Shimmers and Skimmers: Fraudsters Find Opportunity in EMV Chip Cards - PaymentsJournal

xxx

if a bank fails to perform a critical verification step, then you might have a problem

From Shimmers and Skimmers: Fraudsters Find Opportunity in EMV Chip Cards - PaymentsJournal.

Hello. What are they talking about? What is this “critical verification step” that banks might fail to perform (or, at least, banks not advised by Consult Hyperion might fail to perform)? To understand what they are talking about here, you have to understand that you cannot create a counterfeit chip card in the same way that you can create a counterfeit magnetic stripe card. The chips contain a private key that is never revealed, so if you capture all of the data that is on a card or exchanged with a terminal during the process of a transaction, you will obtain the card number and expiry date and so on (these things are not encrypted between the card and the terminal) but so what? You cannot make a fake chip stripe card with these details because you don’t have that pesky private key so you can’t add the correct digital signature to a transaction.

Now, you could of course just make a random signature and hope that the issuing bank doesn’t check it. But that would be ridiculous because surely all banks would check the digital signatures on all transactions, right? Wrong. As we wrote about here many years ago, some banks do not