Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code?
If the PIN code is changed, can the cloned card still be used?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityCould a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code?
It depends.
A lot of threats relies on the attacker knowing only the card number and the expiration date and not the PIN. Personally, if changing one thing, I would merely request to change the card number instead of the PIN.
Some web-forms on the Internet give me the impression that some countries are used to keep the same card number when renewing a card. In France (at least) the card number is not valid more than 2-3 years: after this period the card is replaced by a new one whose number is partially different and as unpredictable as possible (at the opposite, without explicit request the PIN code remains the same over the years and card renewals).
From a theoretical perspective, a smart card can be compared to a networked computer: it's content cannot be accessed directly, one must send requests to the chip (either to access some data or execute some operation) and the chip answers depending on the protocol requirement (authentication might be needed in prior to some requests, etc.).
Therefore, still from a theoretical perspective, a smart card itself can be considered as secure, this led to a wrong marketing discourse claiming that systems based on it were "unbreakable" or that such card were "unclonable". However, a complex system like the payment system cannot be shrinked to the sole EMV card security: everything around it must be taken into account, from the protocols to the devices, a lot of disparate elements participating into weakening the payment system and making it far from being "unbreakable".
The smart card being a French invention, France was obviously an early adopter of this technology to increase payment system security. Indeed, the magstripe was not perceived as being secure enough, and the future shows that this weakness was true (at the end of this video for instance, we can see someone creating a credit card from an hotel door card).
Despite "GIE cartes bancaires" (the French banks consortium handling smart card based payment systems) claims that this system was unbreakable, a security researcher, Serge Humpich, contacted them privately and demonstrated this was not true. Due to a too short private key being used, Serge Humpich was indeed in measure, not only to clone a card, but even to create new cards with fancy numbers.
While Serge humpich's goal was to help the "GIE cartes bancaires" to improve the security of their system, as a reward they sued him for having reverse-engineered it. As a reward, the "GIE cartes bancaires" sued him for having reverse-engineered their security system.
Nevertheless, after this event the private has been upgraded ad nowadays its length is reviewed on a yearly basis).
The smart card payment system being still not widely accepted around the world, the ATM and payment devices accept magstripe as a fallback when the chip is unavailable or unreadable.
Next issue: by putting some tape on the the chip you can force an ATM to fall-back on the easily forgeable magstripe, allowing you to clone even a chip-enabled card without having to actually clone the chip itself.
Some banks reacted by restricting payment made by EMV enabled card to be chip-only, the EMVCo consortium also proposed to use a different CCV (a 3 number ID) on the the chip and on the magstripe in order to prevent to build a valid magstripe from data read from the chip (called iCCV, I do not know if this is widespread, the video linked above showing someone forging a magstripe using data collected via NFC make me doubtfull about this...).
The protocol involving the chip, the payment/ATM device and the bank is very complex, too complex according some people. The communication between the card and the device is not fully secured (some steps involve no cryptography, signature, etc.), this includes several backward and international compatibility features and some other features allowing the transaction to proceed even in case of technical issues. Moreover, the different steps composing the transaction are not tight together.
All this complexity make any flaw hardly fixable, while opening the door to a wide range of attacks, including the following Man-In-The-Middle (MiTM) attack.
Instead of a simple piece of tape as seen before, the attacker will now put a specially crafted second chip over the genuine one which will take in charge all of the MiTM process. It could for instance:
The standard complexity also encourages for weak implementation.
Cambridge University researchers have shown that several ATM use a weak pseudo-random number generator. While the card contains a secret encryption key which cannot be discovered, malicious payment devices could trick a card into producing several signed messages by advance which will then be used against such weak ATM, effectively making resulting malicious "clone" cards act as the genuine one from the ATM point-of-view.
This attack has been described in 2012, since then it is said that weak ATM's have been upgraded and fixed. However, by the end of 2014 newspapers still seem to describe attacks looking strangely close to this one. Funnily enough, this article mentions a bank which detected the attack because some EMV payment have been processed for magstripe-only cards.
At last, I cannot without mentioning other situation where card number obtained by cloning devices can also be useful:
As a side note, the worse in all this is that several of the above mentioned attacks, producing a transaction labelled as EMV (no matter if a physical card has been used or not) makes most often the consumer directly responsible of the financial consequences. Most banks indeed only covers frauds as-long-as the PIN code has not been used. As-soon-as the transaction appear as EMV on their logs, upon the wrong assumption that smart card security is unbreakable, they often blindly consider that the PIN code has been used and that the consumer is responsible by negligence.
Speaking from a UK standpoint (which I've got a fair amount of experience with- done this on TV recently- legally) there's a few points to note. Let's break the card itself down first into sections-
Chips
The chip cannot be copied or cloned without substantial resources and engineering. It's not impossible, just it'd be quicker to mug you and steal the actual card. These chips are common (actually issued by default) in the UK for several years.
Magstripe
The cloning of the magstripe can be done easily and quickly with skimmers as we already know. These are available almost everywhere now and have obvious genuine usage alongside... Y'know... Cloning
Contactless chip (RFID)
Theoretically a replay type attack can be carried out on the target card and cloned to another card but this takes a fair amount of time (~2-5mins) to copy the card and has the potential of "bricking" it.
Since chip cloning is out, as is RFID cloning in this case, the potential damage that can occur from a magstripe clone depends on the transaction. Online purchases don't require a PIN but do usually require information that's not on the card (CVV/CSV/Billing address/password auth with your bank). Some websites will allow folks to order without checks but those places are fast going out of fashion. Similarly cash point ATMs inside a bank will reject (or swallow) your card since it doesn't have a chip.
However, those stand alone third party ATMs that can literally be "wheeled in" to any shop can be fooled into accepting the cloned card without the PIN. How does this work? In the UK, the PIN is stored in the chip itself- or at least a hashed version. When you insert your card, it reads the magstripe & chip, contacts your bank, waits for pin entry, checks that against the chip, then let's you withdraw money- if the issuing bank gives it the all clear.
The bypass comes into play here because of technology. Or lack of it. Because a 100% uptime internet connection between two points can't ever be guaranteed, there's inbuilt fallbacks for some of the third party ATMs that let it accept magstripe only transactions if an Internet connection cannot be established with the issuing bank. It just places it in a queue for processing later. This is usually a simple situation to create by literally pulling the Ethernet plug on the ATM (although props to anyone that goes to the bother of packet sniffing one of those things and somehow injecting packets/simple DNS fail)
The best part is any PIN will work since the PIN hash is unreadable. Some ATMs bypass this pin entry screen, some don't.
Also payment terminals shipped to vendors usually come with a default setting meaning that if the chip is detected as broken, it tries again 3 times until finally falling back to magstripe (which doesn't require PIN entry).
Your issuing bank can detect attempted withdrawals/balance queries and more so if you're in doubt, phone them and ask. They'll also be able to get date, time, location (maybe even security footage from the area) if it's used without your permission.
Recommendation- never give your card to anyone, ever and if you think it may have been compromised- immediately phone your issuer and tell them. Change your pin to something different with each card too (and cut out that damned contactless chip, that's nothing but bad news)
The common thing for card skimmers to do now is collate all the info into a database and sell it on as a package. The risks of using a cloned card, or even the data on a website, are too high. Much easier to sell on 100, 1,000, or 10,000 credit card details than it is to clone a single card, pray it works, find somewhere secluded, try it out, do some OpSec, ?????, profit.