Within minutes of my credit card being stolen by pickpockets, two large transactions were made by the thieves, apparently in a bar or cafe. My bank tells me that they were chip and pin transactions. I am sure to a high degree of certainty that my pin was not compromised:

  1. It was not written down
  2. It was not used for other purposes
  3. The card in question had not been used in months, and even then, in a different country (effectively ruling out shoulder-surfing)

Still, my bank insists that my pin was used, although there is no reasonable way the thieves could have come to know it. The bank's people obviously place a high degree of trust in this technology.

Are there known exploits that could allow a chip and pin transaction to appear to have been made using the pin, without the criminals actually having it?

  • Eventually the bank agreed to look more closely at the evidence. They then said, that of the two transactions, the PIN had been used for one and not the other, casting doubt on the quality of the evidence. They agreed not to debit the money from my account. This was a great relief, as going through a long process with the ombudsman was not my favoured option. Sep 22, 2019 at 18:18

2 Answers 2


Is it possible? Yes. This article from 2015 describes one way:

[T]he fraudsters were able to perform a man-in-the-middle attack by programming a second hobbyist chip called a FUN card to accept any PIN entry, and soldering that chip onto the card’s original chip. This increased the thickness of the chip from 0.4mm to 0.7mm, "making insertion into a PoS somewhat uneasy but perfectly feasible,” the researchers write.


The researchers explain that a typical EMV transaction involves three steps: card authentication, cardholder verification, and then transaction authorization. During a transaction using one of the altered cards, the original chip was allowed to respond with the card authentication as normal. Then, during card holder authentication, the POS system would ask for a user’s PIN, the thief would respond with any PIN, and the FUN card would step in and send the POS the code indicating that it was ok to proceed with the transaction because the PIN checked out. During the final transaction authentication phase, the FUN card would relay the transaction data between the POS and the original chip, sending the issuing bank an authorization request cryptogram which the card issuer uses to tell the POS system whether to accept the transaction or not.

Effectively, there are two things that a card reader can do with your PIN when "you" enter it - it can encrypt it and send it to your bank to verify, or it can give it to the chip (either in an encrypted or unencrypted form, but it doesn't matter here) and ask the chip whether it's correct. By intercepting that request and replying "correct" no matter what, the reader thinks that everything is good, even if the PIN was wrong.

Since then, the methods of tricking chip-and-pin have just gotten more sophisticated.

The bank should be able to tell you whether the PIN was "verified online" (sent to them) or "verified offline" (validated by the card). If it was online PIN, then I really have no idea how it could have happened.

Side note: I know you don't have the receipts from these transactions, but the next time you do use your PIN, look at the receipt for something called TVR or Tag 95 or something along those lines. It should be a ten-character string. If the 6th character is a 4, then the PIN was sent to your bank. (See here for the rest of it, or here for a decoder).


Today, Chip & PIN card uses Combined Data Authentication (CDA) for card authentication and transaction authorisation. There was an attack on chip and pin called No-PIN attack to which even CDA was vulnerable and it used to work with both offline and online transaction. See Chip and Pin is broken.

The flaw is that when you put a card into a terminal, a negotiation takes place about how the cardholder should be authenticated: using a PIN, using a signature or not at all. This particular subprotocol is not authenticated, so a man-in-the-middle fraudulent card can trick the stolen card into thinking it’s doing a chip-and-signature transaction while the terminal thinks it’s chip-and-PIN. The upshot is that you can buy stuff using a stolen card and a PIN of 0000 (or anything you want). We did so, on camera, using various journalists’ cards. The transactions went through fine and the receipts say “Verified by PIN”.

The FUN card successfully exploited this vulnerability a year after researchers at Cambridge University released their paper in 2010 but the French criminals worked out this attack independently.

As of now, that vulnerability was fixed and there are no known vulnerability in Chip & PIN card to fake a transaction. An attacker only needs to know your PIN to use your card and it is easier to obtain PIN than finding another undisclosed vulnerability.

Stealing ATM PINs with thermal cameras

New ATM warning: Watch out for pinhole cameras

Point of sale (PoS) devices have encrypted keypad so a PoS malware can steal your credit card data in practice but not the PIN. Not all PoS devices follow this standard though and PoS keyloggers do exist that infect outdated payment terminals. See ChewBacca point-of-sale keylogger SLURPS your CREDIT CARD data

It could be that it was an organised attack and they might have checked if your credit card data along with the PIN has been ever compromised by PoS malware. Today, every transaction is done online along with online PIN verification. You have to ask your bank if the PIN was verified online or offline. If it was verified online, then pickpockets certainly knew your PIN and if it was offline then there could be a vulnerability involved.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .