New Fraud Tactic: Non-EMV Transactions Pretending To Be EMV

Here’s a cyberthief twist. Thieves are routing bogus transactions through Brazil and are riding under the cover of EMV. The twist? “They were all submitted through Visa and MasterCard‘s networks as chip-enabled transactions, even though the banks that issued the cards in question haven’t even yet begun sending customers chip-enabled cards,” according to a report Monday (Oct. 27) from Krebs On Security.

“The most frustrating aspect of these unauthorized charges? They’re far harder for the bank to dispute. Banks usually end up eating the cost of fraud from unauthorized transactions when scammers counterfeit and use stolen credit cards. Even so, a bank may be able to recover some of that loss through dispute mechanisms set up by Visa and MasterCard, as long as the bank can show that the fraud was the result of a breach at a specific merchant, in this case Home Depot,” the story reported. “However, banks are responsible for all of the fraud costs that occur from any fraudulent use of their customers’ chip-enabled credit/debit cards — even fraudulent charges disguised as these pseudo-chip transactions.”

The story spoke a small financial institution in New England that had “battled some $120,000 in fraudulent charges from Brazilian stores in less than two days beginning last week. The bank managed to block $80,000 of those fraudulent charges, but the bank’s processor, which approves incoming transactions when the bank’s core systems are offline, let through the other $40,000. All of the transactions were debit charges, and all came across MasterCard’s network looking to MasterCard like chip transactions without a PIN. The fraud expert with the New England bank said the institution had decided against reissuing customer cards that were potentially compromised in the five-month breach at Home Depot, mainly because that would mean reissuing a sizable chunk of the bank’s overall card base and because the bank had until that point seen virtually no fraud on the accounts. ‘We saw very low penetration rates on our Home Depot cards, so we didn’t do a mass reissue,’ the expert said. ‘And then in one day we matched a month’s worth of fraud on those cards thanks to these charges from Brazil.'”

After MasterCard initially insisted that the cards were EMV cards—until the bank proved it hadn’t issued any yet—the card brand relented.  MasterCard officials then told the financial institution that “the most likely explanation was that fraudsters were pushing regular magnetic stripe transactions through the card network as EMV purchases using a technique known as a ‘replay’ attack. According to the bank, MasterCard officials explained that the thieves were probably in control of a payment terminal and had the ability to manipulate data fields for transactions put through that terminal. After capturing traffic from a real EMV-based chip card transaction, the thieves could insert stolen card data into the transaction stream, while modifying the merchant and acquirer bank account on the fly.”