Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security United States

US Chip Cards Are Being Compromised In the Millions (threatpost.com) 106

Posted by BeauHD from the that's-a-lot-of-zeros dept.
According to a study from Gemini Advisory, some 60 million U.S. cards were compromised in the past 12 months. "Of those, 93 percent were EMV chip-enabled," reports Threatpost. "Also, crucially, 75 percent, or 45.8 million, were records stolen from in-person transactions." From the report: These were likely compromised through card-skimming malware and point-of-sale (POS) breaches at establishments like retailers, hotels and restaurants, the likes of which continue to make headlines. Further results show that the U.S. leads the rest of the world in the total amount of compromised EMV payment cards by a massive 37.3 million records. In the past 12 months, about 15.9 million compromised non-U.S. payment cards were posted for sale on the underground, split between 11.3 million card-not-present (online transaction) records and 4.6 million card-present records, of which 4.3 million were EMV enabled. This means that the theft level of EMV-enabled card data in the U.S. is 868 percent higher than the rest of the world combined.

The reason for this state of affairs, according to Gemini, is the lack of U.S. merchant compliance -- too many of them still use the mag-stripe function at PoS terminals. Gemini also said that card-present data "is also collected via a more manual method by skimmer groups, who are utilizing custom made hardware known as 'shimmers' to record and exfiltrate data from ATMs and POS systems. The firm also found that while most large U.S. merchants have fully transitioned to EMV, gas pump terminals and small/medium size businesses are emerging as the main targets for cybercriminals going forward.
This discussion has been archived. No new comments can be posted.

US Chip Cards Are Being Compromised In the Millions More

US Chip Cards Are Being Compromised In the Millions

Comments Filter:

  • What (Score:5, Interesting)

    by Anonymous Coward on Monday November 12, 2018 @05:44PM (#57633530)

    too many of them still use the mag-stripe function

    If this is mostly happening via the old magnetic strip than what does the chip even have to do with this story?

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Just reiterating the fact that the chips were a half-measure, never fully implemented as designed, and are thus useless and leave us vulnerable per the credit vendors' lobbied wishes? Yeah maybe just that.

      • Re:What (Score:5, Interesting)

        by ShanghaiBill ( 739463 ) on Monday November 12, 2018 @06:32PM (#57633810)

        Just reiterating the fact that the chips were a half-measure

        Not even half, maybe a quarter measure. The chips can not only be bypassed, but because America doesn't use chip-and-PIN, the chip can be used directly by anyone stealing your card.

        It is like putting a titanium deadbolt on your front door, and having an aluminum screen door on the back of the house, and also putting the deadbolt cylinder in backwards so the thumbturn is on the outside.

        The rest of the world did this right. Only America screwed it up so badly, and mostly because the people with the ability to fix it (that banks) have no incentive to do so. They just push the losses off onto the customer or the merchant.

        • Re: What (Score:3, Informative)

          by Anonymous Coward

          Most of the fraud is moving to online transactions, where all they need are the numbers and cvv code. Chips won't help. What is needed is 2 factor Auth to approve transactions.

          • Re: What (Score:1)

            by Anonymous Coward

            So 3-D Secure with strong authentication, which has been around for years and is becoming a requirement in Europe as per the PSD2. The problem is that they had to enforce it through regulation because even if it shifts liability from the merchant to the card issuer in case of fraud, it has quite an impact on sales conversions.

          • Re: (Score:1)

            by Anonymous Coward

            We do have that where I live. In order to use my card, you need my password and a generated code from my code generator. Otherwise, my bank will not authorize the online transaction.

        • >>> because the people with the ability to fix it (that banks) have no incentive to do so

          Not about "fix it", about doing it right in the first place. The merchants with many swipe readers - like gas stations (where the reader is integrated into the pump) and fast-food chains - didn't want to pay for new hardware with chip handlers, so they convinced the banks to delay. The same merchants didn't want to slow down transactions, so they didn't want the "wasted time" of PIN entry; after all, the c

    • Re:What (Score:4, Informative)

      by hey! ( 33014 ) on Monday November 12, 2018 @06:00PM (#57633626) Homepage Journal

      If this is mostly happening via the old magnetic strip than what does the chip even have to do with this story?

      If you can intercept the conversation between the EMV chip and the terminal, you can skim enough information to produce a counterfeit mag stripe that will work. That's actually a long-standing vulnerability in the EMV system.

      There was supposedly a fix which involved programming different ICCV codes on the chip and in the mag stripe, but that fix depends on the card provisioners to implement. This is typical of security debacles: a fundamental weakness in the system isn't really fixed by a band-aid that requires everyone to do the right thing.

      • Re: (Score:2)

        by AmiMoJo ( 196126 )

        Why not just disable mag stripe payments on cards that have chips? The bank has to authorize the payment, and can simply decline if the terminal reports that it was by mag strip when the card has a chip.

        That's what happened in the UK. There are some exceptions for people who can't use a PIN (numerical dyslexia etc.) but for most people it's PIN only. Retailers had a few years to upgrade their terminals; they don't last forever anyway so it wasn't even an extra cost.

        • Re: (Score:2)

          by aitikin ( 909209 )
          Because enough terminals don't have a chip reader. I just went through a gas station where the terminal didn't have a chip reader, just the mag strip. If they implemented it that way, my card would be useless there...although, they'd also have likely lost enough business to choose to upgrade or to make the decision to go cash only...

      • Re: (Score:2)

        by mjwx ( 966435 )

        If this is mostly happening via the old magnetic strip than what does the chip even have to do with this story?

        If you can intercept the conversation between the EMV chip and the terminal, you can skim enough information to produce a counterfeit mag stripe that will work. That's actually a long-standing vulnerability in the EMV system.

        There was supposedly a fix which involved programming different ICCV codes on the chip and in the mag stripe, but that fix depends on the card provisioners to implement. This is typical of security debacles: a fundamental weakness in the system isn't really fixed by a band-aid that requires everyone to do the right thing.

        Not sure why you're going on about card cloning... Hardly anyone clones cards any more as they're too easy to trace and there are far better uses for card details.

        The article said "compromised", not "cloned" so likely the card numbers are being used to make online transactions as all you need for that are your card number, cardholder name and expiry date (CVV/CVC is optional, not using it just attracts higher merchant fees and it's like criminals care about that with someone else's money). Dumb criminals

    • Re: (Score:2)

      by dpalley ( 670276 )
      They're saying the chips are EMV-enabled, but the vulnerable transactions are still using the old mag stripe.

      • no. read my (long) post.

        it was not magstripe, it was outright forgery. I don't believe they ever had my card, but I suspect the equifax (etc) break-ins were the cause of most of this.

        there is 'skimming' and 'shimming' but in my case, I don't think it was a copy of the card; I think they frauded the system some other way.

        one thing the bank told me: if these were magstripe transactions, we would have voided them out as soon as you reported them to us, but since they used MAGIC CHIPS, of course, those are tr

    • Re: (Score:2)

      by gweihir ( 88907 )

      Good question.

    • Re: What (Score:1)

      by Anonymous Coward

      Because all US EMV cards have magstripes. The solution is so stupid: Hold merchants responsible if the mag stripe is used and do not issue and more mag stripe cards. Foreign banks can get the ball rolling by refusing to accept magstripe and card not present (online/offline) unless accompanied by GPS coordinates. Then if the coordinates donâ(TM)t match the userâ(TM)s cell phone app location, void it.

      • Re: (Score:2)

        by TRRosen ( 720617 )

        Ummm that's exactly how it works. If you don't take chip cards your liable for fraud. If you do VISA/MC is.

  • Poland and Serbia (Score:1)

    by Anonymous Coward

    This is the mecca for fraud in Europe.

    • Re: (Score:1)

      by Anonymous Coward

      We have joke in Albania - Serbia two biggest export is asbestos and fraud.

  • The last couple of times I bought groceries, the chip was rejected three times, then fell back to magstrip.

    Turns out relying on chip and PIN is unreliable.

    • Re: (Score:3)

      by gweihir ( 88907 )

      This seems to be a US problem. Late to the game and trouble getting it to work? Not good.

      • Could be wrong, but most countries I imagine can get away without the fallback. American consumers don't use nor do they carry cash. As many Europeans seem to find weird: we use credit cards to pay for gum. A downed payment machine is a good way to lose a customer permanently.

    • The last couple times I bought groceries, I paid good, old-fashioned, real, cash. Because cash payments are seldom rejected (outside of Zimbabwe dollars) and always work.

      I know. How non-millennial of me.

  • Honestly, this doesn't make me too upset, since consumers will always get their money back at the end of the day.

    Anything that reduces the profits of the card companies, card-using merchants, and card-issuing banks doesn't make me the slightest bit sad. Think of it as the world throwing some sand into the gears of the transition to a cash "free" (aka privacy-free) economy. Anything that creates just a little bit more friction is a net positive.

    • You do realize who winds up paying those costs in the end, don't you?
      • Yes. And if cards become more expensive to use and accept, it will do a little bit to discourage their use, which is good for preserving a privacy-friendly economy.
    • Not always, I recently had $155 charged to my card from a Kohl's in Iowa. I've never been to Iowa, I never shop at Kohls, and it turns out that a lot of other people did also get theirs charged when I googled the ident/charge name/whatever for the specific charge. This was a company card for my business that is only used for business purposes, and actually very rarely at that.

      So when trying to deal with my bank they initially told me that I had to wait for it to post, then after that they told me there was
      • If you had proof you weren't in Iowa, you should have filed a complaint with your state's department of bank regulation if your bank didn't fix the issue.
        • Yet more stuff to do to cost me time and money that won't be reimbursed no matter what, the point still stands it isn't just money being taken out that's put back in just because you point out a fraudulent charge.

      • I have never had this much trouble for fraudulent charges. I suddenly discovered a $25 charge for the last 4 months that looked legit (Spotify) but I knew I never purchased.

        A 5 minute email and two days later, I was fully credited. For stuff that was 4 months old! They did tell me 2 months afterward that their investigation concluded that they appeared fraudulent and the credits will stand, closing the topic.

        I don't understand why people have so much trouble disputing charges.

        • read my long post.

          I disputed them, I had proof and my bank STILL threw me under the bus.

          go read my post. its long but it explains it all.

  • Bait and switch headline much? (Score:5, Insightful)

    by Wrath0fb0b ( 302444 ) on Monday November 12, 2018 @06:25PM (#57633748)

    The reason for this state of affairs, according to Gemini, is the lack of U.S. merchant complianceâ"too many of them still use the mag-stripe function at PoS terminals. ...
    If the EMV functionalities are not fully deployed, the track 1 and track 2 data stolen from the chip transaction can be easily encoded by the fraudster onto any magnetic strip.

    So to get this straight, you get a plastic card, it supports both the newfangled way and the old-and-busted way (or else people would be up in arms that it wasn't compatible with 100% of readers). By the way, the new hotness is just the old version plus a transaction-unique cryptographic token. Now, when this is deployed, people figure out -- they skim the new way and then use it to create mag-stripe cards that can be used only at places that don't require a chip. But somehow this is a problem with the chip cards?

    Nooooo, it's a problem with places that don't require a chip. We've known since the 80s that you can copy a magnetic strip with a 2-tape boombox (seriously, it will work).

    TLDR: There's nothing wrong with the chip cards themselves. But there is something wrong with merchants that haven't upgraded to EMV, and definitely something wrong with /. editors that write a completely ass-backwards headline.

    • Re:Bait and switch headline much? (Score:5, Informative)

      by Tony Isaac ( 1301187 ) on Tuesday November 13, 2018 @12:39AM (#57635352) Homepage

      Those merchants are having to pay for their lack of adoption. Based on Visa and Mastercard rules, if the merchant doesn't support chip cards, and there is a fraudulent transaction using the magnetic strip, the merchant is out the money. If the issuing bank doesn't provide a chip card, the bank is out the money. These incentives will talk more loudly than people preaching better security.

      • These incentives will talk more loudly than people preaching better security.

        Or back in reality: People don't care. That is shown quite clearly by the USA having some of the slowest and most lacklustre adoption to CHIP + STUPIDITY in the developed world.

        I mean you could do it like the rest of the world where the evil government forces a multinational megacorp literally swimming in cash to dip into that cash to provide updated systems to their merchants and then force adoption of said system by making the use of a mag stripe illegal. But no, evil government is evil, free market will

      • Not only that, the transaction fees are higher as well. I was talking this last week with a friend who owns a small music shop, and he was saying that their credit card processing fees for card-not-present transactions are twice those of card-present transactions. They'll be switching to a new version of their POS system that allows them to associate a card read/swipe with a contract (i.e. each subsequent monthly charge counts as a card-present transaction), rather than having to rely on entering payment in

    • A lot of the fraud was solved in the rest of the world by a simple change to the merchant banking rules: merchants may not take the card out of sight of the customer. If you want people to pay at the table in a restaurant, you come around with a wireless card reader. This removes 99% of the opportunities for skimming and it means that if a merchant does take the card away it's so unusual that the customer will likely remember it when they discover fraudulent transactions and can easily report the source.

      • But you can't clone an EMV card anyway. So the best a waiter can do with a clone is use it at a merchant that still accepts magstripe.

        Once that goes away, the problem goes away.

    • You seem to be unaware that the chip and pin cards can be hacked also. Fraud isn't gone in Europe where they use these things. It was always a story told to us about how we needed this extra security with no facts to back it up.

  • Slow adoptance (Score:4, Interesting)

    by Dan East ( 318230 ) on Monday November 12, 2018 @06:30PM (#57633804) Journal

    The headline is misleading. It is not the transactions by chip that are being compromised. The fact that a card swiped the old fashioned way happened to have a chip is moot - it is the same attack vector on the legacy magnetic strip.

    There must be significant expense involved for merchants to switch to the chip readers, as most of the POS now systems have chip readers, but some retailers don't support them. More than likely it is price gouging by the vendors that configure and manage the POS units.

    Finally, in my area, Lowes Home Improvement has the totally bizarre setup where if I want to use my bank card as a debit card (requiring PIN) I must swipe, and if I want to use it as credit card (requiring signature) I must insert it. However, it asks you AFTER you have inserted or swiped, so if you choose the wrong option then you have to remove or re-swipe the card. The local store has resorted to putting handwritten notes on the POS terminals advising which to do (insert or swipe) depending on whether you want credit or debit. That leads me to believe there is some recurring per-transaction cost using chip with debit.

    • Slow adoptance because of banks (Score:4, Informative)

      by johnjones ( 14274 ) on Monday November 12, 2018 @06:47PM (#57633912) Homepage Journal

      the retailers put up with allowing mag stripe because the banks do

      if EMV actually made the retailer liable for fraud then they would make sure you use pay wave/pass (NFC) and a PIN
      by using a CHIP and PIN it first of all verifies LOCALLY on the chip then generates a One Time Code that gets sent to the issuing network (bank) There is ZERO

      repeat ZERO ways to skim chip and PIN its all down to the Mag Stripe

      before some bright spark complains about having to input the numbers into ecommerce sites... Yes this can be secured by 2FA that the banks in europe ask for (you get redirected during the payment process to the banks website that then ask's for your 2FA details )

      basically its american banks being lazy and dont care about loosing customer details... its just a cost of business to them and they dont care about the retailers experience either otherwise they would have made made NFC cheap and easy

      basically banks need to reduce they fee's they charge retailers in return for securing things 0.5% is common in Europe

  • Whenever I travel to the US... (Score:4, Informative)

    by beezly ( 197427 ) on Monday November 12, 2018 @06:47PM (#57633908)

    Whenever I travel to the US, one of the first things that I notice is different is the lax approach to card security. In most of Western Europe, pretty much every card transaction uses the chip. I can disable the mag-stripe on some of my cards (through the banks' online systems), and using magstripe anywhere increases the chance of a transaction being picked up by the banks' automated fraud detection systems. Then when you get to the US, you go into a restaurant, settle up by card with no signature and no pin, and then the restaurant can manipulate the transaction later to add whatever tip you wrote on the bill. Madness!

    • Re: (Score:1)

      by Anonymous Coward

      Then when you get to the US, you go into a restaurant, settle up by card with no signature and no pin, and then the restaurant can manipulate the transaction later to add whatever tip you wrote on the bill.

      Actually, this could happen in Europe as well if there was incentive for it.

      Credit card processing mechanisms can have multiple phases for a single transaction. Normally it's one phase: you pay for your merchandise immediately, and the exact amount is added to your balance. However, for online orders, i

    • Re:Whenever I travel to the US... (Score:4, Informative)

      by viperidaenz ( 2515578 ) on Monday November 12, 2018 @09:51PM (#57634872)

      You can disable the magstripe with a magnet too.

      That might stop it working in ATM's though.
      Some bank ATM's rewrite the magstripe every time you use it with a different security code. They recommend you insert your card in their ATM's when you return from holiday, as if it was skimmed and they've update the security code since then, the fraud detection kicks in immediately when the skimmed card is used.

      National Australia Bank calls it LENSecure

      • Re: (Score:2)

        by beezly ( 197427 )

        Yeah - some ATMs in the UK still don't use magstripe, although the numbers are decreasing and their usually easy to identify (the displays look like something out of War Games).

  • I started using my watch, samsung pay, because, as I understand it, between my bank & the watch/phone/app, it sends a ONE TIME token through the POS reader, instead of the card information. If that is exactly how it works, even if they get a "card number" it won't do a thief any good because it's only good for a one time use.

    • That's also how chip cards and contactless cards work too.
      Except when you're in the USA and all the terminals still allow the use of magstripes, regardless of the card having a chip, then you can bypass the chip completely.

  • my story (tldr; wells fargo is clueless) (Score:5, Informative)

    by TheGratefulNet ( 143330 ) on Monday November 12, 2018 @09:24PM (#57634732)

    sigh. I'd like to type in pages but I won't.

    long story short, I got a text from wells saying they thought something was 'up' with some purchases. I never check sms (I use email and ignore sms) but I later found that text and called wells to check if it was real. it was real and there were thousands of dollars of charges I didn't make. I never lost my card and it was never out of my posession.

    I called wells and we went thru the charges. I told them which were mine and which were unknown to me. I thought that was it and waited to hear back. weeks later, I get a letter in the mail from them saying that they 'investigated' it and since the card was never lost and it was a CHIP BASED CARD, it could NOT BE THEIR FAULT and I was told I had to pay the thousands of dollars of charges!

    I was shocked. I was a member of that bank for over 20 years (yeah, I know, I should have left years ago when wells first had issues reported against them).

    the weeks that they let it sit were weeks that evidence was starting to fade away (video 'tapes' being recycled at stores, etc). I think that was also part of wells' plan, to delay me and make me miss some deadlines.

    I forced them to re-open the 'closed' case and I filed a police report. I was not asked to at first, but when I went to the bank in person and made an issue of this, they asked that I make a formal police report, which I then did.

    get this: one week later, I get letters in the mail from the local court system. they caught 2 people and I was informed that sentencing was going to happen in 1 week and I was allowed to attend, if I wanted. (I suspect that the forged card had my name on it or receipts from stores had my name on it).

    here's the kicker: it took ALL OF THIS in order to convince my bank that it was not me. their line, all along was 'it was a chip card and it never left your possesion, in your own words, and chip cards are PERFECT, so pay up, it was you!'. that was their line and until I showed them court papers, they would not give in.

    tell everyone you know about this. the chip cards are less than useless in the US and banks are still putting their fingers in their ears and saying 'I cant hear you, its still your fault, pay up!'.

    their security system is at fault and yet they blame us.

    it took me MONTHS to get this all cleared out. did I get anything for my time? no. of course not.

    wells fargo can eat shit and die. anyone still with them should leave immediately. I was a 20+ year member and they threw me under the bus for a few thousand dollars. they don't deserve to have a single customer. please leave if you are with them.

    and be very careful with your 'chip' card. there's nothing secure about it. the thieves have it all worked out already ;(

    • I donâ(TM)t think that WF disbelieved you or thinks that chip cards are invulnerable.

      Shifting the cost of fraud away from them and onto you was one of the âoeselling pointsâ that got US card issuers to finally embrace this âoeupgradeâ.

      They donâ(TM)t care about the chip card fraud because they donâ(TM)t have to under the new system. Pretty cool, right?

      • Re: (Score:2)

        by DarenN ( 411219 )

        hifting the cost of fraud away from them and onto you was one of the âoeselling pointsâ that got US card issuers to finally embrace this âoeupgradeâ.

        No, it wasn't. There was no selling point. MasterCard, Amex, Diners and Visa told them that if they did not use chip, they were liable for fraud. Simple as that. So the rule now is, if the card is not chip enabled, the Issuer (your bank) are liable. If the card is chip enabled but the POS does not support chip, the merchant is liable. That was what liability shift meant - it did not shift liability to the consumer.

        I'd be interested in the GP's understanding of what actually happened. There's only been one p

  • The merchants are liable for card fraud if a magstripe is used.
    Most of the merchants don't own the terminals, they're leased.

    It didn't take long for the full rollout of emv chip+pin.

    The only annoying thing now is all the terminals support NFC, but a lot of merchants don't have it enabled because the fees are higher. If contactless transactions cost the same as credit cards I wouldn't need to carry my wallet around when I go out for lunch.

    • Re: (Score:2)

      by ledow ( 319597 )

      I think if NZ is anything like the UK, it's nothing to do with magstripe liability.

      The second "Chip + PIN" (as we called it) came out, the new deals to all merchants basically said "all liability is yours". Whether Chip, NFC or magstripe.

      It was literally "if you want our shiny new, you take responsibility for all fraud in your shop". Which is ridiculous and should have been illegal but these card companies are international and it's hard to apply law to them to combat that when they own the industry.

      There

      • NZ is probably a bit unique.
        We have a debit card network (I think it's still called EFTPOS) which means transactions for debit cards don't go through Visa/Mastercard/etc. It's a pretty much zero fee network.
        The reason small shops here hate you paying by credit card or NFC is the fees. Those all go through the credit card networks and they've just gone from free transactions for debit cards to 2.5% fees for credit cards. Sometimes even larger for small transactions.

        Here's an agreement for merchant credit car

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (10) Sorry, but that's too useful.

Close