In this module,
we're going to discover where payment card data can be typically found,
and this is one of the first steps in securing data
because if you don't know where it is, you cannot protect it.
But firstly,
have you ever wondered how criminals turn stolen card data into cash?
Their job is to persuade the issuer of the card that the
transaction is a real one made by the real cardholder using
the card that the issuer made.
And so before authorizing a transaction,
an issuer wants to validate that it really is their customer using the card,
and the security of the payment system and of payment cards is
designed to allow an issuer to do just that.
In the early days of payments when all card processing was manual,
someone working in a retail environment was supposed to check the hologram on
the card to prove that it was a real issued card and not an imitation and also
have the customer sign a piece of paper and then compare the signature on the
paper to the signature on the back of the card to validate it really was the
customer making the transaction.
Once the magnetic stripe and online authorization were introduced,
the issuer could validate that the card was real by making sure that
the data encoded in the magnetic stripe was correct.
And to validate the cardholder,
they could either rely on the merchant's personnel still checking the
signature or that the customer had used their secret PIN.
For an online transaction,
the issuer hasn't much to go on other than the data printed on the card,
including the CVV2 found on the signature strip to validate that card.
They don't really have anything to validate it is really their customer
other than perhaps validating the customer's address.
And when we get to chip cards, as we'll find out later in the module,
the chip contains a secret and a different type of CVV value.
The chip can be asked to use its secret to produce a
cryptographic value that the issuer is able to verify could
only have been produced by that card.
When it comes to validating the cardholder,
some brands ask the merchant to check the signature whereas
others want the cardholder to use their PIN.
There's also a new type of card that includes a fingerprint reader so the
cardholder can be validated by their own biometric data.
So to fool an issuer,
a criminal needs to be able to steal or guess the data that the issuer
relies on to validate the card or the cardholder,
and that's generally the data on the magnetic stripe,
the CVV2, and the cardholder's PIN.
Theoretically, if the criminals wanted to use
stolen data to make a physical card,
they'd need to make false holograms and signatures,
but as no one really checks these anymore, it's just the data they need,
and that's what they can magically turn into cash,
which they do in two ways,
either by taking stolen data and using that data to create cloned
cards that they can use to get cash out of ATMs or by buying goods in
shops with cloned cards and selling those goods for cash or by buying
stuff online with stolen card data and selling those things that
they've bought for cash.
Typically, it's not just one criminal involved in turning card data into money.
There are usually at least four involved.
The first criminal specializes in breaking into a company's systems
and then stealing card data from the company.
The second criminal is a data dealer.
They find people to sell the data to.
The third criminal that just bought the stolen data works out how
to turn the data they've bought into money.
They may create cloned cards or shop online and recruit people
to have goods shipped to them that can then be forwarded to the
criminal and turned into cash.
And the final criminal is known as the mule, and it's the job of the
mule to actually turn it into cash or stolen goods.
They may have to go to lots of ATM machines to make withdrawals or go
shopping online and then ship the stolen goods to the criminal, or even go
shopping in store and ship the goods to the criminal or pass them to
someone else who will make money from it.
Quite often the mule is not a real criminal,
but someone who has been recruited for a work‑at‑home scheme on the internet.
They may think they have a job as a parcel forwarder,
but what they're really doing is resending goods that have
been purchased with stolen payment card data.
It is often the mules who are most easily caught because they
have parcels shipped to their real address, and so law
enforcement can go to the mule's real address.
Okay, so that's simply how payment card crime works.
Now, let's look at the data a criminal might want to steal. To get cash,
criminals want to visit an ATM and make a transaction that just relies on the
magnetic stripe and doesn't use the chip on the card, and that's typically
because the ATM is old and doesn't yet support chip cards or the card that
was cloned itself did not have a chip.
The number of magnetic stripe‑only cards in ATMs is
decreasing, so this attack is also decreasing.
Criminals need to make cloned cards to use in the ATM, so they need to get
the entire contents of track 1 data from the magnetic stripe, and they
also need to have somehow captured the cardholder's PIN. To get physical
goods, the criminal has two options.
They could visit a physical store,
in which case they'll need that cloned magnetic stripe data again using
the track 1 data they've stolen from somewhere else.
Or, and this is more common nowadays, they can make an ecommerce transaction.
They will just require the data that's used to authorize an
ecommerce transaction which can be as little as PAN,
expiration date, and the cardholder's name.
Some issuers also require and check the CVV2 security
code or the cardholder's address.
And, as we will discover in a few minutes,
the new EMV 3‑D secure protocol aims to prevent this type of
fraudulent use. As we discovered in the previous module, there
are four possible steps in a payment card transaction where the
data moves between merchants, banks, and card schemes,
authorization clearing settlement and the undo
transactions, chargebacks and refunds.
The authorization step is the one that contains the most data as
this is the step where the issuer works out if they want to
authorize the transaction, and so this step has to contain all
the data that the issuer needs.
So logically,
if a criminal steals authorization data, then the criminal has all the
data needed to make a criminal authorization request.
If we look at authorization data for the different
ways that the card is accepted,
criminals need to get track 1 data to get cash from an
ATM and goods from physical stores.
And they can steal track 1 data from ATMs or from retail stores and
other places where the magnetic stripe is swiped, such as fuel
dispensers and transport ticketing machines.
Now, I know as well as track 1 data criminals need to get PINs to get
cash from ATMs, and we're going to look at how criminals steal PINs a
bit later because it's not possible to steal a PIN just by stealing
data from the authorization request. To make ecommerce and mail order
transactions,
criminals just need to steal the PAN, the expiration date, and perhaps
the CVV2 from other ecommerce or mail order and telephone all the
retailers. The payment industry uses the term MOTO, M‑O‑T‑O, for mail
order and telephone order retailers.
And in some cases, if the criminals can find an ecommerce or MOTO
retailer doesn't even check the CVV2 security code,
they can use any source of PAN and expiration date, which includes both the
track data and data taken from other ecommerce websites.
Much face‑to‑face fraud is stopped by chip cards, but until
chip cards are everywhere in the world,
criminals will still target magnetic stripe transactions.
So let's find out how criminals use stolen mag stripe data first, and then
later we'll look at the difference that chip technology makes.