A recent article, in the Daily Mail, highlighted how supposedly secure Pin and Chip cards can be compromised, despite assurances to the contrary by a lot of banks.
We spoke to our resident EMV specialist, John Rummery, who confirmed that it can happen and sent us this response.
“This was going to happen!
Under EMV the PIN is stored on the card through an algorithm and validated at the POS by the terminal device.
Previously under the magnetic stripe method the PIN was sent to the bank for validation in an encrypted format.
Given that encryption keys are held in the terminal device, and on the card, it stands to reason that these can be compromised.
The Banks identified this very early in the EMV cycle and dynamic keys (keys that change with every transaction) were introduced and these were changed on the card on every transaction, again it stands to reason that the new key can be compromised with an effective invasion device that will send the correct data to the device for approval.
I guess the old saying “if it can be built it can be broken” is true.
I firmly believe that the PIN should in all cases be sent to the Issuer for validation through entry to the terminal device, encryption and then sent to the Issuer.
Whilst not 100% secure the use of the protocols can protect the messages (the communication networks are so large and with changing keys on every transaction it would be difficult to perpetrate large scale fraud).
This can be evidenced by ATM traffic where all PINs are sent to the Issuer for validation, the only form of compromise for these devices would seem to be through physical monitoring of transactions at the ATM (i.e. cameras to record PIN entry and devices attached that can capture card data)”.
Interesting times coming up in the card industry for sure.