5 ms·

I am quite certain that the EMV chip, which is the chip on your card, must authenticate the POS machines it talks to. The authentication is done using public ke

I am quite certain that the EMV chip, which is the chip on your card, must authenticate the POS machines it talks to. The authentication is done using public key cryptography. So it's not sufficient just to host a fake machine and expect it to be accepted within the EMV infrastructure (cards, POC machines and backend processors).

pmjordan 16y ago
Of course, extracting the entered PIN is trivial to do with a covertly modified terminal. (skimming) Short of the card being stolen, that shouldn't let anyone access your account, assuming the crypto implementation is sound. Likewise, the card without the PIN is designed to be equally useless, though support for legacy payment systems partially undermines all of this. I suspect a modified terminal which records entered PINs and clones the magnetic strips would let you withdraw cash from the victim's account via Cirrus/Visa Plus.