Forest Global Training Partners

Cyber Risks · Krebs on Security

‘Replay’ Attacks Spoof Chip Card Charges

Summary: At least three U.S. financial institutions reported tens of thousands of dollars in fraudulent card transactions originating from Brazil and hitting accounts compromised in the Home Depot breach, submitted through Visa and MasterCard networks as chip-enabled transactions even though the issuing banks had not yet sent customers chip cards. A small New England bank fought about $120,000 in fraudulent debit charges from Brazilian stores in under two days, blocking $80,000 while its processor approved the remaining $40,000, and MasterCard told the bank the likely mechanism was a "replay" attack in which thieves controlling a payment terminal captured real EMV transaction traffic and inserted stolen card data.

What's compelling: Under the card network rules described here, banks bear all fraud costs on their customers' chip-enabled cards, so a replay attack that makes a magnetic-stripe transaction look like EMV shifts the loss onto the issuer and closes off the merchant-breach dispute path. Gartner analyst Avivah Litan noted a Canadian bank suffered a fairly large loss because it accepted any cryptogram and did not check the one-time code or dynamic counter.

Read the original at Krebs on Security ↗

Topics
Fraud & Scams
Related