Skip to main content
5 votes
Accepted

How does Square Reader comply with EMV pin entry requirements?

From what I have seen of the device, your description of the Square Reader and it's operation is spot on. The requirement for a pin pad to be tamper evident is however no longer required. The update ...
Joe's user avatar
  • 1,224
4 votes
Accepted

Are EMV terminals required to support offline PIN as well as online PIN in US market?

The short answer is international interoperability. Not all countries joined the EMV band-wagon at the same time, and hence different countries support different types CVMs. Many markets still only ...
keithRozario's user avatar
  • 3,711
4 votes
Accepted

What info this EMV chip "skimmer" was actually capturing?

The article itself addresses this: Banks can run a simple check to see if any card inserted into an ATM is a counterfeit magnetic stripe card that is encoded with data stolen from a chip card. But ...
Bobson's user avatar
  • 1,485
4 votes

How do I know if a EMV is SDA, DDA or CDA?

This is not something that's determined by the account number (BIN or otherwise). Rather, it's determined by the bank that orders the cards and has the chip "personalized" with your account ...
Bobson's user avatar
  • 1,485
4 votes
Accepted

Guessing PIN code of smartcard using brute force and offline reader

EMV has PIN Try Counter. Failed offline PIN attempt decrements the counter and remains persistent across sessions. So even if you cancel the transaction after 2 failed attempts, it won't reset the ...
defalt's user avatar
  • 6,911
3 votes
Accepted

Are there any transaction time constraints in EMV contact and contactless cards?

Contactless card uses the same chip and PIN module as in contact card. The difference between them is in the medium of communication with the terminal and in application selection. Contactless cards ...
defalt's user avatar
  • 6,911
3 votes
Accepted

Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones

The NFC relay attack is still unresolved. Most of the attacks discovered against contactless payments work on top of the relay attack. The identified security issues result from flawed implementation ...
defalt's user avatar
  • 6,911
2 votes
Accepted

How to securely transfer DUKPT BDK between HSMs?

Spoke to a sales rep of Thales distributor. Generate a Zone Master Key (ZMK), which is a KEK. Distribute that to the destination party, in multiple components, via different media. Load that ZMK ...
Nik's user avatar
  • 171
2 votes
Accepted

Would an offline-authorized EMV transaction use offline PIN validation?

Generally true. It depends of Cardholder Verification Method (CVM) List of terminal and card. Offline pin would perform if both support offline pin and if it has highest priority in CVM lists.
Alexander Vgn's user avatar
2 votes

Cloning of EMV cards

Cost efficiency There are known methods that would work to extract data from EMV cards, namely, decapping the chip and analyzing its contents with various microscopy and probing techniques; just as ...
Peteris's user avatar
  • 8,429
2 votes
Accepted

EMV Transactions vs Magnetic Stripe

EMV has no effect on the rules for capture amounts. It's only an authorization-time feature. There are things you can do with swipe cards that you can't with a chip, but your specific example isn't ...
Bobson's user avatar
  • 1,485
2 votes

PIN transfer between payment schemes

The PIN does not depend on the card number or to the type of card but is an independent property. In fact, many providers let you choose your own PIN and also let you change an existing PIN.
Steffen Ullrich's user avatar
2 votes
Accepted

Are wedge attacks on EMV cards still viable?

Wedge attack was applicable on DDA cards (Dynamic Data Authentication) which were being superseded by CDA cards (Combined Data Authentication) at the time when vulnerability was disclosed. The ...
defalt's user avatar
  • 6,911
2 votes

Is it possible to use a magnetic striped card with no emv chip to clone a credit or debit card with EMV chip inserted

Hopefully someone can provide a more authoritative answer, but I developed a point of sale application years ago and I seem to remember there is one tag which provides the track 2 equivalent data: EMV ...
Kate's user avatar
  • 8,435
1 vote

EMV choose crypto method between SDA/DDA/CDA

I got it. You have to the AIP field as follows: To retrieve the AIP, according to "EMV Book 3 - Application Specification", use te Tag 0x80 Format 1 reply for GET PROCESSING OPTIONS ...
Piero Alberto's user avatar
1 vote
Accepted

Can ISO 7816 (EMV) based smart card handle interrupts?

Contact card can. Contact card can even tell terminal to wait and call it again after some seconds and then it can do this indefinitely (21:01). EMV Book 1, 9.2.2.3.1 Procedure Byte The procedure ...
defalt's user avatar
  • 6,911
1 vote
Accepted

Manually sending PIN Change/Unblock Command to IC card

PIN CHANGE/UNBLOCK is the post-issuance command that can only be sent using issuer script. Issuer encrypts issuer script by the session key derived from "Script encryption key". The MAC is ...
defalt's user avatar
  • 6,911
1 vote

How does debit/credit card shimming work?

In this whitepaper "It Only Takes A Minute to Clone a Credit Card, Thanks to a 50-Year-Old Problem" (pdf), Researchers created magstripe versions from EMV and contactless cards by exploiting ...
defalt's user avatar
  • 6,911
1 vote

EMV Transactions vs Magnetic Stripe

Tampering with the amount is not possible with EMV card. With MagStripe card, the transaction is authorised online by the Issuer. In EMV, transaction authorisation is done by the Integrated Circuit ...
defalt's user avatar
  • 6,911
1 vote

PCI-DSS scope: Using P2PE Compliant devices

I'd suggest putting in a logic control (rather than just the current physical tamper control) to verify no clear text cardholder data is ever received by the connected system environment. If such data ...
AndyMac's user avatar
  • 3,169
1 vote
Accepted

EMV cards, is the PIN always stored also at the issuer secure server side?

There’s 3 types of cardholder verification methods (at least when I was playing with EMV 3 years back) PIN (both offline and online) Signature No verification (this is possible under some ...
keithRozario's user avatar
  • 3,711
1 vote

Why are card associations launching RFID enabled payment cards despite of their being unsecure?

Many people use cars on a daily basis, even with the number of deaths on roads worldwide. So why would everyday people want to use them? The reason why I ask that question at the start is because it ...
dark_st3alth's user avatar
  • 3,022
1 vote

Can someone clone emv chip card by knowing the magnetic stripe info?

EMV chips can be cloned, but not with only the information present on the mag stripe. EMVs function as a challenge-response system, meaning an EMV authorization is transactionary between the ATM/POS ...
Khang T's user avatar
  • 36
1 vote

Is identification with NFC bank cards feasible?

The only thing available to you via a contactless bank card is an ID number (of the card). To get more, you have to follow the appropriate guidelines and security of the contactless cards. This means ...
Julian Knight's user avatar
1 vote
Accepted

How could criminals use stolen EMV credit cards in 2011?

One of the features of EMV is that a transaction can be approved offline by the chip, if neither the chip nor the terminal flags it to go online. The terminal simply stores the chip's response, and ...
Bobson's user avatar
  • 1,485
1 vote

ATM skimming and magnetic strip cloning

So, here in Europe, ATMs have been Pin&Chipped for at least since the mid 90's. So there's no question. Other than that: Just insert a credit card (stolen, yours) and try to get money? Stand ...
Marcus Müller's user avatar
1 vote

ATM skimming and cloning

It is possible, and it's also possible to change the service code value on the clone card to trick terminals into believing this card never had a chip to begin with (otherwise EMV capable terminals ...
André Borie's user avatar
  • 12.8k
1 vote

How do I know if a EMV is SDA, DDA or CDA?

Use https://github.com/L1L1/cardpeek/commits/master Cardpeek, it can read VISA or mastercard and then there will be flags what of the SDA, DDA or CDA are supported on this EVM chip. There will be also ...
Валерий Заподовников's user avatar
1 vote

Should EMV data fields be encrypted?

After looking at this website article (https://www.pcicomplianceguide.org/will-emv-make-you-pci-compliant/) it looks like that yes, the data, specifically the PAN needs to be encrypted in accordance ...
Carter's user avatar
  • 11
1 vote

Reading magnetic stripe on a credit/debit card with an EMV chip

Yes, this is called the service code. Its the number in bold below, 101 can be swiped and does not have a chip, while code 201 will not allow a swipe unless the payment device is unable to accept ...
Timothy Goodwin's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible