New scam called 'shimming' targets your credit or debit card chip

[gdale6]

El Paso, TX - 
There's a new technique that thieves are using to steal your credit and debit card information.

It's called shimming and it targets those who use cards that have a microchip on it.

Credit or debit cards with the embedded chips on them were released as a response to the credit card scam known as skimming.

http://www.kvia.com/news/top-stories/new-scam-called-shimming-targets-your-credit-or-debit-card-chip...

[Anonymous]

wow... no matter the technology to keep info from scammers, they will find a way to beat it.

All the more reason to use credit rather than debit cards? 

Thanks for posting this. 

[Anonymous]

Nice read...i'm sure banks will start thinking on how they can improve the security on the cards by adding a second layer of security.  Now we know that the metallic stripe didn't work, now the chip went $#@...wha'ts next?

[Anonymous]

Skimming is real and scary but keep in mind you're statistically more likely to get mugged at an atm than skimmed, but it still is something to look out for.

The worst part about this technique is that it's only due to some banks not properly verifying the ICVV (integrated circuit verification value - the number equivalent to the traditional 3 digit CVV card verification value "security code" on the back of card) or CVV for transactions. The ICVV stored on the chip portion of a chip enabled card has added security features and can be dynamic in a sense, all to make it so you can't clone the data from a chip card and encode it on a standard magstrip card for fraud - the values won't match. It's due to the reluctance to and half-assed and incomplete deployment of chip/EMV standards equipment by card issuers, payment networks and POS operators that this is a problem at all. How many places have you shopped have had chip card readers at checkout that don't actually accept chip but make you swipe? Or that take chip but still also accept magnetic only cards? For me it's been countless.

The merchants fear of losing business if customers are forced to endure the "unacceptable inconvenience" of an additional 30-60 seconds while checking out, combined with business & and smaller card issuers reluctance to pay up front cost of upgrading payment hardware and the underlying lack of financial liability to those business where fraudulent purchases occur means that yet again, in America the cost benefits of fraud and doing business favors card issuers and thus consumers bearing the cost of fraud instead of businesses taking already established & proven steps to protect the personal information of the consumers they depend on.

I'll get off my soap box now.

[Anonymous]

Postscript: I'm thinking of putting together a "basic POS checkout, atm & general card security practices" thread to help people learn & use some of the very simple and potent techniques they can take to minimize their risk of feeling victim to fraud.

Think of something akin to the "Amex 3x CLI guide" mega-thread, but about basic Opsec for using (preferably not actually physically) your cards in stores, restaurants and at atms. A worthwhile endeavor or would I be wasting my time? I've spent over a decade following information security and fraud trends and tend to be shocked at how few of us take any real precautions at all. I figure if people are here to learn how to manage and use their credit they should want to learn to protect it as well.

[Anonymous]

gdale6 ... great read and good follow from the posters!

[Anonymous]

I went to shell to put gas and remembered this post, i check the credit card slot before pumping lol.

I guess going inside will be safer.

[SOGGIE]

Shimming is more of a nightmare than skimming as you cannot see the internally installed device and therefore, inspection is useless. I think NFC technology is a much more securer method for card payment use. Either a card by itself (like the Edge smart card) or a smart phone with NFC capability for use with apps such as Apple Pay, Google Pay, Samsung Pay or Chase Pay is the better way to go. Just my opinion.

[ToughFistFight]

Off subject. I love El Paso. Great article also.

[arkane]

Using Samsung Pay at Gas Pumps

Pardon the Youtube link, but I thought it highly relevant to this thread. I think I may just have to try this one out, and if it works, that's how I'm paying for my gas from here on out.