Researchers: Chip and PIN Enables ‘Chip and Skim’
Summary: Researchers at Cambridge University say they have found that some payment terminals and ATMs generate the 'unpredictable number' used to authenticate EMV chip-and-PIN transactions from simple, predictable counters rather than true random values. Their paper, 'Chip and Skim: Cloning EMV cards with the Pre-Play Attack,' describes recording a transaction and replaying it later at a different location, and draws on data from more than 1,000 transactions at over 20 ATMs and three EMV-enabled ATMs bought on eBay.
Bottom line: The victims in the paper were refused reimbursement because banks argued the chip made the claimed fraud impossible, and the UK's Financial Fraud Action group told the BBC there is 'absolutely no evidence of this complicated fraud being undertaken in the real world' - a denial Anderson says follows the industry's pattern from its 2008 and 2010 research.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026