cards, or not in the list of enabled cards.
How was it possible that those transactions were accepted and processed? The article clearly speaks about stolen cards, and I don't think that all 40s of cards were stolen without the cardholder knowing that. And also I am not talking about a card stolen and used as quickly as possible before the cardholder calls the bank to block the card.
All of our banks since earlier than 2011 offered a free-dial number to report stolen card. The card is blocked immediately (ATMs may also refuse to return the card to the presenter) and the bank will later issue a new EMV card with a new PAN and a new PIN. I had to block my stolen EMV card once, so I have direct experience with this. It was never used by who got it, as it was PIN protected, but anyway I got my old card blocked upon phone call, and after a few weeks a new card with new number and code was issued to me.
I have read the entire paper I linked and could not understand how could that fraud scheme be effective against payment processing banks. Unless at that time the payment processor did not check for the card to be active, relying on its advertised expiry date (stored in the chip) and PIN authentication result.
The sense of this question is that, theoretically, an EMV card with compromised PIN reported stolen could be (or could have been at the time) used further! I know about a small number of PIN coercion cases in my country.