3

Within minutes of my credit card being stolen by pickpockets, two large transactions were made by the thieves, apparently in a bar or cafe. My bank tells me that they were chip and pin transactions. I am sure to a high degree of certainty that my pin was not compromised:

  1. It was not written down
  2. It was not used for other purposes
  3. The card in question had not been used in months, and even then, in a different country (effectively ruling out shoulder-surfing)

Still, my bank insists that my pin was used, although there is no reasonable way the thieves could have come to know it. The bank's people obviously place a high degree of trust in this technology.

Are there known exploits that could allow a chip and pin transaction to appear to have been made using the pin, without the criminals actually having it?

3

Is it possible? Yes. This article from 2015 describes one way:

[T]he fraudsters were able to perform a man-in-the-middle attack by programming a second hobbyist chip called a FUN card to accept any PIN entry, and soldering that chip onto the card’s original chip. This increased the thickness of the chip from 0.4mm to 0.7mm, "making insertion into a PoS somewhat uneasy but perfectly feasible,” the researchers write.

...

The researchers explain that a typical EMV transaction involves three steps: card authentication, cardholder verification, and then transaction authorization. During a transaction using one of the altered cards, the original chip was allowed to respond with the card authentication as normal. Then, during card holder authentication, the POS system would ask for a user’s PIN, the thief would respond with any PIN, and the FUN card would step in and send the POS the code indicating that it was ok to proceed with the transaction because the PIN checked out. During the final transaction authentication phase, the FUN card would relay the transaction data between the POS and the original chip, sending the issuing bank an authorization request cryptogram which the card issuer uses to tell the POS system whether to accept the transaction or not.

Effectively, there are two things that a card reader can do with your PIN when "you" enter it - it can encrypt it and send it to your bank to verify, or it can give it to the chip (either in an encrypted or unencrypted form, but it doesn't matter here) and ask the chip whether it's correct. By intercepting that request and replying "correct" no matter what, the reader thinks that everything is good, even if the PIN was wrong.

Since then, the methods of tricking chip-and-pin have just gotten more sophisticated.

The bank should be able to tell you whether the PIN was "verified online" (sent to them) or "verified offline" (validated by the card). If it was online PIN, then I really have no idea how it could have happened.

Side note: I know you don't have the receipts from these transactions, but the next time you do use your PIN, look at the receipt for something called TVR or Tag 95 or something along those lines. It should be a ten-character string. If the 6th character is a 4, then the PIN was sent to your bank. (See here for the rest of it, or here for a decoder).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.