The research paper seems to grossly oversimplify the matter of "cashing in" the fraudulent transactions.
While the authors claim to "appreciate that banks will have a number of security systems in place to prevent fraud", they seem to neglect that those systems should effectively render the attack impossible:
- There are limits for CVM-less transactions; not only in the application running on the chip, but also for terminals. I think that there is one limit above which a CVM (e.g. PIN or signature) is required, and another limit for offline authorizations. CVM-less high-vale transactions would not only be suspicious, but even non-compliant for most card schemes.
- It is not trivial to apply for a merchant account, and I guess that a new account would not be allowed to immediately withdraw recently acquired funds. (If it were that simple, magnetic stripe card skimmers could simply apply for a merchant account and avoid all the hassle with PIN skimming, finding vulnerable merchants or ATMs etc.)
- A merchant with a higher than average rate of transactions challenged by cardholders will surely be scrutinized even more closely.
All in all, the implemented failure mode of offline-authorizing all transactions in unknown currencies seems like a really bad idea and should be improved. The rest of the paper seems like speculation, though.
(Compare e.g. to Steven J Murdoch's work ("Chip and PIN is broken" etc.), where the claims have been verified with an actual payment terminal.)
Comments
The research paper seems to grossly oversimplify the matter of "cashing in" the fraudulent transactions.
While the authors claim to "appreciate that banks will have a number of security systems in place to prevent fraud", they seem to neglect that those systems should effectively render the attack impossible:
- There are limits for CVM-less transactions; not only in the application running on the chip, but also for terminals. I think that there is one limit above which a CVM (e.g. PIN or signature) is required, and another limit for offline authorizations. CVM-less high-vale transactions would not only be suspicious, but even non-compliant for most card schemes.
- It is not trivial to apply for a merchant account, and I guess that a new account would not be allowed to immediately withdraw recently acquired funds. (If it were that simple, magnetic stripe card skimmers could simply apply for a merchant account and avoid all the hassle with PIN skimming, finding vulnerable merchants or ATMs etc.)
- A merchant with a higher than average rate of transactions challenged by cardholders will surely be scrutinized even more closely.
All in all, the implemented failure mode of offline-authorizing all transactions in unknown currencies seems like a really bad idea and should be improved. The rest of the paper seems like speculation, though.
(Compare e.g. to Steven J Murdoch's work ("Chip and PIN is broken" etc.), where the claims have been verified with an actual payment terminal.)