0

I'm new to this topic and I found it very interesting how all the payment system is currently working. To be honest it look like they are not doing enough to stop fraudulent activity with Credit Cards.

From my understanding, each card has an smart chip that use encrypted data, this to overcome the Magstrip plaintext.

The problem that each card STILL has a Magstrip in case EMV is not working(Merchant don't wanna lose customers).

When the POS cant read the Chip, it will fallback to the Magstripe. What criminals are doing is cloning track 1//2 on Mag cards with blank/unreadable Chip, this will cause the POS to fallback to Magstripe transaction... and the whole EMV is irrelevant in this case.

I thought this is extremely dangerous and went to the wild to check it on my own card(201 / Chip and Pin) and here is the outcome:

I cloned my own CC (201 / chip) on blank Magstripe card and went to the ATM.. after typing the PIN i got the withdrawal screen, pressed on the lowest amount then the ATM said "Service is Unavailable for this card".

Then I did some research and found this : https://github.com/samyk/magspoof/pull/3

I know that when changing the service code, the CVV1 is also changed (DES encryption of PAN, Exp Date and Service code = CVV1). But I changed it to see what will happen.

Its so weird, The cloned card of my own CC worked just on 1 model of ATM. I even tried to change the CVV1 to random number and its still working on that specific ATM(My bank is not even checking CVV1 ????)

Does anyone know whats going on? Why when changing the Service Code its working on 1 Model of ATMS? Why my bank is not verifying the CVV1 value?

Can someone please explain why my own cloned card is not working when using 201 as service code? The POS should do fallback transaction as he cant read the Chip.

Its really confusing and scary at the same time, how this simple trick (Changing 201 to 101), made the POS to continue the transaction, and then the bank didnt even verify the CVV1(I even typed 000 then random number and still it works).

Should I report this to my bank/POS company?

Improve this question
4
  • I don't believe the service code is considered part of the CVV1, nor does it get factored into it. Also, did you change the data on track 1, track 2, or both?
    – Bobson
    Jun 9, 2020 at 0:09
  • 1
    To calculate a 3-digit CVV, the CVV algorithm requires a Primary Account Number (PAN), a 4-digit Expiration Date, a 3-digit Service Code, and a pair of DES keys (CVKs). I changed the data on both of them. @Bobson do you know why I'm getting "Service is unavailable " when 201 SC is used (On All ATMS), and when changing to 101 it works only on 1 model and same error message for other models. I mean if this is the case, why and how there are still criminals cashing out ATMs? How is it possible? I'm using my own EXACT track 1/2 data on cloned card and the error appear. Am I missing something??
    – Moudilan999
    Jun 9, 2020 at 1:42
  • Are you sure that ATM is actively talking to your bank? Can you check your balance using the 101 card? It's a little hard to follow from your question what combinations worked and what didn't.
    – Bobson
    Jun 9, 2020 at 4:17
  • Yes I checked the balance using the 101 card and it worked! (Only on 1 ATM model- private ATM company not BANK ATM). My main question is: How criminals are still doing fraud when I did not have the ability to cash out my own cloned card? If you go and clone you own CC on magstripe card, is it going to work on the ATM? Because mine didn't and I'm confused. Thanks for your help @Bobson
    – Moudilan999
    Jun 9, 2020 at 9:02

1 Answer 1

Reset to default
1

After hours of research, I think I found the answer: This specific ATM model (Private company) doesn't have the authorization to transfer track data in the request message, therefore CVV1 is not checked by the bank!

https://stackoverflow.com/questions/29820337/difference-between-pos-entry-modes-field-22#34044458 " '90' used in case track data present in the ISO 8583 request message, '02' - if, for same reason, acquirer or terminal device not qualified to transfer track data in the request messages." @iso8583.info-support

So the POS entry mode for this ATM Model is '02', that's why no matter what CVV1 value I encoded in the track data, the withdrawal was successful.

Is that something normal or should I report it? How criminals are still doing ATM frauds with cloned cards? In Europe, all ATM fallback transactions must be declined according to This : pg 226 - 7.6 https://www.mastercard.us/content/dam/mccom/global/documents/transaction-processing-rules.pdf

Is the above means that criminals are doing fraud only on Bank Branch Terminals ? According to this, simple cloning of my own CC should work on Bank Branch ATM right?

Improve this answer
1
  • 1
    Please do not use the Answer space for new or follow up questions. If you have an answer, then just post that.
    – schroeder ♦
    Jun 9, 2020 at 16:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .