ATM manufacturer Diebold has spoken out to CU Times after fraud experts reportedly discovered a skimming device on one of its ATMs that may be able to hack EMV cards.
The device, called a “shimmer,” is apparently inserted into the mouth of the ATM's card acceptance slot and sits between the card's chip and the ATM's chip reader. Fraud experts in Mexico discovered one on a Diebold Opteva 520 with a chip reader, according to the report, which was published last week on KrebsonSecurity.com.
The chips on many EMV cards contain a security component called an integrated circuit card verification value that protects against copying magnetic stripe data from the chip. However, thieves may have devised a workaround.
“Banks can run a simple check to see if any card inserted into an ATM is a counterfeit magnetic stripe card that is encoded with data stolen from a chip card,” KrebsonSecurity.com reported. “But there may be some instances in which banks are doing this checking incorrectly or not at all during some periods, and experts say the thieves have figured out which ATMs will accept magnetic stripe cards that are cloned from chip cards.”
That kind of fraud is called cross contamination, according to Diebold Senior Director of Software and Core Security Nick Billett (pictured), who told CU Times through a spokesperson that his company is aware of the attack and is investigating.
“We have a fundamental understanding of the shimmer technology and have already received response from PCI regarding the mitigation technology available to help prevent cross-channel redemption fraud,” Billett said.
The EMV-based track data stored on the EMV chip does not include the card validation code stored on the magnetic stripe, Billett noted.
Shimmers could be a sign that cards will still be vulnerable in a post-EMV world because most card issuers are deploying cards with both EMV chips and magnetic stripes so customers can use both types of readers.
The challenge now is waiting for magnetic stripe readers to disappear.
“Until then, magnetic stripe-based skimming and redemption fraud will continue to some extent,” he said.
Billett said ATM operators should inspect card readers regularly to ensure nothing foreign is inside them, and acquirers should ensure that ATM transaction hosts are checking CVCs.
Complete your profile to continue reading and get FREE access to CUTimes.com, part of your ALM digital membership.
Your access to unlimited CUTimes.com content isn’t changing.
Once you are an ALM digital member, you’ll receive:
- Breaking credit union news and analysis, on-site and via our newsletters and custom alerts
- Weekly Shared Accounts podcast featuring exclusive interviews with industry leaders
- Educational webcasts, white papers, and ebooks from industry thought leaders
- Critical coverage of the commercial real estate and financial advisory markets on our other ALM sites, GlobeSt.com and ThinkAdvisor.com
Already have an account? Sign In Now
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
