SAN DIEGO -- The U.S. Federal Bureau of Investigation (FBI) recently issued a warning to law enforcement, merchants and consumers that credit cards with the new EMV (Europay MasterCard and Visa) chip can still be the target of fraud. It has since issued an update and clarification that “the new microchip-enabled credit cards may still be vulnerable to exploitation by fraudsters.”
While EMV cards offer enhanced security, the FBI is warning law enforcement, merchants and the general public that no one technology eliminates fraud and cybercriminals will continue to look for opportunities to steal payment information.
With traditional credit cards, the magnetic strip on the back of the card contains static personal information about the cardholder. This information is used to authenticate the card at the point-of-sale (POS) terminal, before the purchase is authorized. When a consumer uses an EMV card at a chip POS terminal, that transaction is protected using the technology in the microchip. Additionally, consumers will be able to continue to use the magnetic strip on the EMV card at retailers who have not yet implemented chip POS terminals. When the card is equipped with a personal identification number (PIN), which is known only to the cardholder and the issuing financial institution, issuers will be able to verify the user’s identity.
Currently, not all EMV cards are issued to consumers with the PIN capability and not all merchant POS terminals can accept PIN entry.
EMV transactions at chip POS terminals provide more security of consumers' personal data than magnetic strip POS transactions. In addition, EMV card transactions transmit data between the merchant and the issuing bank with a special code that is unique to each individual transaction. This provides the cardholder greater security and makes the EMV card less vulnerable to criminal activity while the data is transmitted from the chip enabled POS to the issuing bank.
Although EMV cards provide greater security than traditional magnetic strip cards, an EMV chip does not stop lost and stolen cards from being used in stores, or for online or telephone purchases when the chip is not physically provided to the merchant, referred to as a card-not-present transaction. Additionally, the data on the magnetic strip of an EMV card can still be stolen if the merchant has not upgraded to an EMV terminal and it becomes infected with data-capturing malware.
The FBI is urging consumers to use the EMV feature of their new card wherever merchants accept it to limit the exposure of their sensitive payment data.
And the FBI is encouraging merchants to handle the EMV card and its data with the same security precautions they use for standard credit cards.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.