Hacker News Reader

Comment by notatoad | Hacker News Reader

PCI will require that gas stations accept EMV next year. It was supposed to happen like four years ago, but the stations protested. Hopefully it actually goes through this time.

View on HN

That just means they have to use the chip (or accept the liability on their end). Doesn't protect you from a skimmer or a camera.

you can't skim a chip though

Sure, but when you dip your card, the magstripe on that chip card gets skimmed and the camera captures your card number and PIN entry.

If it's implemented properly, the card shouldn't go all the way into the reader, just the smartcard contact

None of which saves you from a camera looking at the numbers on the card while you insert it.

The camera is to record your PIN, which is only useful in conjunction with the magstripe data. A camera to record the numbers physically printed on the card isn't going to be super effective. Yeah, it might get a few, but probably not enough to be worthwhile.

There's no reason a camera couldn't capture card number, expiration and CVV, especially if paired with a contact switch on a skimmer to trigger the photo.

My iPhone happily lets me add a card by taking a picture of the card and OCRing it; my Discover card has number, expiration, and CVV all on the same side even.

It doesn't solve the immediate problem, but once enough people are using chips you could disable the ability to do old-style magstrip transactions (or at least flag them for manual review / extra scrutiny).

Reply on news.ycombinator.com