Technical realization of fraudulent credit card cash withdrawal

Question

Somebody unauthorized in India managed to withdraw cash from my credit card account. The card I use (and which they claim to have used) is a German Visa prepaid card issued by Postbank. It has a chip and a magnet strip.

I'm interested in the technical side of PIN verification. IIUC the thief must have had a physical card and a PIN for cash withdrawal (as opposed to non-cash transactions like purchases which can be done without a PIN).

The bank representative I talked to claimed that it is possible for anybody who has read the card to create a duplicate. Is that true for both the magnet strip and the chip? I always thought that the chip was introduced to prevent forging.

The representative also claimed that a matching PIN can be computed from the card data, but I think he was not sure about the details. Is that true? I remember that ages ago it was possible to use an ATM which was not online and withdraw money with a forged PIN which tested true against the local card data but would not have passed a verification by the bank. Is that what happened here, e.g. are there still ATMs which are not online?

Answer 1

You are correct that a thief needs a physical card and pin to make a withdrawal. Chips cannot be fully cloned (yet, that may change), but magnetic strips can be cloned or created from intercepted chip data. Brazilian hackers have come up with a way to create working cards which allow any pin and bypass card data authentication:

The card-cloners created a Java application for cards to run. The application has two capabilities: First, it tells the POS terminal there is no need to perform data authentication. That means no cryptographic operations, sparing them the near-impossible task of obtaining the card’s private cryptographic keys.

But that still leaves PIN authentication. However, there’s an option in the EMV standard to choose as the entity checking if the PIN is correct…your card. Or, more precisely, an app running on your card.

You read that right: The cybercriminals’ app can say a PIN is valid, no matter what PIN was entered. That means that the crook wielding the card can simply enter four random digits — and they’ll always be accepted.

However, it's unlikely that's how your card was compromised. While there are attacks against credit card chips which can break encryption and retrieve PIN and other data, they aren't used in the wild so that representative was. What's likely happened to you is you've been hit by one of the mainstream credit card attacks:

• Skimming: a device reads the magnetic strip of your card as it's put into a machine while another device gets your pin by videoing your fingers or reading the key input
• Compromised ATM: a hacked ATM gives the strip and pin data to attackers
• Shimming: a device is put between your card's chip and a card reader, it intercepts the communications between the device and your card, allowing the magnetic strip to be re-created. Your pin would need to be gained separately using the same methods as skimming
• Compromised Point of Sale System: some major retailers' point of sale terminals have been hacked in the past, handheld credit card readers have as well, where your card data and pin are sent to a malicious third party