THE CHIP-ENABLED CREDIT card system long used in Europe, a watered down version of which is rolling out for the first time in America, is meant to create a double check against fraud. In a so-called “chip-and-PIN” system, a would-be thief has to both steal a victim’s chip-enabled card and be able to enter the victim’s PIN. But French forensics researchers have dissected a real-world case in which criminals outsmarted that system with a seamless chip-switching trick—and pulled off the feat with a slip of plastic that’s almost indistinguishable from a normal credit card.
French computer security researchers at the École Normale Supérieure university and the science and technology institute CEA late last week published a paper detailing a unique case of credit card fraud they analyzed as investigators in a criminal case. Five French citizens (whom the researchers didn’t name in either their paper or an interview with WIRED) were arrested in 2011 and 2012 for using a clever workaround to spend nearly 600,000 euros (about $680,000) from stolen credit cards in spite of the cards’ chip-and-PIN protections. Through an investigation that included microscopic analysis and even X-ray scans, the researchers discovered that the now-convicted fraudsters actually altered stolen credit cards to implant a second chip inside of them, capable of spoofing the PIN verification required by point-of-sale terminals.
Reblogged this on Brittius.