Forest Global Training Partners

Cyber Risks · Krebs on Security

ATM ‘Shimmers’ Target Chip-Based Cards

Summary: Warnings out of Canada describe "shimming" devices that sit between a chip card and the chip reader in an ATM or point-of-sale terminal, recording chip data as it is read; KrebsOnSecurity first covered the technique in August 2015 and expects it to spread as more U.S. banks issue chip cards. Shimmer data cannot fabricate a chip card but can clone a magnetic stripe card, and NCR wrote in a 2016 alert that the attack only succeeds when a card issuer neglects to check the CVV when authorizing a transaction.

What's compelling: NCR's 2016 warning is blunt: the only way this attack works is if an issuer skips the basic CVV check, so the exposure sits in card-issuer authorization logic rather than in the ATM or the chip itself.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related