It's frequently stated that EMV cards cannot be cloned. I'd like to know, specially with commodity smart card readers/ writers, why is this true? What specific data cannot be read using commodity hardware, and what type of hardware would be required to do so?

  • 1
    EMV is beyond the card itself. There's a chip on the card that cannot be cloned, thus defeating the efforts of cloning the card by skimming it over a reader.
    – Nathan C
    Commented Dec 2, 2013 at 16:03
  • That's my question: why cannot the chip be cloned?
    – Jaywalker
    Commented Dec 2, 2013 at 16:09
  • 2
    It's a physical device on the card itself, not "virtual" or encoded onto the card.
    – Nathan C
    Commented Dec 2, 2013 at 16:10

3 Answers 3


To use an analogy, expanding on what people have said about it being a chip:

An older style magstripe card was simply a string of characters encoded onto the card, it could be read, or written, and that was it. It's like a page of a book, you can read it, but if you don't understand, you can't ask it questions.

An EMV chip is a small microprocessor. It runs a specific application. You can't just read what it knows, but you can 'ask' it 'questions' by issuing commands from the EMV set, and see what it returns. Unlike Magstripe, it's interactive, and is capable of both answering and more importantly, refusing to answer queries.

All of this is a little simplified. Encryption obviously plays a large role in EMV, and it's much complex than just some little microbug that you can interview, like I make it sound, but the essence is there.

Like @Lucas Kauffman has mentioned, EMV isn't unclonable, but it is significantly more difficult, at least if you start from first principles. As with many security issues, these complex differences will start to mean less and less now that vulnerabilities have been found, because it will be possible to buy cloners without needing to know how they actually work.

  • Like your answer in general; would you like to add more explanation to the first sentence of the third para: "An EMV chip is a small microprocessor, and hence cloning actually means...."
    – Jaywalker
    Commented Dec 6, 2013 at 17:52
  • Ok, well, the chip actually runs software, so rather than being a list that can be read, or a file that can be opened, it's a program that will take input, and return output based on the results of its program code. To successfully clone a card, you need to create another card that provide the right answer to any input challenge, and to do that, you have to work out what the process is.
    – Owen
    Commented Dec 9, 2013 at 10:16
  • 1
    @Owen: No, you have to work out what the cryptographic secret stored in the chip is. Generally, the process (or algorithm) should be considered to be well known - otherwise, how would anyone know it's cryptographically secure. Commented Jan 24, 2014 at 0:43
  • 1
    @SoftwareMonkey It is good practice for a designer to assume the attacker knows the algorithms (and pick well-analyzed cryptographic algorithms and protocols) plus the communication protocol. That does not imply they actually are published, so as an attacker, you may still need to figure them out, in addition to the key itself. Commented Jan 24, 2014 at 6:34
  • 1
    @SoftwareMonkey: Working out what the cryptographic secret is necessary yes, but so is working out what algos and crypto system are being used, which would be the process I referred to. The question was quite simple, so I simplified the answer too. Card distributors actually don't yell about what crypto they're using, although they obviously release this info to some people, like the manufacturers of POS systems. To clone cards and such, you do need to do a bit of working out what process is in use.
    – Owen
    Commented Jan 24, 2014 at 12:39

The chip is actually a device which can perform calculations execute instructions. It's used for challenge response as to authorize attackers. It's therefor not possible to just clone them.

There are attacks against the EMV cards as demonstrated by the University of Camebridge. They published a paper about it named "Chip and Skin: Cloning EMV cards with a preplay attack".

The attack heavily relies on flawed random number generator used by the bank terminals. There is also a Defcon presentation on chip & pin which can be found here.

I attended an OWASP chapter meeting last year where Senior Cambrdige ResearcherSteven Murdoch presented their attack. He also noted that recently criminals had realized to reduce the attack for which they needed a complete PC in a back pack, to a simple chip which can be fit in plastic banking card (the chip itself was a mere 3 mm longer).

  • 2
    The good news is that by updating the faulty POS terminal such "preplay" attacks against predictable nonce values are immediately thwarted. Updating 100,000 POS machines is much more practical and cost-effective than replacing 1000,000,000 cards (because the chip code is flawed). Commented Jan 24, 2014 at 0:50

The key is that EMV cards don't just output the same response every time. They're a challenge-response system: they work by reading a "challenge" message from the terminal, doing some computation within the chip, and then outputting a unique "response" message back. If you capture that response, you're only capturing one possible output -- the one that corresponds to the challenge it was sent. Since a terminal should never output the same challenge twice and the challenge should be unpredictable, then that capture response should be useless in the future.

In order to fully clone an EMV chip, you need to know the secret that's stored inside it. Since it never transmits that secret, obtaining it is impractical.

This in contrast to other identification technology such as RFID and magnetic stripes which only know how to transmit one number. In the case of these technologies, cloning that output is reasonably simple.

  • 1
    Is it possible to at least transfer an EMV card? The reason I ask is let's say I want a more fancy credit card than the plastic one my bank sends me. If I get a nice, metal blank card of some sort to just transfer the data over and use it. Commented Aug 18, 2017 at 21:15
  • @AlexKwitny Theoretically, but you'd have to destroy the original card in the process, and run a high likelihood of destroying the chip as well, making it unusable.
    – tylerl
    Commented Aug 19, 2017 at 4:43
  • 1
    Is there anywhere you can recommend I start to learn about this? I'm OK with destroying the card. The goal isn't to "clone" the card as much as transfer it to a new card body. Nothing nefarious. Commented Dec 14, 2017 at 23:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .