Evan Schuman's StorefrontBacktalk

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

Reports of the latest successful attack on chip cards based on the EMV standard should remind all of us once again that there is no such thing as absolute security. Retailers and consumers worldwide–especially those in Canada who are currently implementing chip-and-PIN–need to understand this fact and not count on any single technology to remain secure. That is why PCI remains relevant even in a chip-and-PIN environment.

From a security perspective, retail CIOs should understand a few things about these chip cards or smart cards (i.e., payment cards with an embedded integrated circuit or microchip). Chip cards can reduce fraud losses, but chip-and-PIN zealots can overstate the benefits. While card-present fraud decreases significantly, the bad guys simply shift to card-not-present (e.g., mail, phone or E-Commerce, where the chip has little value) and international fraud (to countries where magnetic stripe technology is used). For example, after the U.K. introduced smart cards, losses from both these sources increased dramatically. Remember that smart cards still have a magnetic stripe (and embossing and signature panels and holograms and every other piece of anti-fraud baggage ever devised).

Retailers should also understand that EMV (Eurocard MasterCard Visa) is a set of generic requirements that allows for the interoperability of cards. Implementation can be card-specific, and issuers still depend greatly on their own internal authorization procedures. Although these procedures are based on EMV, they can vary. For example, it appears the issuers in the recent U.K. case were not checking to see whether a PIN entry was attempted. When you think about chip-and-PIN security, you need to look at the entire authorization process.

One thing that is particularly disturbing about the recent attack is that the printed receipts stated “Verified by PIN” even though they were not. The Cambridge University team managed to convince the smart card that it had a chip-and-signature transaction while simultaneously convincing the POS terminal that it was a chip-and-PIN transaction. As a result, the receipts printed by the terminal indicated that a valid PIN was entered each time. That means defrauded consumers are in the unenviable position of having to convince their issuers that they did not make the transaction. In a particularly ominous quote, Professor Ross Anderson, the lead Cambridge researcher, said: “Over the past five years, thousands of cardholders have had stolen chip-and-PIN cards used by criminals. The banks often tell customers that their PIN was used and so it’s their fault.” Does this mean the bad guys have already used this fraud, or have consumers been lying?

Chip-and-PIN does not give the retailer a free pass on PCI. Sales clerks will continue to process some smart card transactions as chip-and-signature, and some of your people will be willing or unwilling participants in fraud. (Hint: Don’t use chip cards as an excuse to get rid of your internal fraud and staff monitoring systems.) Your call centers will not see much change, nor will your E-Commerce site. And until the entire planet converts to chip cards (and the U.S. market is a long way away from that happening), you will still see cards that have only a magnetic stripe.