Check Your Statement! A Big Hotel Credit Card Breach...

You would think the cost of all this fraud would be more than enough to validate new chip and PIN rollout in the USA.

Can't quite understand why the US banks are so resistent to this PHeymont.  Have you an understanding of what their reasons are?

It's been a long path. For a long time, observers thought it was because they were committed to contactless (RFID) technology as the next step...but that hasn't advances as fast as some predicted, and it has big security issues, too. Now that MC and Visa have set down a "you must comply or you will be responsible for fraudulent charges" rule for next year, we're seeing motion. 

BUT...so far most issuers have been sticking to chip-and-signature, not and-PIN, which guts the whole process. Chip-and-PIN eliminates both fake cards and anyone who does not know the PIN. Chip-and-signature does NOT validate who presented the card...only that it's a real card. When's the last time someone really checked your signature on the slip and the card? That's right...you probably can't remember!

By the way, a lot of the published stories lately have used inflated figures from the opponents to make it seem too costly ("over $1000 per sales terminal" I mean, those little swipe terminals you see at every counter in Europe...they sell for as little as about $200...and the card issuers subsidize them for many users).

I don't quite see why using a pin would prevent fraud of the type we're seeing on a large scale.  Presumably, if the hackers continue to target terminals, the pin would be compromised too.  Yes, we could change the pin but it would need to be done immediately, before the damage is done.   What am I missing?

As I see it, PM, mostly they are just stealing the data off the magnetic strip.  Or the PIN in the card has data that can also be copied, but that's a little hard than just scamming the read off the strip.  

With a PIN, that data, validated by your unique PIN (which you pick) are encrypted and sent off to the bank for approval.  Not just the strip data, but the two together are the key.  I have a credit card with a Canadian bank (chip and pin) which I prefer to use over the swipe and sign USA credit card I have (the latter seemingly having to be replaced every year because someone out there has stolen it).

Seems to work in most countries.  From what I know, credit card fraud abroad isn't anywhere near as big as in the USA.  Maybe PHeymont could expand on this.

In the most secure system, the PIN is known to you, the user, but is not in your records at the issuer. That's why if you forget your PIN, a new one can be generated, but no one can send you your "lost" PIN the way that passwords can be.

In the PIN system, the first communication takes place at the terminal. The terminal reads the PIN from the chip on your card, and asks you to enter it on the pad. If it matches, the terminal does NOT send the PIN to the clearing house or merchant...it only identifies itself to the network and notifies the network that your identity has been verified. 

That's different from the kind of PIN transaction on your ATM or debit card; in that transaction, the PIN is sent to the network, where the computer verifies that the PIN matches the information read from the mag stripe or the chip, exposing both sets of information. The terminal-side theft that has taken place has been done by software that reads the terminal's communication with the network.

The other major type of theft has been by hackers with credentials that have allowed them to invade central accounting systems and obtain the stored data...but a PIN that is not stored there can't be stolen there!

So, if I understand it then, even if the hackers can read the entered pin keystrokes from the terminal keypad which we enter, it cannot be used without the card with the unique chip, which cannot be duplicated as a magnetic strip can be duplicated?

That's correct. It is, of course, not totally impossible to create a duplicate chip, but it takes major equipment, not $5 worth of RadioShack parts...and it would also require much more information than can be harvested easily.

The relative security (and it is relative) has driven over 80% of the world's credit card fraud toward the U.S. as other areas become more difficult. And once everyone is on board, the Trojan Horse mag stripe can come off the card as well.