Shimming: the newest con for stealing credit card info from ATM machines

Re:Shimming: the newest con for stealing credit card info fr... by kqr2 on Monday July 12, 2010 @07:55PM (#1509867)

Since US cards are "dumb", the ATM doesn't need to send PIN information to it. The ATM card # can be stolen, however, that's not enough to complete the transaction.

[ Parent | on HN ]

Re:Shimming: the newest con for stealing credit card info fr... by gbrindisi on Tuesday July 13, 2010 @06:00AM (#1510890)

Talking about old mag stripe card, the system used to authenticate the transaction is this:

1. The account number is crypted in DES (ora a variant) with a PIN key, the cryptogram is then decimalized and the first 4-5 digit extracted to obtain the so-called natural PIN.

2. The user then can change is PIN by using an offset: user PIN + offset = natural PIN.

3. Account number and offset are stored in the card.

4. The ATM knows the PIN key (wich is a shared key common to all the ATMs system of a certain bank) and when a card is inserted the ATM calculates the natural PIN from the account number. Then it verifies the PIN number: if user PIN = natural PIN + offset then SUCCESS

[ Parent | on HN ]