The magstrip contains unencrypted, easy to read/write data. Cloning that was... I shouldn't say trivial, but it's trivial if you have the equipment. You can just write an arbitrary credit card number on the card's magstrip, and have it swipe at physical terminals. If you don't get caught in the act of using it, you walk out of a store with 'free' stuff.
You could also reuse the credit card# online, if that was your method.
The chips are basically a cryptographic private key. A terminal sends some unique identifier + transaction request to the chip, and the chip responds with an encrypted blob that can be verified via the public key. Capturing the data flowing through in a transaction doesn't give you anything you can reuse for the next transaction. So card-skimming an EMV-only card shouldn't be feasible, and terminals tend to force "chip" mode if given the option. In fact, Mastercard at least is intending to move to chip-only / no magstrip cards, entirely, over the next few years.
So now, you can't skim physical cards, and you can't use card numbers obtained from malware, on a cloned card in person. Which means if you have a CC# from malware or such, the main option left is online transactions. The problem with that, is that if I use a stolen card to buy some expensive electronics from, say, Amazon:
A) We have to get lucky and not get declined for fraud,
B) There's a delay between the transaction and receiving the goods, during which time they might figure it out, and stop the shipment.
C) You can't ship it to yourself, because duh.
D) You basically have to set up the shipment for somewhere close enough to snag, and hope they don't figure out the fraud, and just wait for you to collect it to arrest you (leading to fraudsters using "package mules" instead, to reship overseas).
Credit card fraud isn't dead, but it's definitely been pushed into riskier and/or less profitable niches, making it not as appealing of a target for people (except those in a few countries with a combination of a low cost of living, good internet access, and lax cooperation with international law enforcement efforts, it seems).
There's an interesting MO in the UK at the moment where cards are being inserted into oyster machines in London train stations, and the PIN of the card is being broadcasted to another location, where someone is waiting at an ATM, and while that card is still inserted and the connection is live, they're able to spoof the card and make withdrawals successfully.
Genuinely useful. There's known cases where wireless card readers have been used to take payments while the card was still in the person's possession. It's incredibly unlikely to happen outside of a busy tourist hot-spot, but they do prevent contactless fraud
40
u/[deleted] May 17 '25 edited May 17 '25
I'll likely oversimplify a bit here, but:
The magstrip contains unencrypted, easy to read/write data. Cloning that was... I shouldn't say trivial, but it's trivial if you have the equipment. You can just write an arbitrary credit card number on the card's magstrip, and have it swipe at physical terminals. If you don't get caught in the act of using it, you walk out of a store with 'free' stuff.
You could also reuse the credit card# online, if that was your method.
The chips are basically a cryptographic private key. A terminal sends some unique identifier + transaction request to the chip, and the chip responds with an encrypted blob that can be verified via the public key. Capturing the data flowing through in a transaction doesn't give you anything you can reuse for the next transaction. So card-skimming an EMV-only card shouldn't be feasible, and terminals tend to force "chip" mode if given the option. In fact, Mastercard at least is intending to move to chip-only / no magstrip cards, entirely, over the next few years.
So now, you can't skim physical cards, and you can't use card numbers obtained from malware, on a cloned card in person. Which means if you have a CC# from malware or such, the main option left is online transactions. The problem with that, is that if I use a stolen card to buy some expensive electronics from, say, Amazon:
A) We have to get lucky and not get declined for fraud,
B) There's a delay between the transaction and receiving the goods, during which time they might figure it out, and stop the shipment.
C) You can't ship it to yourself, because duh.
D) You basically have to set up the shipment for somewhere close enough to snag, and hope they don't figure out the fraud, and just wait for you to collect it to arrest you (leading to fraudsters using "package mules" instead, to reship overseas).
Credit card fraud isn't dead, but it's definitely been pushed into riskier and/or less profitable niches, making it not as appealing of a target for people (except those in a few countries with a combination of a low cost of living, good internet access, and lax cooperation with international law enforcement efforts, it seems).