Brian Krebs
MERRIFIELD, Va.—A new pattern of card fraud could raise issues for FIs deploying EMV cards, according to security blogger Brian Krebs.
KrebsOnSecurity reported that at least three U.S. financial institutions have received tens of thousands of dollars in fraudulent credit and debit card transactions coming from Brazil and hitting card accounts stolen in recent retail heists, principally cards compromised as part of the breach at Home Depot.
Krebs noted that what’s unique—and concerning—about the thefts, is that the unauthorized charges were all submitted through Visa and MasterCard’s networks as chip-enabled transactions, despite the issuing banks not yet sending customers chip-enabled cards.
A bank victimized by the fraud informed Krebs that based on a conversation with MasterCard officials, the most likely explanation how the fraud occurred was a technique called “replay” attack, where fraudsters push magnetic-stripe card transactions through the card network as EMV purchases.
MasterCard officials explained that the thieves were probably in control of a payment terminal and had the ability to manipulate data fields for transactions put through that terminal. After capturing traffic from a real EMV-based chip card transaction, the thieves could insert stolen card data into the transaction stream, while modifying the merchant and acquirer bank account on the fly.
Not only is this a new fraud pattern, but one that makes it harder for banks and credit unions to dispute the phony charges, said Krebs. FIs are responsible for all of the fraud costs that occur from any fraudulent use of their customers’ chip-enabled credit/debit cards—even fraudulent charges disguised as pseudo-chip transactions.
Avivah Litan, a fraud analyst with Gartner Inc., quoted in the Krebs report, stated the attacks illustrate the importance of FIs setting up EMV correctly.
“There’s going to be a lot of confusion when banks roll out EMV, and one thing I’ve learned from clients is how hard it is to implement properly,” Litan said. “A lot of banks will loosen other fraud controls right away, even before they verify that they’ve got EMV implemented correctly. They won’t expect the point-of-sale codes to be manipulated by fraudsters. That’s the irony: We think EMV is going to solve all our card fraud problems, but doing it correctly is going to take a lot longer than we thought. It’s not that easy.”
Related links