Researchers describe how attackers can sidestep security features of chip-based credit and debit cards from certain banks to create counterfeit cards
Chip-based credit and debit cards are designed to make it infeasible for skimming devices or malware to clone your card when you pay … Source: Cyber R&D Lab .
Context & Ripple Effects
The chip on a credit or debit card exists to make cloning infeasible, but this Cyber R&D Lab work reported by Krebs on Security adds to a string of findings that the protection holds only when banks implement it correctly. Researchers had already shown at Black Hat that PIN pads and ATMs could be manipulated despite chip cards, and by 2019 the [[a:937439|Secret Service was warning about thieves carrying multiple counterfeit chip cards on Fuze smart cards]] without detection.
What is new here is the mechanism: rather than attacking terminals, researchers describe sidestepping the chip security features of cards from certain banks directly — meaning the weakness sits with specific issuers' implementations, not the standard as a whole.
First-order effects
- Customers of the banks whose card configurations fall to the technique face renewed counterfeit-fraud exposure that the chip transition was supposed to have closed off.
- The named issuers' chip implementations become the weak link in their networks, putting the burden on them to fix card-side behavior rather than on merchants or terminal makers.
Second-order effects
- Issuers whose cards hold up can use the contrast in marketing and risk pricing, while vulnerable banks face pressure to reissue or remotely update card software before counterfeit rings adapt the method.
- Terminal and mobile-reader vendors — already under scrutiny after [[a:932359|researchers found Bluetooth and app-based manipulation bugs in Square, SumUp, iZettle, and PayPal readers]] — will be asked whether combined card-and-terminal attacks defeat defenses neither side covers alone.
Third-order effects
- If bank-by-bank implementation gaps keep surfacing, EMV's promise shifts from 'the chip prevents cloning' to 'the chip prevents cloning only where the issuer got it right,' fragmenting fraud risk across issuers and pushing regulators and networks toward mandatory conformance testing.
- Payment security increasingly becomes an arms race between researcher disclosure and criminal tooling, with each published bypass feeding the next generation of counterfeit kits like the Fuze card.
The trend: Four years after chip cards became widespread, payment-card security is being exposed as implementation-dependent, with researchers repeatedly finding that individual banks' and vendors' choices — not the chip standard — determine whether cloning works.