Personal Finance & Money Stack Exchange is a question and answer site for people who want to be financially literate. It only takes a minute to sign up.
Sign up to join this community
The new Chip credit cards are being introduced to provide better security to consumers, merchants and credit card vendors.
Sample Card:
(source: mastercard.com)
Card Reader & PIN Entry:
Are they really better from a security point of view? What are the advantages and disadvantages?
Cambridge researchers called this system fundamentally broken. Here's the news story on ZDNet.
It relies on the card to authenticate that the PIN inserted was correct, and the card merely sends a "PIN okay" note to the payment processing system. This "everything OK" signal can be faked. If the PIN challenge was communicated over a secure channel over the network to a central authentication mechanism somehow, it would have been more secure than the card alone. (There's a couple of schemes you can use to do that without transmitting the PIN itself, too, for extra security.) But they didn't do any of these.
So, it makes stolen cards a little harder to use, and makes forgery a little trickier, but doesn't really do much else. It's like one of those locks on your door that can be jiggled open with a credit card: a casual deterrent. Which is worth something; however, if it fails,
Anderson noted that in disputed transactions, if the transaction has been verified by PIN, the liability for the loss rests on the consumer rather than on the bank or merchant.
Fun, huh?
There's little doubt that EMV has better security than simple mag stripe cards. EMV cards currently can't be skimmed or duplicated, unlike mag stripe cards. That gets rid of a bunch of fraud channels.
The EMV standard is large and there are many ways to implement it. There are currently(?) 3 types of chips - SDA, DDA and CDA, with each chip improving security. With such a large standard, and so many ways to implement it, there are bound to be insecure combinations. It's far from perfect.
Allowing the Chip to authenticate the PIN (Offline PIN) is not mandatory. In Australia for example, I believe it's uncommon as EFT terminals are always online - in Europe I understand it's more common to have terminals which are offline. So I believe the attack linked from ZDNet wouldn't work in Australia. Which isn't to say there aren't others - see here for another great attack: http://www.schneier.com/blog/archives/2010/02/man-in-the-midd_1.html
EMV will be the future in most countries, with the US being the exception (It's the only exception I know of, but I'm no expert) where EMV has yet to take hold, partly, I hear, due to the cost of rolling out such a large number of new terminals. In Australia at least, MasterCard and VISA tune the liabilities to favour companies which adopt the new standards. This has the effect of encouraging take up of EMV and other schemes like 3D-Secure.
As a consumer, I don't really care at all about the security of payment cards. I don't carry debit cards, and fraud on my credit cards is the bank's problem. The cost of a card compromise to me is a 5-minute phone call.
Personally, I'm wary of PIN-transactions because banks have a tendency to consider 12 bits of entropy (ie. 4 numbers) as a foolproof security measure that shifts liability for fraud to me.
If this technology actually reduces fraud to a level that improves the bottom line of the issuing banks, you'll know when they start replacing the current magnetic stripe cards en masse. Judging by the fact that American Express abandoned chip and pin efforts (the original hook for the "Blue" card), new credit card paradigms like RevolutionCard haven't had a ton of uptake, and RFID payment doesn't seem to be a big deal to consumers, my guess is that it doesn't have a big impact.
They are better for the bank, as the terms put more liability on the user. They can be a little more secure in some circumstances, but while some countries still avoid using chip and pin a simple attack which is incredibly common is fir attackers to get the magstrip and pin code and send them to one of those countries where a cloned card can be used, or for simple 'card not present' transactions - like Internet shopping.
