Hot answers tagged

8 votes
Accepted

Reading magnetic stripe on a credit/debit card with an EMV chip

The service code on the stripe data will notify you it is a chip capable card and you should use this to prompt for card insertion. US is using the first digit of 2 or 6 to signify a chip card. Magnet ...
Ian Link's user avatar
  • 196
6 votes

Why is using the chip in chip-cards required at manned points of sale?

Swipe cards aren't secure, even under human supervision. It takes only seconds to swipe a card and read all the data off the magnetic strip. Once you have that data, it's possible to write it to a ...
Simon B's user avatar
  • 904
5 votes
Accepted

Does EMV protect against sniffing PAN data from untrusted network?

Many people are surprised to learn that EMV doesn't encrypt the PAN. But really, once EMV is fully rolled out encrypting the PAN will become unnecessary, and would be leftover as a technical debt of ...
John Deters's user avatar
  • 34.1k
5 votes
Accepted

How does Square Reader comply with EMV pin entry requirements?

From what I have seen of the device, your description of the Square Reader and it's operation is spot on. The requirement for a pin pad to be tamper evident is however no longer required. The update ...
Joe's user avatar
  • 1,224
4 votes
Accepted

Are EMV terminals required to support offline PIN as well as online PIN in US market?

The short answer is international interoperability. Not all countries joined the EMV band-wagon at the same time, and hence different countries support different types CVMs. Many markets still only ...
keithRozario's user avatar
  • 3,691
4 votes
Accepted

What info this EMV chip "skimmer" was actually capturing?

The article itself addresses this: Banks can run a simple check to see if any card inserted into an ATM is a counterfeit magnetic stripe card that is encoded with data stolen from a chip card. But ...
Bobson's user avatar
  • 1,447
4 votes

Comprimising or affecting card readers, billing systems, or POS terminals using a malicious card

What I know about the POS products I resell/support, when taking a credit card for a payment there are set # of characters it's looking for. In a general sense it's looking for something like this: ...
N. Greene's user avatar
  • 341
4 votes

How do I know if a EMV is SDA, DDA or CDA?

This is not something that's determined by the account number (BIN or otherwise). Rather, it's determined by the bank that orders the cards and has the chip "personalized" with your account ...
Bobson's user avatar
  • 1,447
4 votes
Accepted

Guessing PIN code of smartcard using brute force and offline reader

EMV has PIN Try Counter. Failed offline PIN attempt decrements the counter and remains persistent across sessions. So even if you cancel the transaction after 2 failed attempts, it won't reset the ...
defalt's user avatar
  • 6,751
3 votes

Does EMV protect against sniffing PAN data from untrusted network?

The PAN is still as vulnerable to compromise in an EMV transaction as it was without EMV, if no additional security measures are taken. The cleartext, static PAN is still included in the transaction ...
Jin's user avatar
  • 116
3 votes

Are RFID shielding sleeves/wallets necessary for payment cards?

I'd like to say up front that everyone else who has posted here is essentially correct. I thought I would post a different perspective, as I am a user of RFID shielding technology. Every card in my ...
Hearth's user avatar
  • 365
3 votes
Accepted

Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones

The NFC relay attack is still unresolved. Most of the attacks discovered against contactless payments work on top of the relay attack. The identified security issues result from flawed implementation ...
defalt's user avatar
  • 6,751
3 votes
Accepted

Are there any transaction time constraints in EMV contact and contactless cards?

Contactless card uses the same chip and PIN module as in contact card. The difference between them is in the medium of communication with the terminal and in application selection. Contactless cards ...
defalt's user avatar
  • 6,751
2 votes

EMV as authentication technology and not a data security technology

1: Since EMV uses dynamic CVVs, a CVV of a recorded transaction is useless, since its spent. Thus they lack the complete info to create a (functioning) magnetic stripe card. However, doing a fake ...
sebastian nielsen's user avatar
2 votes

Are RFID shielding sleeves/wallets necessary for payment cards?

You have good reason to be confused about what "threats" these products are actually targeted at protecting against: not one commercial that I've seen for these items actually provides clear, ...
mostlyinformed's user avatar
2 votes
Accepted

Are RFID shielding sleeves/wallets necessary for payment cards?

Deciding whether a security measure is worthwhile means you need to balance the cost of the measure against the benefit of using it. In this case cost, other than a bit of money to buy the sleeves, is ...
GdD's user avatar
  • 17.4k
2 votes
Accepted

Would an offline-authorized EMV transaction use offline PIN validation?

Generally true. It depends of Cardholder Verification Method (CVM) List of terminal and card. Offline pin would perform if both support offline pin and if it has highest priority in CVM lists.
Alexander Vgn's user avatar
2 votes
Accepted

How to securely transfer DUKPT BDK between HSMs?

Spoke to a sales rep of Thales distributor. Generate a Zone Master Key (ZMK), which is a KEK. Distribute that to the destination party, in multiple components, via different media. Load that ZMK ...
Nik's user avatar
  • 171
2 votes

Cloning of EMV cards

Cost efficiency There are known methods that would work to extract data from EMV cards, namely, decapping the chip and analyzing its contents with various microscopy and probing techniques; just as ...
Peteris's user avatar
  • 8,419
2 votes
Accepted

EMV Transactions vs Magnetic Stripe

EMV has no effect on the rules for capture amounts. It's only an authorization-time feature. There are things you can do with swipe cards that you can't with a chip, but your specific example isn't ...
Bobson's user avatar
  • 1,447
2 votes

PIN transfer between payment schemes

The PIN does not depend on the card number or to the type of card but is an independent property. In fact, many providers let you choose your own PIN and also let you change an existing PIN.
Steffen Ullrich's user avatar
2 votes
Accepted

Are wedge attacks on EMV cards still viable?

Wedge attack was applicable on DDA cards (Dynamic Data Authentication) which were being superseded by CDA cards (Combined Data Authentication) at the time when vulnerability was disclosed. The ...
defalt's user avatar
  • 6,751
2 votes

Is it possible to use a magnetic striped card with no emv chip to clone a credit or debit card with EMV chip inserted

Hopefully someone can provide a more authoritative answer, but I developed a point of sale application years ago and I seem to remember there is one tag which provides the track 2 equivalent data: EMV ...
Kate's user avatar
  • 7,847
1 vote
Accepted

EMV cards, is the PIN always stored also at the issuer secure server side?

There’s 3 types of cardholder verification methods (at least when I was playing with EMV 3 years back) PIN (both offline and online) Signature No verification (this is possible under some ...
keithRozario's user avatar
  • 3,691
1 vote

Can someone clone emv chip card by knowing the magnetic stripe info?

EMV chips can be cloned, but not with only the information present on the mag stripe. EMVs function as a challenge-response system, meaning an EMV authorization is transactionary between the ATM/POS ...
Khang T's user avatar
  • 36
1 vote

Is identification with NFC bank cards feasible?

The only thing available to you via a contactless bank card is an ID number (of the card). To get more, you have to follow the appropriate guidelines and security of the contactless cards. This means ...
Julian Knight's user avatar
1 vote
Accepted

How could criminals use stolen EMV credit cards in 2011?

One of the features of EMV is that a transaction can be approved offline by the chip, if neither the chip nor the terminal flags it to go online. The terminal simply stores the chip's response, and ...
Bobson's user avatar
  • 1,447
1 vote

Why are card associations launching RFID enabled payment cards despite of their being unsecure?

Many people use cars on a daily basis, even with the number of deaths on roads worldwide. So why would everyday people want to use them? The reason why I ask that question at the start is because it ...
dark_st3alth's user avatar
  • 3,032
1 vote

How do I know if a EMV is SDA, DDA or CDA?

Use https://github.com/L1L1/cardpeek/commits/master Cardpeek, it can read VISA or mastercard and then there will be flags what of the SDA, DDA or CDA are supported on this EVM chip. There will be also ...
Валерий Заподовников's user avatar
1 vote

ATM skimming and magnetic strip cloning

So, here in Europe, ATMs have been Pin&Chipped for at least since the mid 90's. So there's no question. Other than that: Just insert a credit card (stolen, yours) and try to get money? Stand ...
Marcus Müller's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible