Questions tagged [emv]
EMV (Europay, MasterCard and Visa) is a standard for credit cards, commonly referred to as "chip-and-PIN".
48
questions
7
votes
4
answers
3k
views
Reading magnetic stripe on a credit/debit card with an EMV chip
Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
1
vote
1
answer
551
views
Are wedge attacks on EMV cards still viable?
I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution?
The latest literature or ...
- 6,751
0
votes
2
answers
1k
views
ATM skimming and cloning
Is it possible for a skimmer to copy the magnetic strip of a smart card (smart card contains microchip and magnetic strip) and clone the card only using the magnetic strip and use that at an ATM to ...
2
votes
1
answer
1k
views
How does debit/credit card shimming work?
Correct me if I'm wrong, but before EMV cards were introduced in the U.S., thieves would use card skimmers on ATMs and point-of-sale (POS) terminals (such as gas pumps) to steal the CVV1, which would ...
- 6,751
0
votes
1
answer
1k
views
Is it possible to use a magnetic striped card with no emv chip to clone a credit or debit card with EMV chip inserted
If a credit card or debit card has a emv chip can it be successfully cloned onto a credit or debit card that does not possess a emv chip
If so how does that work and will the ATM accept it
CommunityBot
- 1
0
votes
0
answers
4k
views
Clone a credit card [duplicate]
I wanted to ask if it's possible to clone your own credit card (clone the emv chip) and copy it onto another emv chip with an emv reader/writer.
Shouldn't this be easily possible without extracting ...
- 128k
2
votes
3
answers
9k
views
How do I know if a EMV is SDA, DDA or CDA?
For chip cards (emv), how do I know, based on either BIN (first six digits of card numbers) or on the entire card number, if a card is SDA, DDA or CDA?
I know what it means, but without using a POS or ...
- 128k
1
vote
1
answer
237
views
EMV choose crypto method between SDA/DDA/CDA
I'm a newbie in emv world.
I'm trying to follow this flow:
I'm in the third step. I have to manage the Offline Data Authentication.
How can I negotiate the correct way (SDA, DDA or CDA) with the ICC ...
CommunityBot
- 1
0
votes
2
answers
235
views
Can ISO 7816 (EMV) based smart card handle interrupts?
ISO 7816 smartcards are typically used in EMV transactions. I know that the card can perform arbitrary actions before sending a response to the terminal in a typical EMV transaction (e.g. signing ...
- 159
3
votes
1
answer
411
views
Are there any transaction time constraints in EMV contact and contactless cards?
I am looking into EMV Contact and Contactless protocols, but I felt there were a few ambiguities which I would appreciate help with:
Is the chip used in EMV Contactless capable of performing the same ...
- 6,751
4
votes
1
answer
2k
views
How to securely transfer DUKPT BDK between HSMs?
I'm trying to understand best practices and capabilities regarding the use of an HSM, e.g the Thales Payshield 9000.
Specifically, I wish to securely transfer a BDK for DUKPT from one HSM to a second,...
1
vote
1
answer
1k
views
Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones
The title is pretty self explanatory. The market is pretty secretive about these kinds of matter since companies won't give out vulnerabilities for attackers to abuse and will give out vulnerabilities ...
- 6,751
4
votes
1
answer
2k
views
Guessing PIN code of smartcard using brute force and offline reader
I came across this question Offline brute-forcing of a bank card PIN, which was asked 7 years ago. I'm currently exploring vulnerabilities in EMV protocol, and I wanted to double check if an idea I ...
- 6,751
2
votes
1
answer
2k
views
Manually sending PIN Change/Unblock Command to IC card
In the EMV documentation (EMV Book 3 Section 6.5.10), the PIN Change/Unblock command provides the option to change or unblock a card's PIN, and also handles resetting the PIN Try Counter (EMV tag ...
- 6,751
1
vote
1
answer
942
views
Does having 2 or more RFID-enabled cards in a wallet prevent all attacks?
I've heard about RFID-shielding wallets and even individual card sleeves, but my wallet has multiple RFID cards in it (credit card, bus card, building entry card), and if I tap my whole wallet on a ...
0
votes
1
answer
84
views
PIN transfer between payment schemes
I am wondering, if it should be possible to transfer PIN in case of migrating between different payment schemes like Mastercard or VISA.
For example, when I have a card issued by Mastercard, and it ...
- 198k
1
vote
2
answers
225
views
EMV Transactions vs Magnetic Stripe [closed]
In Mag stripe transactions, I've worked on solutions by which you get an initial small value Authorization and then can capture a full amount later using the transaction_id. E.g. The payment gateways ...
CommunityBot
- 1
2
votes
2
answers
1k
views
Are EMV terminals required to support offline PIN as well as online PIN in US market?
It is my understanding that in the US 100% of EMV transactions (contact and contactless) are expected to be performed online. If so, why would a payment gateway be requiring a US terminal to support ...
- 1
0
votes
1
answer
203
views
PCI-DSS scope: Using P2PE Compliant devices
We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
- 3,159
0
votes
0
answers
379
views
EMV card secret key + PIN to generate HOTP key
The Open Authentication HOTP algorithm is considered very reliable when using a 160 bits long secret key. Suppose I have this idea to generate such a 160 bits long key without requiring any further ...
- 113
1
vote
1
answer
313
views
EMV cards, is the PIN always stored also at the issuer secure server side?
Issuers of EMV card (or their specialised service providers) always securely store on their server (Hardware Security Modules) a copy of the secret keys which are hidden inside each individual EMV ...
- 3,691
1
vote
1
answer
4k
views
Cloning of EMV cards
I am trying to get information about cloning of EMV credit cards (chip cards). I have a good understanding of the cryptology behind it and know that it is impossible to clone it "from the outside" ...
3
votes
1
answer
7k
views
Can someone clone emv chip card by knowing the magnetic stripe info? [duplicate]
Lets consider that someone skimmed the magnetic stripe of a credit/debit card which also has an emv chip.
Can this info be translated and stored into an emv chip?
And if this is possible, it is ...
- 36
1
vote
0
answers
137
views
What (small) computer chips are able to run JCOP and are EMV compatible? [closed]
NXP Semiconductors has the Smartmx2 P60 that is able to run JCOP3 and is compatible with EMV.
Now I wonder where one can find other tiny chips that are capable of the same thing but perhaps a bit ...
- 128k
2
votes
1
answer
2k
views
Would an offline-authorized EMV transaction use offline PIN validation?
If an EMV payment terminal offers offline authorization (e.g. because connectivity is poor), will chip and PIN transactions be processed using offline PIN validation?
It doesn't make sense to me for ...
3
votes
3
answers
2k
views
What info this EMV chip "skimmer" was actually capturing?
Reading a security blog I found an article about an EMV skimmer designed to be inserted into the ATM's chip card slot.
What info was this device actually capture? As far as I know there's definitely ...
CommunityBot
- 1
0
votes
1
answer
503
views
Is identification with NFC bank cards feasible?
Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards ...
- 1
1
vote
1
answer
439
views
How could criminals use stolen EMV credit cards in 2011?
I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory ...
CommunityBot
- 1
1
vote
3
answers
8k
views
EMV credit card cloning: PIN code known by a malicious person
Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code?
If the PIN code is changed, can the cloned card still be used?
- 19.2k
12
votes
1
answer
2k
views
How does Square Reader comply with EMV pin entry requirements?
Square recently launched their Square Reader physical device. AS well as accepting NFC based payments (e.g. Contactless or Apple/Android Pay, it also accepts Chip and PIN authentication.
However the ...
- 1,224
0
votes
1
answer
170
views
Why are card associations launching RFID enabled payment cards despite of their being unsecure?
You can use applications to get data from these cards. I got tracks data of my cards as well as card number and expiry from my debit card just by single tap of phone. A criminal can use that data and ...
- 3,032
1
vote
1
answer
279
views
ATM skimming and magnetic strip cloning
How does a thief know whether an ATM is EMV enabled or not?
- 5,928
1
vote
1
answer
167
views
Should EMV data fields be encrypted?
Are there any EMV data fields considered to be sensitive data according to the PCI DSS standard?
- 11
1
vote
2
answers
420
views
Comprimising or affecting card readers, billing systems, or POS terminals using a malicious card
Our company got a new card printer for employee IDs. It was a bit expensive and we had to undergo a background as it allowed us to print both mag strips and EMV chips. I don't understand enough about ...
- 65.4k
5
votes
2
answers
2k
views
Does EMV protect against sniffing PAN data from untrusted network?
I have received conflicting information in regards to the security of PAN data on the wire. Can this be sniffed with properly configured EMV at an atm?
To quote from the link below:
http://www....
- 34.1k
0
votes
1
answer
271
views
Momentarily unencrypted Payment cards
Momentarily unencrypted Payment cards
I read about the cyber-attacks related to the momentarily unencrypted payment processing data at the point of sales devices. Technically, how is it possible?
...
CommunityBot
- 1
4
votes
2
answers
983
views
EMV as authentication technology and not a data security technology
I'm trying to wrap my head around what I view as EMV chip card security loopholes.
Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
- 4,213
7
votes
3
answers
2k
views
Are RFID shielding sleeves/wallets necessary for payment cards?
I have seen advertised several times now products that claim to "protect" contactless payment cards (e.g. special sleeves, wallets).
What exactly do these products protect against?
Is it just ...
CommunityBot
- 1
0
votes
3
answers
288
views
Why is using the chip in chip-cards required at manned points of sale?
Chip cards are more secure because they prevent cloning. Chip cards also have the magstripe for backward compatibility. In my recent experience at supermarkets in California, using the chip takes a ...
CommunityBot
- 1
3
votes
1
answer
754
views
Using chip and pin credit card for authentication?
I'd like to use a chip and pin credit card for authentication, that is to register a card into a system and then use it to log in (for demo/entertainment purposes only so bulletproof security isn't ...
- 58.8k
0
votes
0
answers
131
views
If EMV can't be copied/cloned, how will companies like plastc do it? [duplicate]
It is widely spread that EMV chips can't be copied or cloned onto another card like the information on a magnet strip.
How will companies like plastc (a rewritable card) do it?
Any Ideas?
2
votes
2
answers
786
views
Would chip-and-PIN have prevented the Target breach?
Would chip-and-PIN have prevented the Target breach?
As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
- 41
2
votes
0
answers
901
views
Which keys does a bank typically exchange with a card scheme?
I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard.
I understand the bank would typically ...
- 1,647
15
votes
3
answers
26k
views
Why EMV cards cannot be cloned?
It's frequently stated that EMV cards cannot be cloned. I'd like to know, specially with commodity smart card readers/ writers, why is this true? What specific data cannot be read using commodity ...
CommunityBot
- 1
3
votes
1
answer
878
views
EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV
Ok I understand from my research that the Chip Card creates an AC Key(MasterKey+AccNumber) to communicate with the authorizing server securely (3DES key to have encrypted communication) but I don't ...
- 103
2
votes
2
answers
282
views
What's the point of EMV when only the card is needed to shop online? [duplicate]
In many countries, EMV is used to prevent credit and debit cards being cloned. But given that it's possible to perform online transactions using the details printed on the card, how does it add ...
- 4,213
2
votes
3
answers
1k
views
What are the problems that Chip card technology solve? and what are the problems EMV solve? Are the separate things?
What are the problems that Chip card technology solve? and what are the problems EMV solve?
I understand that EMV is a standard where as chip card is a technology, It's pretty hard to tell them ...
- 357
3
votes
1
answer
1k
views
Advantages of using a Digital Signature Scheme (DSS) with Appendix instead of DSS giving Message Recovery
I've been looking at the EMV draft specification (pdf) for using Eliptic Curve Cryptography in payment cards instead of the currently used RSA. One thing I've noticed is that they've moved from using ...
- 325k