Chip-and-pin weakness is revealed

[Pommie]

This report from the BBC. states.

Viewers of Tuesday night's Watchdog programme can watch the Cambridge University team intercepting cardholder's details during a transaction in a book shop before sending them wirelessly to an accomplice.

A fake card was made up with the account details and further purchases were made.

How is this possible? Assuming that the cards use a microcontroller then surely the code protect is turned on. It can't be how sky cards use to be copied which was to record answers to questions. How can this be so insecure?

I left the UK before chip and pin was introduced so don't actually know how it works. If the chip doesn't work then do they revert back to the magnetic strip. If so then that would explain it and totally astound me.

Mike.

 

[Sceadwian]

It says that the reader device has to be altered in order to do this. The people that did this had the knowledge to alter the device and money to buy the hardware to replicate the cards from the information retrieved, there is no electronic scheme on earth that can be protected from direct physical tampering like this. Magstrip cards are actually more insecure as all you need to do is tack on an addition to the slide reader to read the cards, and this can be very small. Software and hardware to write your own mag cards is also dirt cheap. At the very least the method used requires the thieves to invest a lot more money. Things like this will be possible with any system used, so it shouldn't be very astounding.