Questions tagged [emv]

EMV (Europay, MasterCard and Visa) is a standard for credit cards, commonly referred to as "chip-and-PIN".

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

Rotate or replace EMV keys?

I would like to better understand the mechanism of rotation of EMV keys used for payment cards. Assuming that it intends to provide a rotation of the keys used for the production cards: just recycle ...
MaXbeMan's user avatar
0 votes
0 answers
4k views

Clone a credit card [duplicate]

I wanted to ask if it's possible to clone your own credit card (clone the emv chip) and copy it onto another emv chip with an emv reader/writer. Shouldn't this be easily possible without extracting ...
Ethan Brown's user avatar
0 votes
1 answer
1k views

Is it possible to use a magnetic striped card with no emv chip to clone a credit or debit card with EMV chip inserted

If a credit card or debit card has a emv chip can it be successfully cloned onto a credit or debit card that does not possess a emv chip If so how does that work and will the ATM accept it
Draco60's user avatar
1 vote
1 answer
262 views

EMV choose crypto method between SDA/DDA/CDA

I'm a newbie in emv world. I'm trying to follow this flow: I'm in the third step. I have to manage the Offline Data Authentication. How can I negotiate the correct way (SDA, DDA or CDA) with the ICC ...
Piero Alberto's user avatar
0 votes
2 answers
250 views

Can ISO 7816 (EMV) based smart card handle interrupts?

ISO 7816 smartcards are typically used in EMV transactions. I know that the card can perform arbitrary actions before sending a response to the terminal in a typical EMV transaction (e.g. signing ...
OrangeJusticeV's user avatar
3 votes
1 answer
471 views

Are there any transaction time constraints in EMV contact and contactless cards?

I am looking into EMV Contact and Contactless protocols, but I felt there were a few ambiguities which I would appreciate help with: Is the chip used in EMV Contactless capable of performing the same ...
OrangeJusticeV's user avatar
1 vote
1 answer
1k views

Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones

The title is pretty self explanatory. The market is pretty secretive about these kinds of matter since companies won't give out vulnerabilities for attackers to abuse and will give out vulnerabilities ...
warpeace's user avatar
2 votes
1 answer
2k views

Manually sending PIN Change/Unblock Command to IC card

In the EMV documentation (EMV Book 3 Section 6.5.10), the PIN Change/Unblock command provides the option to change or unblock a card's PIN, and also handles resetting the PIN Try Counter (EMV tag ...
OrangeJusticeV's user avatar
4 votes
1 answer
2k views

Guessing PIN code of smartcard using brute force and offline reader

I came across this question Offline brute-forcing of a bank card PIN, which was asked 7 years ago. I'm currently exploring vulnerabilities in EMV protocol, and I wanted to double check if an idea I ...
OrangeJusticeV's user avatar
1 vote
1 answer
595 views

Are wedge attacks on EMV cards still viable?

I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution? The latest literature or ...
warpeace's user avatar
2 votes
1 answer
1k views

How does debit/credit card shimming work?

Correct me if I'm wrong, but before EMV cards were introduced in the U.S., thieves would use card skimmers on ATMs and point-of-sale (POS) terminals (such as gas pumps) to steal the CVV1, which would ...
jojo5389's user avatar
1 vote
1 answer
1k views

Does having 2 or more RFID-enabled cards in a wallet prevent all attacks?

I've heard about RFID-shielding wallets and even individual card sleeves, but my wallet has multiple RFID cards in it (credit card, bus card, building entry card), and if I tap my whole wallet on a ...
user avatar
0 votes
1 answer
93 views

PIN transfer between payment schemes

I am wondering, if it should be possible to transfer PIN in case of migrating between different payment schemes like Mastercard or VISA. For example, when I have a card issued by Mastercard, and it ...
user1563721's user avatar
  • 1,119
1 vote
2 answers
243 views

EMV Transactions vs Magnetic Stripe [closed]

In Mag stripe transactions, I've worked on solutions by which you get an initial small value Authorization and then can capture a full amount later using the transaction_id. E.g. The payment gateways ...
wmitchell's user avatar
  • 113
0 votes
1 answer
220 views

PCI-DSS scope: Using P2PE Compliant devices

We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
Kane's user avatar
  • 61
0 votes
0 answers
396 views

EMV card secret key + PIN to generate HOTP key

The Open Authentication HOTP algorithm is considered very reliable when using a 160 bits long secret key. Suppose I have this idea to generate such a 160 bits long key without requiring any further ...
Luca's user avatar
  • 113
1 vote
1 answer
357 views

EMV cards, is the PIN always stored also at the issuer secure server side?

Issuers of EMV card (or their specialised service providers) always securely store on their server (Hardware Security Modules) a copy of the secret keys which are hidden inside each individual EMV ...
Luca's user avatar
  • 113
2 votes
2 answers
1k views

Are EMV terminals required to support offline PIN as well as online PIN in US market?

It is my understanding that in the US 100% of EMV transactions (contact and contactless) are expected to be performed online. If so, why would a payment gateway be requiring a US terminal to support ...
mfarver's user avatar
  • 123
3 votes
1 answer
7k views

Can someone clone emv chip card by knowing the magnetic stripe info? [duplicate]

Lets consider that someone skimmed the magnetic stripe of a credit/debit card which also has an emv chip. Can this info be translated and stored into an emv chip? And if this is possible, it is ...
Nikos Tsirakakis's user avatar
1 vote
0 answers
148 views

What (small) computer chips are able to run JCOP and are EMV compatible? [closed]

NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV. Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
Rauf Akdemir's user avatar
0 votes
1 answer
516 views

Is identification with NFC bank cards feasible?

Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards ...
Bozho's user avatar
  • 1,223
1 vote
1 answer
460 views

How could criminals use stolen EMV credit cards in 2011?

I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
3 votes
3 answers
3k views

What info this EMV chip "skimmer" was actually capturing?

Reading a security blog I found an article about an EMV skimmer designed to be inserted into the ATM's chip card slot. What info was this device actually capture? As far as I know there's definitely ...
André Borie's user avatar
  • 12.8k
1 vote
1 answer
4k views

Cloning of EMV cards

I am trying to get information about cloning of EMV credit cards (chip cards). I have a good understanding of the cryptology behind it and know that it is impossible to clone it "from the outside" ...
Lindell's user avatar
  • 111
0 votes
1 answer
182 views

Why are card associations launching RFID enabled payment cards despite of their being unsecure?

You can use applications to get data from these cards. I got tracks data of my cards as well as card number and expiry from my debit card just by single tap of phone. A criminal can use that data and ...
user avatar
12 votes
1 answer
2k views

How does Square Reader comply with EMV pin entry requirements?

Square recently launched their Square Reader physical device. AS well as accepting NFC based payments (e.g. Contactless or Apple/Android Pay, it also accepts Chip and PIN authentication. However the ...
Megan Walker's user avatar
2 votes
1 answer
2k views

Would an offline-authorized EMV transaction use offline PIN validation?

If an EMV payment terminal offers offline authorization (e.g. because connectivity is poor), will chip and PIN transactions be processed using offline PIN validation? It doesn't make sense to me for ...
Duncan Jones's user avatar
  • 1,647
1 vote
1 answer
290 views

ATM skimming and magnetic strip cloning

How does a thief know whether an ATM is EMV enabled or not?
wayne's user avatar
  • 11
0 votes
2 answers
1k views

ATM skimming and cloning

Is it possible for a skimmer to copy the magnetic strip of a smart card (smart card contains microchip and magnetic strip) and clone the card only using the magnetic strip and use that at an ATM to ...
wayne's user avatar
  • 11
4 votes
1 answer
2k views

How to securely transfer DUKPT BDK between HSMs?

I'm trying to understand best practices and capabilities regarding the use of an HSM, e.g the Thales Payshield 9000. Specifically, I wish to securely transfer a BDK for DUKPT from one HSM to a second,...
Nik's user avatar
  • 171
2 votes
3 answers
9k views

How do I know if a EMV is SDA, DDA or CDA?

For chip cards (emv), how do I know, based on either BIN (first six digits of card numbers) or on the entire card number, if a card is SDA, DDA or CDA? I know what it means, but without using a POS or ...
Eston's user avatar
  • 21
1 vote
1 answer
179 views

Should EMV data fields be encrypted?

Are there any EMV data fields considered to be sensitive data according to the PCI DSS standard?
bbozo's user avatar
  • 511
5 votes
2 answers
2k views

Does EMV protect against sniffing PAN data from untrusted network?

I have received conflicting information in regards to the security of PAN data on the wire. Can this be sniffed with properly configured EMV at an atm? To quote from the link below: http://www....
Tyler's user avatar
  • 53
0 votes
1 answer
280 views

Momentarily unencrypted Payment cards

Momentarily unencrypted Payment cards I read about the cyber-attacks related to the momentarily unencrypted payment processing data at the point of sales devices. Technically, how is it possible? ...
max's user avatar
  • 141
7 votes
3 answers
2k views

Are RFID shielding sleeves/wallets necessary for payment cards?

I have seen advertised several times now products that claim to "protect" contactless payment cards (e.g. special sleeves, wallets). What exactly do these products protect against? Is it just ...
JonnyWizz's user avatar
  • 1,961
4 votes
2 answers
1k views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
Zach Nichols's user avatar
1 vote
2 answers
446 views

Comprimising or affecting card readers, billing systems, or POS terminals using a malicious card

Our company got a new card printer for employee IDs. It was a bit expensive and we had to undergo a background as it allowed us to print both mag strips and EMV chips. I don't understand enough about ...
Bacon Brad's user avatar
  • 3,382
0 votes
3 answers
310 views

Why is using the chip in chip-cards required at manned points of sale?

Chip cards are more secure because they prevent cloning. Chip cards also have the magstripe for backward compatibility. In my recent experience at supermarkets in California, using the chip takes a ...
Dan Dascalescu's user avatar
1 vote
3 answers
8k views

EMV credit card cloning: PIN code known by a malicious person

Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code? If the PIN code is changed, can the cloned card still be used?
Razmar's user avatar
  • 11
7 votes
4 answers
3k views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
Emilio's user avatar
  • 73
0 votes
0 answers
132 views

If EMV can't be copied/cloned, how will companies like plastc do it? [duplicate]

It is widely spread that EMV chips can't be copied or cloned onto another card like the information on a magnet strip. How will companies like plastc (a rewritable card) do it? Any Ideas?
user73019's user avatar
2 votes
0 answers
939 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
Duncan Jones's user avatar
  • 1,647
3 votes
1 answer
773 views

Using chip and pin credit card for authentication?

I'd like to use a chip and pin credit card for authentication, that is to register a card into a system and then use it to log in (for demo/entertainment purposes only so bulletproof security isn't ...
user avatar
2 votes
2 answers
796 views

Would chip-and-PIN have prevented the Target breach?

Would chip-and-PIN have prevented the Target breach? As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
D.W.'s user avatar
  • 99.5k
2 votes
2 answers
289 views

What's the point of EMV when only the card is needed to shop online? [duplicate]

In many countries, EMV is used to prevent credit and debit cards being cloned. But given that it's possible to perform online transactions using the details printed on the card, how does it add ...
Gelatin's user avatar
  • 194
3 votes
1 answer
889 views

EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV

Ok I understand from my research that the Chip Card creates an AC Key(MasterKey+AccNumber) to communicate with the authorizing server securely (3DES key to have encrypted communication) but I don't ...
Brandon Seet's user avatar
2 votes
3 answers
1k views

What are the problems that Chip card technology solve? and what are the problems EMV solve? Are the separate things?

What are the problems that Chip card technology solve? and what are the problems EMV solve? I understand that EMV is a standard where as chip card is a technology, It's pretty hard to tell them ...
Brandon Seet's user avatar
15 votes
3 answers
27k views

Why EMV cards cannot be cloned?

It's frequently stated that EMV cards cannot be cloned. I'd like to know, specially with commodity smart card readers/ writers, why is this true? What specific data cannot be read using commodity ...
Jaywalker's user avatar
  • 261
3 votes
1 answer
1k views

Advantages of using a Digital Signature Scheme (DSS) with Appendix instead of DSS giving Message Recovery

I've been looking at the EMV draft specification (pdf) for using Eliptic Curve Cryptography in payment cards instead of the currently used RSA. One thing I've noticed is that they've moved from using ...
Peanut's user avatar
  • 1,039