Credit cards with chips aren't completely secure

[tvguy]

http://www.usatoday.com/story/news/nation-now/2014/05/13/hugging-robbery-card-scanner/9028065/

Been a running discussion here about how the chip cards are more common in Europe for "security" reasons. My daughter is going to school in the U.K. and has found some businesses use the magnet strip instead of the chip, allegedly for "security reasons". I guess the short answer is, there is no fool proof way to prevent credit card theft, you always have to be careful and keep an eye on your statements.

 

[wdwmom0f3]

http://www.usatoday.com/story/news/nation-now/2014/05/13/hugging-robbery-card-scanner/9028065/

Been a running discussion here about how the chip cards are more common in Europe for "security" reasons. My daughter is going to school in the U.K. and has found some businesses use the magnet strip instead of the chip, allegedly for "security reasons". I guess the short answer is, there is no fool proof way to prevent credit card theft, you always have to be careful and keep an eye on your statements.

I wouldn't doubt it. It seems like the crooks find away around everything pretty fast.

 

[Kogo Shuko]

The Chip cards are fairly common here in Canada, but from what I gathered when my card was compromised is that some businesses have not upgraded their payment system, and still use the magnetic strip. Those stations that don't use the Chip are most likely the stations where cards are compromised.

I've only had a card be compromised ONCE since we've moved over to the Chip cards, whereas before, my card was compromised about four times in just two years (I suspect a gas station near my parents').

 

[tvguy]

The Chip cards are fairly common here in Canada, but from what I gathered when my card was compromised is that some businesses have not upgraded their payment system, and still use the magnetic strip. Those stations that don't use the Chip are most likely the stations where cards are compromised.

I've only had a card be compromised ONCE since we've moved over to the Chip cards, whereas before, my card was compromised about four times in just two years (I suspect a gas station near my parents').

Wow. Guess I am lucky. I've had one ATTEMPTED fraudulent charge in 40 years. Bank caught it because the person attempting the charge didn't have the security code on the back of the card.
I just know that the study abroad program at my daughter's school recommended she make sure her credit card did NOT have a chip for security reasons. She hasn't had an issue, but her friend with a chipped guard has found a few merchants there that are not setup to take chipped cards. And the travel shop here sells those protective sleeves just for chip cards.

I have family in Canada and I am there frequently. But they live in remote areas where it's cash or check only, no credit or debit cards at all.

 

[Kogo Shuko]

That must be REALLY remote then, because we're pretty current with technology up here, even in the boondocks.

Perhaps rural maritimes?

Our bank cards are chipped here as well, and we've had the chip technology for years, whereas I'm only NOW seeing it in the States (Upper NY state, for instance).

I think it's fairly common practice to compromise debit/credit machines at gas stations, at least near where my parents live. But there's a lot of minor crime in that area (smuggling of cigarettes, for instance).

But I was forced into getting chipped cards. Both debit and credit. I had no option to say no to them. They cancelled my old card and forced me to use the one they sent in the mail.

 

[BCDisneyFanatic]

Just a few of the plethora of articles/FAQs explaining why chips are more secure than magnetic stripes.

http://www.npr.org/blogs/alltechcon...etic-strips-how-u-s-credit-card-security-lags

http://usa.visa.com/personal/security/card-technology/chip-card-faq.jsp

https://www.chasepaymentech.com/faq_emv_chip_card_technology.html

https://www.americanexpress.com/in/content/safe-and-secure/chip-and-pin-faq.html

Q3: Are the existing Cards no longer secure?

A: The Card(s) that you currently have is secure and can be used until replaced with a Chip and PIN enabled Card. Chip and PIN technology is simply a newer, more advanced technology, to make payments even more secure.

TVGuy, could you please find me a single (reputable) source suggesting that magnetic stripes are actually more secure than chips? I couldn't find any. The closest I could find was this:

Hacker's Demo Shows How Easily Credit Cards Can Be Read Through Clothes And Wallets

http://www.forbes.com/sites/andygre...ards-can-be-read-through-clothes-and-wallets/


However, it does say in the article:

The attack Paget demonstrated is far from new. The security industry has known since 2006 that contactless credit cards can be read wirelessly without the owner’s knowledge. But in current versions of the cards, the user’s name, PIN and the three-digit CVV on the back of the card aren’t included in the wirelessly-read information, which the industry has argued means the attack isn’t practical.

Randy Vanderhoof, executive director of the industry group the Smart Card Alliance, points out that despite previous research on the contactless attack, no real-world instances of the fraud have ever been reported. “We’ve got six years of history, a hundred million users of these cards, and we haven’t seen any documented cases of this kind of fraudulent transaction. The reason we think that’s the case is that it’s very difficult to monetize this as a criminal,” says Vanderhoof. “The premise that this is a new threat is absolutely false and isn’t supported by [Paget's] demonstration.”

In fact, contactless cards do offer one security feature traditional cards don’t: Along with the card’s 16-digit number and expiration date, the cards are set to offer up a one-time CVV code with every scan. Those codes can only be used for one transaction, and have to used in the order they’re generated. If a payment processor detects multiple transactions with the same code or even codes being used to make transactions in the wrong order, it will disable the card. So a contactless card scammer can only use each stolen number once, and if the victim of a the scam uses the card again before the thief has time to make a fraudulent payment, all transactions on the card will be blocked.


“The truth is that consumers should be embracing this technology because it’s making them safer,” says Vanderhoof. “Efforts to try to discredit the use of chip technology in cards is only making the users of the existing technology more vulnerable.”

 

[sunshinehighway]

Wow. Guess I am lucky. I've had one ATTEMPTED fraudulent charge in 40 years. Bank caught it because the person attempting the charge didn't have the security code on the back of the card.
I just know that the study abroad program at my daughter's school recommended she make sure her credit card did NOT have a chip for security reasons. She hasn't had an issue, but her friend with a chipped guard has found a few merchants there that are not setup to take chipped cards. And the travel shop here sells those protective sleeves just for chip cards.

I have family in Canada and I am there frequently. But they live in remote areas where it's cash or check only, no credit or debit cards at all.

It makes absolutely no sense that your daughter's school would recommend her to not bring a chip card. Chip cards are what they use in Europe. Many automated machines don't take magnetic strip cards. Also, chip cards still have a magnetic strip so even if you were to find the one store that didn't take chips, you'd still be able to use your chip card. Any research into traveling to Europe will have countless articles and information on the benefits of bringing a chip card to Europe.

 

[tvguy]

TVGuy, could you please find me a single (reputable) source suggesting that magnetic stripes are actually more secure than chips?

Ah, all I said was chipped cards are having some issues unique to their design, not that they are any less ( or any more) security.

 

[tvguy]

It makes absolutely no sense that your daughter's school would recommend her to not bring a chip card. Chip cards are what they use in Europe. Many automated machines don't take magnetic strip cards. Also, chip cards still have a magnetic strip so even if you were to find the one store that didn't take chips, you'd still be able to use your chip card. Any research into traveling to Europe will have countless articles and information on the benefits of bringing a chip card to Europe.

I do not know why they make that recommendation, but DW is on Skype with DD right now and I read this post to her and her reply is "Try using a chip card at Morrison's sometime, you'll understand." Her classmate has a chipped card and she has had issues with acceptance, DD has not with her magnetic strip card. So apparently the recommendation was made based on students experience there.

 

[NHdisneylover]

It makes absolutely no sense that your daughter's school would recommend her to not bring a chip card. Chip cards are what they use in Europe. Many automated machines don't take magnetic strip cards. Also, chip cards still have a magnetic strip so even if you were to find the one store that didn't take chips, you'd still be able to use your chip card. Any research into traveling to Europe will have countless articles and information on the benefits of bringing a chip card to Europe.

This. We are forever having visitors to the US who only have the strip and run into not being bale to pay in many places.
Heck, even our local McDonalds now requires a chip and a pin (though I consider it lucky it is not cash only like many still are here in Germany--cash only in Canada is not something I have seen as even close to the norm on visits for many years; I agree you must be very rural--wow).

 

[taitai]

I do not know why they make that recommendation, but DW is on Skype with DD right now and I read this post to her and her reply is "Try using a chip card at Morrison's sometime, you'll understand." Her classmate has a chipped card and she has had issues with acceptance, DD has not with her magnetic strip card. So apparently the recommendation was made based on students experience there.

Does your daughter have a chip and PIN or a chip and signature? Chip and PIN cards are what are used in Europe. It is very difficult to buy a subway ticket in Paris or fill up your car with gas in Italy without one....anyplace automated. However, is she only has a Chip and signature card that could explain the issues.

We have a Chip and PIN card for travel to Europe and Asia. It wasn't easy to get here in the US but it made travel so much easier.

 

[A Small World]

I do not know why they make that recommendation, but DW is on Skype with DD right now and I read this post to her and her reply is "Try using a chip card at Morrison's sometime, you'll understand." Her classmate has a chipped card and she has had issues with acceptance, DD has not with her magnetic strip card. So apparently the recommendation was made based on students experience there.

That really surprises me. Im in the UK and we use Chip and Pin cards all the time and have done for several years now.

OT - whereabouts in UK is your daughter?

 

[Melmac]

I am also in Canada, and chip and PIN has been the norm for a few years now. I shop in the US regularly and have never been able to use the chip on my US Visa (all swipe and sign). Are chip cards in the US set up for signature and/or PIN? Are cards in the US set up for chip OR swipe, not both? If they are just one or other, I could see why tvguy's daughter was told to bring a swipe card. In Canada, the cards are set for both.

In my experience, (including the US, Scotland, Netherlands and Australia), the US seems behind in the use of chip and PIN. I only encountered one shop in Scotland that didn't use the chip and they just swiped my card (tiny town - I think I was lucky they even took credit cards). I would never travel abroad without chip and PIN.

 

[sunshinehighway]

I do not know why they make that recommendation, but DW is on Skype with DD right now and I read this post to her and her reply is "Try using a chip card at Morrison's sometime, you'll understand." Her classmate has a chipped card and she has had issues with acceptance, DD has not with her magnetic strip card. So apparently the recommendation was made based on students experience there.

Do you not understand that chip cards still have a magnetic strip that can be swiped? There would be no issue using it at a store which accepts swiped cards.

 

[jsmith]

As with any technology chip cards can be compromised remotely too-they are RF chips and can be scanned with an RFID tag reader.

 

[tvguy]

Do you not understand that chip cards still have a magnetic strip that can be swiped? There would be no issue using it at a store which accepts swiped cards.

Her classmate from the same college has a chip card. The only other thing I know about it is there are places in the U.K. she can't use it, but my daughter's non-chipped card works. And there are some places she can use it, but only if the clerk manually enters the number in the system (and apparently not all clerks know how to do that).
All I know is at the end of the school year when we go over to bring DD home, I'm taking cash. That seems to work everywhere.

 

[tvguy]

Does your daughter have a chip and PIN or a chip and signature? Chip and PIN cards are what are used in Europe. It is very difficult to buy a subway ticket in Paris or fill up your car with gas in Italy without one....anyplace automated. However, is she only has a Chip and signature card that could explain the issues.

We have a Chip and PIN card for travel to Europe and Asia. It wasn't easy to get here in the US but it made travel so much easier.

She has a magnetic strip card. No chip. No pin. She has some sort of account for the rail system in the U.K., she buys her tickets online, just enters what ticket she wants and imputs her credit card number. She has a login to buy the tickets, and logs in at the train station to print the tickets when she gets there. I think she gets a lower fare that way.

 

[tvguy]

That really surprises me. Im in the UK and we use Chip and Pin cards all the time and have done for several years now.

OT - whereabouts in UK is your daughter?

Leeds.

 

[BCDisneyFanatic]

Ah, all I said was chipped cards are having some issues unique to their design, not that they are any less ( or any more) security.

I was responding to this:

Wow. Guess I am lucky. I've had one ATTEMPTED fraudulent charge in 40 years. Bank caught it because the person attempting the charge didn't have the security code on the back of the card.
I just know that the study abroad program at my daughter's school recommended she make sure her credit card did NOT have a chip for security reasons. She hasn't had an issue, but her friend with a chipped guard has found a few merchants there that are not setup to take chipped cards. And the travel shop here sells those protective sleeves just for chip cards.

And I have to ask...

I have family in Canada and I am there frequently. But they live in remote areas where it's cash or check only, no credit or debit cards at all.

What part of Canada are they from??? I've travelled in all provinces and territories, and with the exception of one small village accessible only by boat (in 1992), I don't think I've ever had trouble using a credit card!

 

[bcla]

As with any technology chip cards can be compromised remotely too-they are RF chips and can be scanned with an RFID tag reader.

There generally isn't one-way RFID per se, but a contactless smart card or something with a certain amount of encryption. It's not supposed to broadcast anything that would be useful to a thief. They're supposed to use authentication techniques that make it pretty much useless if the transmission is intercepted.

Also - most cards don't use those contactless smart cards, but physical contacts - like inserting an SD card.

I've been struggling for the name of the technique to foil potential data snoopers/fakers, and found it. It's called "challenge-response". The processor sends a code and there's supposed to be a unique response to that code corresponding to an algorithm. Simply monitoring the code/response pair doesn't reveal anything since the code itself is unique.

If the code something like a 140-bit binary number, the number of possible codes is more than 1 with 42 zeroes. If it's randomly chosen, it's unlikely that it'll ever come up again. But the response will be predictable with the algorithm processed both inside the credit card's electronics and by the credit card processor.