Before we explore how the PCI standards protect card data for criminals,
let's discover three changes that have been made in the
payment system that aim to stop criminals in their tracks by
adding security to the transactions.
These changes are the introduction of EMV chip
cards in face‑to‑face transactions, the use of the EMV payment tokens,
and finally, EMV 3‑D Secure for ecommerce transactions.
These three technologies have been developed by the main payment brands
cooperating together in a standards body called EMVCo,
which they own between them.
And these standards define the way that the technology works so that
banks and merchants only have to develop a single set of products to
international interoperable standards.
The adoption of these secure technologies varies across the world,
so where you live, you may see just one or all of these technologies in use.
Let's find out the difference with payment transactions with chip cards first.
A few minutes ago,
we saw how criminals could use stolen magstripe data to
make a cloned card that the issuing bank wouldn't be able
to tell apart from the real card.
This is what the criminals did in some of those very large data
breaches of cardholder data you might remember from 2014,
such as Target and Home Depot in the US,
where tracked data was stolen from the retailer's point of
sale systems and used to make cloned cards.
Well, chip cards fixed this problem.
The chip, or EMV chip which is its proper name, is increasingly found on cards.
It's always in the same place,
but it can look slightly different from one card to another.
Some chips have got rounded corners, some have got cut‑off corners,
some chips you'll see are gold and some are silver.
The chip is not just some fancy design on the card.
It's actually a small computer that's powered up when the
chip is inserted into a chip reading device,
such as a point of interaction device, or as they've come to be called now,
chip and PIN readers or EMV readers or even PIN entry devices,
or PEDs.
So, they have lots of different names,
but basically anything you insert the card into that reads the chip.
So, as well as the small computer, the chip contains some cryptographic secrets.
And the way the chip uses those secrets is why criminals can't
simply copy chip data and make a cloned card.
Because unlike track data or the data on the magnetic stripe,
that secret never leaves the chip.
I'm going to simplify what happens in a face‑to‑face EMV transaction
because the actual steps are really quite complex.
But basically, when an EMV terminal wants to make a transaction happen,
it has a chat with the chip on the EMV card that's been inserted into it.
First, the terminal and the chip say hello to each other.
Part of the hello is working out how the rest of
the transaction is going to work.
For example, the EMV chip on the card might say to the terminal,
oh, by the way, I'm going to need a PIN for all transactions.
The terminal then asks the cardholder to enter their PIN and it
might ask the chip to validate the PIN that the user entered
because in some parts of the world the encrypted PIN is actually
stored within the EMV chip,
so it can be validated without having to send it off to the issuer.
And in other parts of the world,
the PIN is always sent to the issuer to be validated.
These two different ways of validating a PIN are
called offline PIN and online PIN.
So,
maybe what happens next is the terminal sends some data
about the transaction to the chip.
What data it sends differs between the card schemes,
but it will generally include information about the merchant like what
the merchant does and the amount of the transaction.
Now here's the really clever part.
The chip uses the unique secret cryptographic data that was stored in it at
the manufacturer and it generates a cryptographic signature,
which is also called a cryptogram,
and it generates that over the data sent by the terminal and the
other data that the chip has got internally,
and that will include, for instance,
the identity of the merchant and the amount of the transaction.
And it generates this cryptogram and it passes the cryptogram back to the
terminal along with something that looks like a magnetic stripe.
And it says to the terminal,
please go and contact my issuing bank for authorization.
So the terminal gets this data and it sends the cryptogram and the
pseudomagnetic stripe as an authorization request to the acquiring bank.
And the acquiring bank goes to feed it through their payment
system and waits for the authorization response to come back
from the cardholder's issuing bank.
And when it gets the response back,
the terminal passes the authorization response back to the
card and the transaction is complete.
With an EMV transaction,
the authorization request consists of this pseudomagnetic stripe track data
read from the chip and the cryptogram generated by the chip and then the user
information from the merchant about the transaction,
the merchant's name and the amount of the transaction.
Now, the issuer, when it receives this bundle of data,
will check that the pseudo magstripe data is correct,
just as it would do for a normal magstripe transaction.
And the reason is this magnetic stripe image or pseudomagnetic
stripe data, the reason that it's in the system is when the world
transition from magnetic stripe to chips, lots of systems are
expecting to still see that track 1 data, which is why it's still
basically hanging around.
So first of all, the issuing bank validates that magnetic stripe data.
And then the next thing is the issuer also generates the cryptogram itself.
It knows the same cryptographic secret that the card knows.
It's a secret that the issuing bank put into the card.
And so what it does is it generates the cryptogram in the same way using the
same data as the card generated the cryptogram, and it makes sure the
cryptogram it generated matches the cryptogram that the card generated
because that means the only place the cryptogram the issuer received could
have been generated is on the card.
And if they both match, it does that final check to see that
Ann's got enough money in her account or of credit, and then
the transaction will be authorized.
This same process happens whether or not the card is inserted into a
reader or whether it makes a contact list transaction.
Believe it or not, there's a magnetic field created by a contactless card
reader that's picked up by an antenna in the card which creates enough power
to activate the chip to allow it to have this type of conversation with the
reader, all in just a couple of seconds.
So let's see how a criminal can attack this transaction.
Remember, the criminal wants to make a cloned card
from the data that they steal.
Well, the cryptographic secret never leaves the EMV chip, so there's no
data that can be stolen to make a cloned chip card.
But what about that pseudomagnetic stripe data?
Could the criminal use that to make a cloned normal magnetic stripe
card by taking the stolen data containing that pseudomagnetic stripe
image from the retailer's point of sale systems and then writing onto
a blank magstripe‑only card.
Well, you'll be pleased to know the answer is no.
The bank would recognize that.
The reason is that the magstripe image on the chip is actually
different from the magstripe on the back of the card.
If you remember, the track data on a magnetic stripe card includes three digits
called the card verification value, or CVV, shown in red.
I'm just showing the track 2 data here for clarity.
Well, the magnetic stripe from the chip has a different
three‑digit value from the real magstripe.
This is called the chip CVC, or Visa call it the iCVV, and it
will always be a different value from the CVV or CVC encoded
in the real magnetic stripe.
So, if a criminal steals the magnetic stripe image from an EMV chip card,
then they try to make a cloned magnetic stripe card using it, the issuing
bank will notice as it's been given the iCVV rather than the real CVV
attached to that card. So it will refuse the transaction.
So, I guess the question is, is it worth criminals
stealing EMV transaction data?
Well,
it sort of is. The magnetic stripe image still includes the PAN and it still
includes the expiration date, and this could be used by criminals in ecommerce
or mail order or telephone order transactions.