Re:MagSpoof: Wireless Magstrip Spoofer
by Loggie on Saturday December 03, 2022 @03:22PM
(#33846922)
Although you can disable the bits in the service code pertaining to the cards ICC capabilities, in theory there's a good chance that the track2 equivalent data on the chip is different from the track2 data on the magstrip. That would make it easy for the issuer to determine that the track2 has been modified and reject the transaction and/or flag the account for fraudulent activity.
[ Parent
| on HN ]
Re:MagSpoof: Wireless Magstrip Spoofer
by Scoundreller on Saturday December 03, 2022 @04:01PM
(#33847321)
Yeah, whenever I try to swipe my card, it instantly tells me to use Chip and PIN. I think it's just to provide rapid localized responses, but who knows if some banks are misconfigured and overly trusted the magstripe data to block magstripe transactions.
Re:MagSpoof: Wireless Magstrip Spoofer
by ComputerGuru on Saturday December 03, 2022 @04:12PM
(#33847406)
But that's what's covered in the article. The "block transaction and require chip and PIN" flag is stored on the magtrack itself.
The bank/processor also knows it and is able to reject any modifications. Whether they do is a matter of their security posture.
Re:MagSpoof: Wireless Magstrip Spoofer
by ImPostingOnHN on Sunday December 04, 2022 @03:10AM
(#33851649)
the article covers that too, saying that the issuer does not seem to do such verification