As more U.S. issuers hand out EMV chip credit cards, a new report challenges the technology's fraud-fighting reputation.
British researchers from Cambridge University claim that fraudsters can penetrate EMV chip cards through certain ATMs and payment terminals.
Here's how it works: EMV cards have embedded microchips that encrypt transaction information uniquely each time a card is used. That encryption is supposed to make it nearly impossible for thieves to clone fraudulent cards. However, a loose thread in the technology's standard gives them an opening, according to these researchers. As part of the EMV standard maintained by Europay, MasterCard and Visa, ATMs or payment terminals must provide an authentication number that is nonrepeating. But some machines provide numbers that simply increase by the same amount for every transaction.
For example, the machine will give "1000" to authorize a transaction, then "1001" for the following transaction, and then "1002" and so on.
That could allow hackers to predict an authentication number, steal the card's information and create a cloned card, the report said. The researchers looked into the possibility of EMV vulnerability about nine months ago after some U.K. citizens reported losses from their EMV cards. Their banks refused to reimburse them.
The report comes as Visa, MasterCard, American Express and push U.S. merchants and ATM owners to accept EMV chip cards over the next few years, mainly because of its anti-theft feature. The liability for credit card fraud falls heavily on banks. Right now, U.S. consumers have a maximum liability of $50 from credit card losses under the Fair Credit Billing Act. (Debit card users have fewer protections.)
At the same time, many banks are offering EMV versions of their credit cards for affluent globetrotters and business travelers for greater convenience. Many tollbooths, unmanned gas stations, train kiosks and rural merchants abroad only take chip cards.
We'll see if this report gains any traction, and if it complicates the U.S. adoption of EMV. Still, it seems that it's harder to steal information from an EMV credit card than your traditional magnetic-strip card. Just ask this Mugs 'N Jugs waitress.
Do you think EMV chip cards aren't what they were cracked up to be?
Follow me on Twitter: @JannaHerron