Researchers find security flaw in chip-and-PIN payment system

Researchers find security flaw in chip-and-PIN payment system
Tags: EMV, Security, Software
February 14, 2010

The United Kingdom's Retail Week reports that researchers at Cambridge University have tricked a chip-and-PIN payment system into authenticating a payment when no valid PIN is present.

The exploit uses what is called a "man-in-the-middle" attack, which involves the thief having a second card-reader nearby, in a backpack.

The fraudster puts the stolen credit or debit card into the shop's reader but then the second reader sends a â€˜PIN okay' signal to the shop terminal. The shop terminal sends back a transaction go-ahead signal to the terminal with the stolen card and money is taken off it.