New security flaw in credit card chips revealed
Computer researchers have found yet another flaw in the upgrade to the chip-based credit cards in the United States.
The chip on these credit cards have been praised for making them nearly impossible to counterfeit. While the cards also contain a magnetic strip, that strip is supposed to tell the payment machine to use the chip.But there's a relatively easy way to knock down that safeguard.
Computer security researchers at the payment technology company NCR demonstrated how credit card thieves can rewrite the magnetic stripe code to make it appear like a chipless card again. This allows them to keep counterfeiting -- just like they did before the nationwide switch to chip cards.
They presented their findings at the Black Hat computer security conference on Wednesday.
This glaring hole in EMV, the chip-based system, is possible because of the way many retailers are upgrading their payment machines: They're not encrypting the transaction.
"There's a common misperception EMV solves everything. It doesn't," Patrick Watson, one of the researchers, told CNNMoney.
The discovery of this flaw bolsters the retail industry's complaints against the upgrade, which was forced upon shops by banks.
The National Retail Federation has long complained about the upgrade, which is estimated to cost American retailers $25 billion.
This latest research shows that retailers could spend millions of dollars upgrading to EMV and still not protect their customers from a massive credit card theft like the Target and Home Depot hacks two years ago.
CNNMoney reached out to the major machine makers, Verifone and Ingenico, as well as the major credit card companies, Visa and MasterCard.
Currently, retailers focus on protecting the computer network that support their payment system. But that leaves the actual conversation between your credit card and the machine in plain text, readable to any hacker who breaks into the system.
During their presentation, the NCR researchers advised shops to "encrypt everything" in a transaction. They also said consumers should pay with special apps on their phones and watches whenever the high tech option is available, CNN reports.