I just don't understand why my card even has a magnetic stripe anymore. It's been years since I've seen any terminals that could actually accept it, it's all chip and pin over here. If I could get a card without the strip I'd gladly do so.
I don't know the details of the technological differences in transaction communication between the two, but in the UK chip and pin is noticeably and consistently faster to perform transactions in my experience, often to the the point that it's perceptibly instant... although it has been quite some years since i've used magnetic ones so that's from memory.
I suppose one way to protect yourself if you are never going to use your card in the US, is by destroying the magnetic strip (magnetically).
Most of the machines were replaced inside of the first year and things have improved substantially since then.
* many places moved from offline magstripe authorisation to online chip-and-pin authorisation (while still often using card terminals that use dialup connections, and connect per transaction)
* many US banks have really slow authorisation servers (for whatever reasons!); I remember some sales staff being really surprised at my card going through in about a second (and that verification probably involved a network roundtrip to the UK!)
I don't think the percieved speed is simply due to offline mode.
Just swipe it three or five or more times, and it might work anyway.
Welcome to the 21st Century.
When I'm at O'Reilly Auto Parts, the pinpad is beeping at me to remove my card almost the moment I've inserted it. It's shockingly fast. (Then their neolithic-age printer takes 8 more seconds to generate a receipt, but... baby steps!)
I wish whoever set up their system could go show some others how it's done. Because yes, on average, most retailers have abominably slow processing for chip cards.
Also, I don't think there are any places left where you swipe the magnetic stripe. If for some reason you don't use contactless, it's a chip transaction. I believe it's pretty much the same all across Europe?
Often enough, the chip or the reader is dirty and fails to read, the terminal will prompt you to swipe the card through the mag-reader instead. Usually, it will prompt you to try the card reader again, then back to the mag-reader for a final swipe before continuing.
I'm pretty sure the swipe-style is aggresively deprecated by the banks. I talked to a vendor who had an older terminal that would not accept NFC, and he mentioned that within 2 years, he'd have to get a terminal that would process NFC payments.
The idea is, if there's fraud and the real account holder gets their money back (a chargeback in payment industry terms) somebody has to eat that loss. The liability shift rules say if you didn't do EMV, that's you. For a bank that decided they wouldn't issue EMV cards, they pay when there's fraud on their non-EMV cards - so the merchant still gets their money. But for a merchant if the customer has an EMV card but they swipe it, if that comes back as fraud they're not getting their money.
If the terminals suck, and your business has very low fraud rates or your markup is so enormous you can eat plenty of fraud and not care, it could make sense to ignore liability shift. Especially at first when customers know they could go elsewhere. But as terminals improve, and everybody else is forcing them to use the chip anyway, offering swipe is pretty much a sign "Commit fraud here, ask us how".
For NFC I don't know, it's hard to imagine them trying liability shift. "Use this less secure option or, we'll stick you with fraud costs for the uh, more secure option?" maybe they're just doing the usual thing where they raise fees for everybody who doesn't want to go along with their latest craze :/
There is not much point in damaging the magnetic stripe but leaving wireless functionality... they are exactly the same thing only wireless works from a greater distance.
It's there, in plain text, any normal NFC-reader will get you everything (there even are android-apps that does it in the play-store).
If you mean the CVV it isn't required to make a transaction.
that's incorrect. there's a cvv1 on the magstripe that's needed for magstripe transactions, and there's cvv2 that's on the back of the card that's mostly required (depends on merchant policy) for card not present transactions. for EMV transactions, you need a payment terminal because the card will refuse to communicate unless the other side has a valid certificate. even then, the card only returns a signed response, which you can't use elsewhere.
No? You just said so yourself? "depends on merchant policy" Why would an attacker choose a merchant whose policy denies their use case?
Why would an attacker opt for a magstripe transaction or a contactless transaction?
it's not as easy as you think. nearly all merchants require some sort of additional information (cvv, billing address, cardholder name) in addition to card number + expiration date. reason being, for card not present transactions (eg. online), the merchant is liable for fraud (the purchase amount + ~$25 chargeback fee), so they have a strong financial incentive to collect/verify as many pieces of information to reduce their losses. it would be insane to not collect any of those (only requiring card number + expiry date), because the chargebacks will bankrupt you. the reason i said "depends on merchant policy" is because some merchants (iirc amazon) don't collect cvv2 (but they do collect billing address + cardholder name), which I presume is for convenience/conversion rate reasons. I don't actually know of any merchants that only collects card number + expiry date.
But name is the only additional information you need to make a legitimate purchase, and that information isn't a secret (if you, under any circumstance, ask for someones CVV they will tell you to fuck off. Ask for their name is another thing (maybe even present on a name tag or in many cases trivial in a certain context)). It will make it slightly harder to just randomly scan peoples pockets on the subway but still an absolute security nightmare.
Just disable NFC altogether, no reason not to.
where did you get the impression that there are merchants (worth stealing from) that only accepts card number + expiry + name? the example I gave was with amazon, and they take name AND address. even if you're able to find a merchant with lax security and is worth stealing from, how long can you keep the scam up for? maybe a week or two before the fraud reports start pouring in? then they'll patch up their systems and you're back to square one. you're better off installing skimmers and using the card numbers at any merchant that accepts credit (at least in the US).
>will make it slightly harder to just randomly scan peoples pockets on the subway but still an absolute security nightmare.
considering that you have to be pretty close for NFC to work, whoever is doing it is going to look pretty suspicious as he's bumping into everyone walking endlessly through the train.
>Just disable NFC altogether, no reason not to.
I can think of one: convenience. wave your card in front of the reader vs insert card, wait, type in, wait some more, then taking out your card.
I've heard poker and gaming sites are popular to extract funds (and simultaneously launder them), don't expect them to have much security no.
> considering that you have to be pretty close for NFC to work, whoever is doing it is going to look pretty suspicious as he's bumping into everyone walking endlessly through the train.
Seriously? Just go during rush hour and you can basically stand still, the victims will practically bump into you for you. I don't expect anyone to attempt sprinting a carriage at a time...
For initial orders, yes. Amazon has a very advanced fraud detection system that builds up trust with your account over a while.
Amazon is very difficult to card.
>I've heard poker and gaming sites are popular to extract funds (and simultaneously launder them), don't expect them to have much security no.
All of those will require you to pass VBV. You will not get the information necessary to pass VBV without phishing.
You make it sound like this is difficult or rare, yet banks have a very lax attitude about this and consequently funds thieves with billions upon billions every year. Somehow it is worth it, relying on the victims to scan their transaction history for errors (talk about convenient!).
https://www.nytimes.com/2016/10/31/technology/how-to-protect...
In Britain, where people have arguably embraced contactless cards to a greater extent than individuals in other countries, researchers have routinely been able to copy the financial details of some cards, including the 16-digit card number and expiration date, by merely passing their own N.F.C. reader close to a person’s wallet.
There have been numerous other demonstrations of this as well.
Another demonstration (site is in Swedish https://www.svt.se/nyheter/lokalt/uppsala/sa-kan-tjuven-skim... ).
I think this is the key. The implementation of each card may differ leading to inconsistent results.
As a general rule I suggest covering up the CVV or scratching it off if you're sure you have it somewhere safe. An option is to also erase the magnetic strip. It might lead to a less useful card (in cases where only magstrip would work) but definitely a more secure one. And for any NFC card an RFID shield sleeve does wonders.
You could also get this data by... seeing the card ?
NFC though has the advantage to be read from a distance, easily through a pocket and wallet (if the wallet doesn't have an rfid shield). Surely open up that attack vector isn't helping?
If you are paying attention you can detect someone trying to photograph your card (they shouldn't even be handling it in the first place). But through your pocket? Practically impossible to detect.
edit: The fact that we still print everything needed to make a purchase on the card itself isn't particularly flattering for our species.
Nobody actually does this. Name+card#+cvv+expiry just isn’t worth the hassle, easier to get 1000s at a time via phishing or hacking web shops.
Stripe dumps are an entirely different market, with ATM pins increasing the value of a single dump up to 100x.
I bet there is zero overlap between those that does it and those that have the slightest clue how to perform a phishing or web shop attack.
They simply wouldn't achieve anything. They wouldn't get enough cards to be able to sell them, nor would they be able to cash out this information.
I'm sure there is zero overlap between people doing this and people actually profiting from (or causing losses with) credit card fraud.
If they actually knew what to do with such information, they'd just be buying it for a couple of dollars a piece.
It makes a much more recently deployed system in my area of the US look like a total embarrassment: seconds per processed tap, a much higher tap failure rate (regularly see tap failures for myself and others), etc.
But then again trains and a lot more really work in Japan. Supermarket? No waiting for payment (card or otherwise) - they're using double-buffering.
The video is 3 years old now but still worth a watch discussing the attacks they have seen on Chip and Pin - https://www.youtube.com/watch?v=Ks0SOn8hjG8
An example I know about with one of those flaws was the "Yes card" which MITMs a real (presumably stolen) card and arranges that the conversation goes like this:
* Legitimate terminal "Hi, I'm a Legitimate terminal, who are you?"
* Real card: "Hi, I'm Sizzle's Real Payment Card from Real Bank"
* Legitimate terminal "OK, let's do an offline transaction. I want Sizzle to authorise payment of 24.50. They entered PIN 1234, is that OK?"
MITM Yes card blocks this and tells the card instead:
"OK, let's do an offline transaction. I want Sizzle to authorize payment of 24.50, but I can't be bothered with a PIN so let's skip that"
* Real card: "OK, yes, payment of 24.50 sounds fine" (cryptographically signed message)
So this way you don't need the correct PIN, since the card never realises you entered a PIN, and so the transaction OK simply never mentions the PIN at all. You don't clone the card though, you need a real card, you're just using something like a Confused Deputy attack where the card and terminal misunderstand the situation.
A _smart_ backend at the bank could identify this fraud when the offline transactions are processed, hours or days later, but many did not, and even if they did spot it the fraudsters got away with their transaction meanwhile. The permanent "fix" for this was to roll out new cards and terminals, given this costs money it was probably not done widely or quickly.