What? It's even easier in the US. Credit card data is just text. Hook up a magstripe reader to a PIC and go to town (literally hah). People have been doing it for years especially at gas stations and seedy bars where it's too dark to notice/patrons are too drunk to care.
Since US cards are "dumb", the ATM doesn't need to send PIN information to it. The ATM card # can be stolen, however, that's not enough to complete the transaction.
Talking about old mag stripe card, the system used to authenticate the transaction is this:
1. The account number is crypted in DES (ora a variant) with a PIN key, the cryptogram is then decimalized and the first 4-5 digit extracted to obtain the so-called natural PIN.
2. The user then can change is PIN by using an offset: user PIN + offset = natural PIN.
3. Account number and offset are stored in the card.
4. The ATM knows the PIN key (wich is a shared key common to all the ATMs system of a certain bank) and when a card is inserted the ATM calculates the natural PIN from the account number.
Then it verifies the PIN number:
if user PIN = natural PIN + offset then SUCCESS
Comments
What? It's even easier in the US. Credit card data is just text. Hook up a magstripe reader to a PIC and go to town (literally hah). People have been doing it for years especially at gas stations and seedy bars where it's too dark to notice/patrons are too drunk to care.
http://www.identitytheft.com/article/identity_theft_gas_stat...
Since US cards are "dumb", the ATM doesn't need to send PIN information to it. The ATM card # can be stolen, however, that's not enough to complete the transaction.
Talking about old mag stripe card, the system used to authenticate the transaction is this:
1. The account number is crypted in DES (ora a variant) with a PIN key, the cryptogram is then decimalized and the first 4-5 digit extracted to obtain the so-called natural PIN.
2. The user then can change is PIN by using an offset: user PIN + offset = natural PIN.
3. Account number and offset are stored in the card.
4. The ATM knows the PIN key (wich is a shared key common to all the ATMs system of a certain bank) and when a card is inserted the ATM calculates the natural PIN from the account number. Then it verifies the PIN number: if user PIN = natural PIN + offset then SUCCESS