US Chip Cards Are Being Compromised In the Millions (threatpost.com) 106
According to a study from Gemini Advisory, some 60 million U.S. cards were compromised in the past 12 months. "Of those, 93 percent were EMV chip-enabled," reports Threatpost. "Also, crucially, 75 percent, or 45.8 million, were records stolen from in-person transactions." From the report: These were likely compromised through card-skimming malware and point-of-sale (POS) breaches at establishments like retailers, hotels and restaurants, the likes of which continue to make headlines. Further results show that the U.S. leads the rest of the world in the total amount of compromised EMV payment cards by a massive 37.3 million records. In the past 12 months, about 15.9 million compromised non-U.S. payment cards were posted for sale on the underground, split between 11.3 million card-not-present (online transaction) records and 4.6 million card-present records, of which 4.3 million were EMV enabled. This means that the theft level of EMV-enabled card data in the U.S. is 868 percent higher than the rest of the world combined.
The reason for this state of affairs, according to Gemini, is the lack of U.S. merchant compliance -- too many of them still use the mag-stripe function at PoS terminals. Gemini also said that card-present data "is also collected via a more manual method by skimmer groups, who are utilizing custom made hardware known as 'shimmers' to record and exfiltrate data from ATMs and POS systems. The firm also found that while most large U.S. merchants have fully transitioned to EMV, gas pump terminals and small/medium size businesses are emerging as the main targets for cybercriminals going forward.
The reason for this state of affairs, according to Gemini, is the lack of U.S. merchant compliance -- too many of them still use the mag-stripe function at PoS terminals. Gemini also said that card-present data "is also collected via a more manual method by skimmer groups, who are utilizing custom made hardware known as 'shimmers' to record and exfiltrate data from ATMs and POS systems. The firm also found that while most large U.S. merchants have fully transitioned to EMV, gas pump terminals and small/medium size businesses are emerging as the main targets for cybercriminals going forward.
What (Score:5, Interesting)
too many of them still use the mag-stripe function
If this is mostly happening via the old magnetic strip than what does the chip even have to do with this story?
Re: (Score:2, Insightful)
Just reiterating the fact that the chips were a half-measure, never fully implemented as designed, and are thus useless and leave us vulnerable per the credit vendors' lobbied wishes? Yeah maybe just that.
Re:What (Score:5, Interesting)
Just reiterating the fact that the chips were a half-measure
Not even half, maybe a quarter measure. The chips can not only be bypassed, but because America doesn't use chip-and-PIN, the chip can be used directly by anyone stealing your card.
It is like putting a titanium deadbolt on your front door, and having an aluminum screen door on the back of the house, and also putting the deadbolt cylinder in backwards so the thumbturn is on the outside.
The rest of the world did this right. Only America screwed it up so badly, and mostly because the people with the ability to fix it (that banks) have no incentive to do so. They just push the losses off onto the customer or the merchant.
Re: What (Score:3, Informative)
Most of the fraud is moving to online transactions, where all they need are the numbers and cvv code. Chips won't help. What is needed is 2 factor Auth to approve transactions.
Re: What (Score:1)
So 3-D Secure with strong authentication, which has been around for years and is becoming a requirement in Europe as per the PSD2. The problem is that they had to enforce it through regulation because even if it shifts liability from the merchant to the card issuer in case of fraud, it has quite an impact on sales conversions.
Re: (Score:1)
We do have that where I live. In order to use my card, you need my password and a generated code from my code generator. Otherwise, my bank will not authorize the online transaction.
Re: (Score:2)
Not about "fix it", about doing it right in the first place. The merchants with many swipe readers - like gas stations (where the reader is integrated into the pump) and fast-food chains - didn't want to pay for new hardware with chip handlers, so they convinced the banks to delay. The same merchants didn't want to slow down transactions, so they didn't want the "wasted time" of PIN entry; after all, the c
Re:What (Score:4, Informative)
If this is mostly happening via the old magnetic strip than what does the chip even have to do with this story?
If you can intercept the conversation between the EMV chip and the terminal, you can skim enough information to produce a counterfeit mag stripe that will work. That's actually a long-standing vulnerability in the EMV system.
There was supposedly a fix which involved programming different ICCV codes on the chip and in the mag stripe, but that fix depends on the card provisioners to implement. This is typical of security debacles: a fundamental weakness in the system isn't really fixed by a band-aid that requires everyone to do the right thing.
Re: (Score:2)
Why have a strip?
Because the gas station companies and many small merchants didn't want to absorb the cost of replacing their pumps and POS units. Not even when the banks told them they would be on the hook for any fraudulent charges. In most cases fraudulent charges to gas station companies and small business owners is a fraction of what they would pay to upgrade, so they just eat the cost, except they don't eat it. They pass the losses on to their customers or insurance companies. Or right them off as los
Re: (Score:2)
Why not just disable mag stripe payments on cards that have chips? The bank has to authorize the payment, and can simply decline if the terminal reports that it was by mag strip when the card has a chip.
That's what happened in the UK. There are some exceptions for people who can't use a PIN (numerical dyslexia etc.) but for most people it's PIN only. Retailers had a few years to upgrade their terminals; they don't last forever anyway so it wasn't even an extra cost.
Re: (Score:2)
Re: (Score:2)
If this is mostly happening via the old magnetic strip than what does the chip even have to do with this story?
If you can intercept the conversation between the EMV chip and the terminal, you can skim enough information to produce a counterfeit mag stripe that will work. That's actually a long-standing vulnerability in the EMV system.
There was supposedly a fix which involved programming different ICCV codes on the chip and in the mag stripe, but that fix depends on the card provisioners to implement. This is typical of security debacles: a fundamental weakness in the system isn't really fixed by a band-aid that requires everyone to do the right thing.
Not sure why you're going on about card cloning... Hardly anyone clones cards any more as they're too easy to trace and there are far better uses for card details.
The article said "compromised", not "cloned" so likely the card numbers are being used to make online transactions as all you need for that are your card number, cardholder name and expiry date (CVV/CVC is optional, not using it just attracts higher merchant fees and it's like criminals care about that with someone else's money). Dumb criminals
Re: (Score:2)
Re: (Score:3)
no. read my (long) post.
it was not magstripe, it was outright forgery. I don't believe they ever had my card, but I suspect the equifax (etc) break-ins were the cause of most of this.
there is 'skimming' and 'shimming' but in my case, I don't think it was a copy of the card; I think they frauded the system some other way.
one thing the bank told me: if these were magstripe transactions, we would have voided them out as soon as you reported them to us, but since they used MAGIC CHIPS, of course, those are tr
Re: (Score:2)
Good question.
Re: What (Score:1)
Because all US EMV cards have magstripes. The solution is so stupid: Hold merchants responsible if the mag stripe is used and do not issue and more mag stripe cards. Foreign banks can get the ball rolling by refusing to accept magstripe and card not present (online/offline) unless accompanied by GPS coordinates. Then if the coordinates donâ(TM)t match the userâ(TM)s cell phone app location, void it.
Re: (Score:2)
Ummm that's exactly how it works. If you don't take chip cards your liable for fraud. If you do VISA/MC is.
Poland and Serbia (Score:1)
This is the mecca for fraud in Europe.
Re: (Score:1)
We have joke in Albania - Serbia two biggest export is asbestos and fraud.
Re:Poland and Serbia (Score:4, Interesting)
Here's the thing -- by allowing the Russians to take over Eastern Europe in 1945, the US created that particular mess. The US should have stuck to their guns in 1945 and required truly free elections in all of the countries concerned. We had nuclear weapons. Stalin did not.
This being said, the stereotype of Eastern Europe being a mecca for fraud, corruption, and nothing else, is a bit of an outdated trope. Poland's economy is booming, though their politics are a bit shameful right now. Countries like Estonia have actually set themselves up as tech hubs right now, legit businesses and startups.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
The US had a ton more Communist spies than is popularly known. A LOT of people back then believed that capitalism had met its end, socialism was the only way forward and it was just a matter of time, better help the system collapse and set up a Communist government in America before it was too late, etc. A lot of these people worked in Hollywood, the State Department, and other influential areas. Go ahead and try to find a Hollywood film from the 40s or 50s with a positive portrayal of business. They're
Re: (Score:2)
Here's the thing -- by allowing the Russians to take over Eastern Europe in 1945, the US created that particular mess. The US should have stuck to their guns in 1945 and required truly free elections in all of the countries concerned. We had nuclear weapons. Stalin did not.
Actually, at the end of WWII... No-one had nuclear weapons. The US used both of its finished bombs on Japan and weren't in a position to mass manufacture more, let alone deliver them to Moscow... And Stalin bloody well knew it thanks to spies at Los Alamos. Hell, if the US had half decent counter intelligence, the Soviet nuclear program would have been put back decades, if it even managed to produce a bomb at all.
However what Stalin did have was the largest army in the world and he did hold all of easte
Re: (Score:3)
b) they can blame the retailer and again that is not fraud they have to cover
c) if they do have to cover more fraud, they just raise the rates
In the end its us that has to pay, both in higher prices and interest rates - they just pass the costs of incompetence on to you.
Chip and PIN is no panacea (Score:2)
The last couple of times I bought groceries, the chip was rejected three times, then fell back to magstrip.
Turns out relying on chip and PIN is unreliable.
Re: (Score:3)
This seems to be a US problem. Late to the game and trouble getting it to work? Not good.
Re: Chip and PIN is no panacea (Score:2)
Could be wrong, but most countries I imagine can get away without the fallback. American consumers don't use nor do they carry cash. As many Europeans seem to find weird: we use credit cards to pay for gum. A downed payment machine is a good way to lose a customer permanently.
Re: (Score:2, Informative)
Last I checked the democracies at least in western Europe work pretty well.
Gerrymandering, voter suppression, election irregularities, fixing the courts with partisan judges, the administration calling the fourth estate the enemies of the people -- all stuff that's undermining democracies, and all stuff that the US is currently known for.
(To be fair: Some of those problems do exist in a few eastern European countries.)
Re: (Score:2)
The last couple times I bought groceries, I paid good, old-fashioned, real, cash. Because cash payments are seldom rejected (outside of Zimbabwe dollars) and always work.
I know. How non-millennial of me.
Re: (Score:2)
Re: (Score:2)
Hey! I am LITERALLY a trillionaire!
Yes, sir, about 7 years ago, I purchased four $250 Billion Dollar Zimbabwe notes, therefore officially making me a trillionaire, in Dollars!
Good. (Score:2)
Honestly, this doesn't make me too upset, since consumers will always get their money back at the end of the day.
Anything that reduces the profits of the card companies, card-using merchants, and card-issuing banks doesn't make me the slightest bit sad. Think of it as the world throwing some sand into the gears of the transition to a cash "free" (aka privacy-free) economy. Anything that creates just a little bit more friction is a net positive.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
So when trying to deal with my bank they initially told me that I had to wait for it to post, then after that they told me there was
Re: (Score:2)
Re: (Score:1)
Re: Good. (Score:2)
I have never had this much trouble for fraudulent charges. I suddenly discovered a $25 charge for the last 4 months that looked legit (Spotify) but I knew I never purchased.
A 5 minute email and two days later, I was fully credited. For stuff that was 4 months old! They did tell me 2 months afterward that their investigation concluded that they appeared fraudulent and the credits will stand, closing the topic.
I don't understand why people have so much trouble disputing charges.
Re: (Score:2)
read my long post.
I disputed them, I had proof and my bank STILL threw me under the bus.
go read my post. its long but it explains it all.
Bait and switch headline much? (Score:5, Insightful)
So to get this straight, you get a plastic card, it supports both the newfangled way and the old-and-busted way (or else people would be up in arms that it wasn't compatible with 100% of readers). By the way, the new hotness is just the old version plus a transaction-unique cryptographic token. Now, when this is deployed, people figure out -- they skim the new way and then use it to create mag-stripe cards that can be used only at places that don't require a chip. But somehow this is a problem with the chip cards?
Nooooo, it's a problem with places that don't require a chip. We've known since the 80s that you can copy a magnetic strip with a 2-tape boombox (seriously, it will work).
TLDR: There's nothing wrong with the chip cards themselves. But there is something wrong with merchants that haven't upgraded to EMV, and definitely something wrong with /. editors that write a completely ass-backwards headline.
Re:Bait and switch headline much? (Score:5, Informative)
Those merchants are having to pay for their lack of adoption. Based on Visa and Mastercard rules, if the merchant doesn't support chip cards, and there is a fraudulent transaction using the magnetic strip, the merchant is out the money. If the issuing bank doesn't provide a chip card, the bank is out the money. These incentives will talk more loudly than people preaching better security.
Re: (Score:2)
These incentives will talk more loudly than people preaching better security.
Or back in reality: People don't care. That is shown quite clearly by the USA having some of the slowest and most lacklustre adoption to CHIP + STUPIDITY in the developed world.
I mean you could do it like the rest of the world where the evil government forces a multinational megacorp literally swimming in cash to dip into that cash to provide updated systems to their merchants and then force adoption of said system by making the use of a mag stripe illegal. But no, evil government is evil, free market will
Re: (Score:2)
Not only that, the transaction fees are higher as well. I was talking this last week with a friend who owns a small music shop, and he was saying that their credit card processing fees for card-not-present transactions are twice those of card-present transactions. They'll be switching to a new version of their POS system that allows them to associate a card read/swipe with a contract (i.e. each subsequent monthly charge counts as a card-present transaction), rather than having to rely on entering payment in
Re: (Score:3)
Re: (Score:2)
But you can't clone an EMV card anyway. So the best a waiter can do with a clone is use it at a merchant that still accepts magstripe.
Once that goes away, the problem goes away.
Re: (Score:2)
Re: (Score:2)
Slow adoptance (Score:4, Interesting)
The headline is misleading. It is not the transactions by chip that are being compromised. The fact that a card swiped the old fashioned way happened to have a chip is moot - it is the same attack vector on the legacy magnetic strip.
There must be significant expense involved for merchants to switch to the chip readers, as most of the POS now systems have chip readers, but some retailers don't support them. More than likely it is price gouging by the vendors that configure and manage the POS units.
Finally, in my area, Lowes Home Improvement has the totally bizarre setup where if I want to use my bank card as a debit card (requiring PIN) I must swipe, and if I want to use it as credit card (requiring signature) I must insert it. However, it asks you AFTER you have inserted or swiped, so if you choose the wrong option then you have to remove or re-swipe the card. The local store has resorted to putting handwritten notes on the POS terminals advising which to do (insert or swipe) depending on whether you want credit or debit. That leads me to believe there is some recurring per-transaction cost using chip with debit.
Slow adoptance because of banks (Score:4, Informative)
the retailers put up with allowing mag stripe because the banks do
if EMV actually made the retailer liable for fraud then they would make sure you use pay wave/pass (NFC) and a PIN
by using a CHIP and PIN it first of all verifies LOCALLY on the chip then generates a One Time Code that gets sent to the issuing network (bank) There is ZERO
repeat ZERO ways to skim chip and PIN its all down to the Mag Stripe
before some bright spark complains about having to input the numbers into ecommerce sites... Yes this can be secured by 2FA that the banks in europe ask for (you get redirected during the payment process to the banks website that then ask's for your 2FA details )
basically its american banks being lazy and dont care about loosing customer details... its just a cost of business to them and they dont care about the retailers experience either otherwise they would have made made NFC cheap and easy
basically banks need to reduce they fee's they charge retailers in return for securing things 0.5% is common in Europe
Re: (Score:2)
Lucky for Europeans. 2.5% is common in New Zealand.
Whenever I travel to the US... (Score:4, Informative)
Whenever I travel to the US, one of the first things that I notice is different is the lax approach to card security. In most of Western Europe, pretty much every card transaction uses the chip. I can disable the mag-stripe on some of my cards (through the banks' online systems), and using magstripe anywhere increases the chance of a transaction being picked up by the banks' automated fraud detection systems. Then when you get to the US, you go into a restaurant, settle up by card with no signature and no pin, and then the restaurant can manipulate the transaction later to add whatever tip you wrote on the bill. Madness!
Re: (Score:1)
Actually, this could happen in Europe as well if there was incentive for it.
Credit card processing mechanisms can have multiple phases for a single transaction. Normally it's one phase: you pay for your merchandise immediately, and the exact amount is added to your balance. However, for online orders, i
Re:Whenever I travel to the US... (Score:4, Informative)
You can disable the magstripe with a magnet too.
That might stop it working in ATM's though.
Some bank ATM's rewrite the magstripe every time you use it with a different security code. They recommend you insert your card in their ATM's when you return from holiday, as if it was skimmed and they've update the security code since then, the fraud detection kicks in immediately when the skimmed card is used.
National Australia Bank calls it LENSecure
Re: (Score:2)
Yeah - some ATMs in the UK still don't use magstripe, although the numbers are decreasing and their usually easy to identify (the displays look like something out of War Games).
Re: (Score:2)
No, it's just as hackable; albeit requiring slightly lower tech tools.
Instead of a skimmer; they'd use something sharp and pointy or something heavy and blunt. At least with credit or debit you have some recourse; carrying cash you're SOL.
Re: (Score:2)
The "sharp and pointy" approach has its own problems.
I use cash for low-value transactions and card for the few high-value ones. The border is somewhere over $50.
Re: (Score:2)
You're also safe using a regular contactless card.
MST with your watch, token sent (Score:2)
Re: (Score:3)
That's also how chip cards and contactless cards work too.
Except when you're in the USA and all the terminals still allow the use of magstripes, regardless of the card having a chip, then you can bypass the chip completely.
my story (tldr; wells fargo is clueless) (Score:5, Informative)
sigh. I'd like to type in pages but I won't.
long story short, I got a text from wells saying they thought something was 'up' with some purchases. I never check sms (I use email and ignore sms) but I later found that text and called wells to check if it was real. it was real and there were thousands of dollars of charges I didn't make. I never lost my card and it was never out of my posession.
I called wells and we went thru the charges. I told them which were mine and which were unknown to me. I thought that was it and waited to hear back. weeks later, I get a letter in the mail from them saying that they 'investigated' it and since the card was never lost and it was a CHIP BASED CARD, it could NOT BE THEIR FAULT and I was told I had to pay the thousands of dollars of charges!
I was shocked. I was a member of that bank for over 20 years (yeah, I know, I should have left years ago when wells first had issues reported against them).
the weeks that they let it sit were weeks that evidence was starting to fade away (video 'tapes' being recycled at stores, etc). I think that was also part of wells' plan, to delay me and make me miss some deadlines.
I forced them to re-open the 'closed' case and I filed a police report. I was not asked to at first, but when I went to the bank in person and made an issue of this, they asked that I make a formal police report, which I then did.
get this: one week later, I get letters in the mail from the local court system. they caught 2 people and I was informed that sentencing was going to happen in 1 week and I was allowed to attend, if I wanted. (I suspect that the forged card had my name on it or receipts from stores had my name on it).
here's the kicker: it took ALL OF THIS in order to convince my bank that it was not me. their line, all along was 'it was a chip card and it never left your possesion, in your own words, and chip cards are PERFECT, so pay up, it was you!'. that was their line and until I showed them court papers, they would not give in.
tell everyone you know about this. the chip cards are less than useless in the US and banks are still putting their fingers in their ears and saying 'I cant hear you, its still your fault, pay up!'.
their security system is at fault and yet they blame us.
it took me MONTHS to get this all cleared out. did I get anything for my time? no. of course not.
wells fargo can eat shit and die. anyone still with them should leave immediately. I was a 20+ year member and they threw me under the bus for a few thousand dollars. they don't deserve to have a single customer. please leave if you are with them.
and be very careful with your 'chip' card. there's nothing secure about it. the thieves have it all worked out already ;(
Re: my story (tldr; wells fargo is clueless) (Score:1)
I donâ(TM)t think that WF disbelieved you or thinks that chip cards are invulnerable.
Shifting the cost of fraud away from them and onto you was one of the âoeselling pointsâ that got US card issuers to finally embrace this âoeupgradeâ.
They donâ(TM)t care about the chip card fraud because they donâ(TM)t have to under the new system. Pretty cool, right?
Re: (Score:2)
hifting the cost of fraud away from them and onto you was one of the âoeselling pointsâ that got US card issuers to finally embrace this âoeupgradeâ.
No, it wasn't. There was no selling point. MasterCard, Amex, Diners and Visa told them that if they did not use chip, they were liable for fraud. Simple as that. So the rule now is, if the card is not chip enabled, the Issuer (your bank) are liable. If the card is chip enabled but the POS does not support chip, the merchant is liable. That was what liability shift meant - it did not shift liability to the consumer.
I'd be interested in the GP's understanding of what actually happened. There's only been one p
Problem non existant in NZ (Score:2)
The merchants are liable for card fraud if a magstripe is used.
Most of the merchants don't own the terminals, they're leased.
It didn't take long for the full rollout of emv chip+pin.
The only annoying thing now is all the terminals support NFC, but a lot of merchants don't have it enabled because the fees are higher. If contactless transactions cost the same as credit cards I wouldn't need to carry my wallet around when I go out for lunch.
Re: (Score:2)
I think if NZ is anything like the UK, it's nothing to do with magstripe liability.
The second "Chip + PIN" (as we called it) came out, the new deals to all merchants basically said "all liability is yours". Whether Chip, NFC or magstripe.
It was literally "if you want our shiny new, you take responsibility for all fraud in your shop". Which is ridiculous and should have been illegal but these card companies are international and it's hard to apply law to them to combat that when they own the industry.
There
Re: (Score:2)
NZ is probably a bit unique.
We have a debit card network (I think it's still called EFTPOS) which means transactions for debit cards don't go through Visa/Mastercard/etc. It's a pretty much zero fee network.
The reason small shops here hate you paying by credit card or NFC is the fees. Those all go through the credit card networks and they've just gone from free transactions for debit cards to 2.5% fees for credit cards. Sometimes even larger for small transactions.
Here's an agreement for merchant credit car
bitcoin user not affected [nt] (Score:1)
Re: (Score:2)
Typically the problem has been that the U.S. is an early adopter. We got cell phones first so there were competing standards. By the time other countries jumped on the bandwagon a clear technology winner was established and so they never faced the competing standards with installed infrastructure problem.
The U.S. invented the credit card. The same applies.
Second is scope. The U.S. is big, with fifty different legal standards for most things. Many people consider this a feature not a bug, but this means that