Is credit card cloning possible BEFORE activation?

Question

I recently acquired this novel credit card which brags about being super secure for not having printed the security numbers on the physical card.

Then, when my physical card package arrive I notice it has some signs of manipulation. I asked the company to provide me with another credit card, and they told me what I stated before: since it doesn't have any security number printed it just doesn't matter much if anyone sees the card before I receive it.

I just thought that yes it helps to be a little more secure, but it doesn't solve the problem since the credit card itself still has information that if stolen, the whole credit card authentication is stolen (cloning). As a result, I'm not sure now if it's secure to activate the card, since its information might have already been stolen digitally, and activation would just let them purchase with it. Am I right or is there something I'm missing?

Answer 1

A modern card has four methods of payment:

• Contactless/NFC/Tap
• EMV Chip/Insert/"dip"
• Magnetic stripe/Swipe
• Printed number/manual entry

The first two are pretty safe against cloning. The chip is effectively a tiny computer with a secret key in it, and it calculates a new cryptogram for every transaction. There are attacks on EMV, but cloning isn't a practical one.

The last one is what is guarded against by not printing the security code on the card. On most websites the code will be required for a payment, but it is possible to run one without it. The banks are getting less and less tolerant of that, though, so most legitimate merchants will require it. (It protects them, too.) On the other hand, if someone looked at your card they also have your address (from the envelope), which is another point of information that could be used to "prove" a transaction is legit. So if someone has the card number but not the code, you might be able to be charged fraudulently, but it's not likely and you can easily challenge and reverse it if it happens.

The third option is the dangerous one. It's trivial to pull the data off of a magstripe and only a little harder to write it onto another card - this is a big part of why EMV adoption (ideally as chip-and-pin, but even just as chip) was pushed so hard. Normally, you aren't allowed to swipe a chip-capable card in a chip-capable terminal, but if there's a merchant that doesn't have a chip reader it can be swiped there.
Additionally, if the chip is damaged, you can "fallback" to a swipe after the chip reader tries to read it and fails. It'd be easy for a fraudster to break the chip on a card and then swipe "your" card as fallback. The bank gets notified when this happens, but it's still likely to be approved.

---

All of which is a long way to say that not printing the code on the card is more secure than printing it, but not - by itself - proof against the card being cloned or used fraudulently. As gowenfawr's answer says:

You are probably safe to activate the card, just keep a close watch on transactions - I find it helpful to set up a text or email notification for all transactions - and if any unauthorized transactions crop up, you can lock the card and dispute the transaction immediately.

Answer 2

it doesn't solve the problem since the credit card itself stills has magnetically information that if stolen,

In fact, the security code is not stored on the mag strip, in the chip, or anywhere in the card. So an attacker who intercepted and cloned your card would not have access to the security code - unless the code was also printed on the card or in the packet that the card came with, and they looked at it then.

So in this case, the card issuer's precaution of not printing the security code on the card would be very helpful.

You are probably safe to activate the card, just keep a close watch on transactions - I find it helpful to set up a text or email notification for all transactions - and if any unauthorized transactions crop up, you can lock the card and dispute the transaction immediately.