Questions tagged [emv]

EMV (Europay, MasterCard and Visa) is a standard for credit cards, commonly referred to as "chip-and-PIN".

Filter by
Sorted by
Tagged with
0
votes
1answer
92 views

PCI-DSS scope: Using P2PE Compliant devices

We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
0
votes
0answers
120 views

EMV card secret key + PIN to generate HOTP key

The Open Authentication HOTP algorithm is considered very reliable when using a 160 bits long secret key. Suppose I have this idea to generate such a 160 bits long key without requiring any further ...
1
vote
1answer
93 views

EMV cards, is the PIN always stored also at the issuer secure server side?

Issuers of EMV card (or their specialised service providers) always securely store on their server (Hardware Security Modules) a copy of the secret keys which are hidden inside each individual EMV ...
0
votes
0answers
44 views

EMV card tools of the trade

I am interested in opinions about effective tools of the trade for developers needing to familiarize themselves, through hardware hands-on experience, with the internal details of a EMV smart card ...
2
votes
1answer
142 views

Are EMV terminals required to support offline PIN as well as online PIN in US market?

It is my understanding that in the US 100% of EMV transactions (contact and contactless) are expected to be performed online. If so, why would a payment gateway be requiring a US terminal to support ...
1
vote
1answer
2k views

Can someone clone emv chip card by knowing the magnetic stripe info? [duplicate]

Lets consider that someone skimmed the magnetic stripe of a credit/debit card which also has an emv chip. Can this info be translated and stored into an emv chip? And if this is possible, it is ...
1
vote
0answers
50 views

What (small) computer chips are able to run JCOP and are EMV compatible? [closed]

NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV. Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
0
votes
1answer
246 views

Is identification with NFC bank cards feasible?

Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards ...
1
vote
1answer
227 views

How could criminals use stolen EMV credit cards in 2011?

I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory ...
3
votes
3answers
1k views

What info this EMV chip “skimmer” was actually capturing?

Reading a security blog I found an article about an EMV skimmer designed to be inserted into the ATM's chip card slot. What info was this device actually capture? As far as I know there's definitely ...
1
vote
1answer
2k views

Cloning of EMV cards

I am trying to get information about cloning of EMV credit cards (chip cards). I have a good understanding of the cryptology behind it and know that it is impossible to clone it "from the outside" ...
0
votes
1answer
96 views

Why are card associations launching RFID enabled payment cards despite of their being unsecure?

You can use applications to get data from these cards. I got tracks data of my cards as well as card number and expiry from my debit card just by single tap of phone. A criminal can use that data and ...
11
votes
1answer
1k views

How does Square Reader comply with EMV pin entry requirements?

Square recently launched their Square Reader physical device. AS well as accepting NFC based payments (e.g. Contactless or Apple/Android Pay, it also accepts Chip and PIN authentication. However the ...
2
votes
1answer
1k views

Would an offline-authorized EMV transaction use offline PIN validation?

If an EMV payment terminal offers offline authorization (e.g. because connectivity is poor), will chip and PIN transactions be processed using offline PIN validation? It doesn't make sense to me for ...
1
vote
1answer
182 views

ATM skimming and magnetic strip cloning

How does a thief know whether an ATM is EMV enabled or not?
0
votes
2answers
531 views

ATM skimming and cloning

Is it possible for a skimmer to copy the magnetic strip of a smart card (smart card contains microchip and magnetic strip) and clone the card only using the magnetic strip and use that at an ATM to ...
4
votes
1answer
907 views

How to securely transfer DUKPT BDK between HSMs?

I'm trying to understand best practices and capabilities regarding the use of an HSM, e.g the Thales Payshield 9000. Specifically, I wish to securely transfer a BDK for DUKPT from one HSM to a second,...
1
vote
1answer
97 views

Should EMV data fields be encrypted?

Are there any EMV data fields considered to be sensitive data according to the PCI DSS standard?
4
votes
2answers
1k views

Does EMV protect against sniffing PAN data from untrusted network?

I have received conflicting information in regards to the security of PAN data on the wire. Can this be sniffed with properly configured EMV at an atm? To quote from the link below: http://www....
0
votes
1answer
169 views

Momentarily unencrypted Payment cards

Momentarily unencrypted Payment cards I read about the cyber-attacks related to the momentarily unencrypted payment processing data at the point of sales devices. Technically, how is it possible? ...
7
votes
3answers
2k views

Are RFID shielding sleeves/wallets necessary for payment cards?

I have seen advertised several times now products that claim to "protect" contactless payment cards (e.g. special sleeves, wallets). What exactly do these products protect against? Is it just ...
4
votes
2answers
644 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
1
vote
2answers
181 views

Comprimising or affecting card readers, billing systems, or POS terminals using a malicious card

Our company got a new card printer for employee IDs. It was a bit expensive and we had to undergo a background as it allowed us to print both mag strips and EMV chips. I don't understand enough about ...
0
votes
3answers
209 views

Why is using the chip in chip-cards required at manned points of sale?

Chip cards are more secure because they prevent cloning. Chip cards also have the magstripe for backward compatibility. In my recent experience at supermarkets in California, using the chip takes a ...
1
vote
3answers
5k views

EMV credit card cloning: PIN code known by a malicious person

Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code? If the PIN code is changed, can the cloned card still be used?
6
votes
3answers
2k views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
0
votes
0answers
112 views

If EMV can't be copied/cloned, how will companies like plastc do it? [duplicate]

It is widely spread that EMV chips can't be copied or cloned onto another card like the information on a magnet strip. How will companies like plastc (a rewritable card) do it? Any Ideas?
2
votes
0answers
616 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
3
votes
1answer
536 views

Using chip and pin credit card for authentication?

I'd like to use a chip and pin credit card for authentication, that is to register a card into a system and then use it to log in (for demo/entertainment purposes only so bulletproof security isn't ...
2
votes
2answers
633 views

Would chip-and-PIN have prevented the Target breach?

Would chip-and-PIN have prevented the Target breach? As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
2
votes
2answers
232 views

What's the point of EMV when only the card is needed to shop online? [duplicate]

In many countries, EMV is used to prevent credit and debit cards being cloned. But given that it's possible to perform online transactions using the details printed on the card, how does it add ...
3
votes
1answer
654 views

EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV

Ok I understand from my research that the Chip Card creates an AC Key(MasterKey+AccNumber) to communicate with the authorizing server securely (3DES key to have encrypted communication) but I don't ...
1
vote
3answers
898 views

What are the problems that Chip card technology solve? and what are the problems EMV solve? Are the separate things?

What are the problems that Chip card technology solve? and what are the problems EMV solve? I understand that EMV is a standard where as chip card is a technology, It's pretty hard to tell them ...
11
votes
3answers
20k views

Why EMV cards cannot be cloned?

It's frequently stated that EMV cards cannot be cloned. I'd like to know, specially with commodity smart card readers/ writers, why is this true? What specific data cannot be read using commodity ...
3
votes
1answer
955 views

Advantages of using a Digital Signature Scheme (DSS) with Appendix instead of DSS giving Message Recovery

I've been looking at the EMV draft specification (pdf) for using Eliptic Curve Cryptography in payment cards instead of the currently used RSA. One thing I've noticed is that they've moved from using ...