News

Researchers find security flaw in chip-and-PIN payment system

February 14, 2010

The United Kingdom's Retail Week reports that researchers at Cambridge University have tricked a chip-and-PIN payment system into authenticating a payment when no valid PIN is present.

The exploit uses what is called a "man-in-the-middle" attack, which involves the thief having a second card-reader nearby, in a backpack.

The fraudster puts the stolen credit or debit card into the shop's reader but then the second reader sends a ‘PIN okay' signal to the shop terminal. The shop terminal sends back a transaction go-ahead signal to the terminal with the stolen card and money is taken off it.