Chip & PIN Fraud Explained - Computerphile
Vložit
- čas přidán 27. 07. 2024
- We rely on Chip & PIN machines to pay for things in a safe way, so how are they being compromised? Ross Anderson is Professor of Security Engineering at the Computer Laboratory, University of Cambridge.
Man in the Middle Attacks: • Man in the Middle Atta...
AI Worst Case Scenario - Deadly Truth of AI: • Deadly Truth of Genera...
The Problem with JPEG: • The Problem with JPEG ...
/ computerphile
/ computer_phile
This video was filmed and edited by Sean Riley.
Computer Science at the University of Nottingham: bit.ly/nottscomputer
Computerphile is a sister project to Brady Haran's Numberphile. More at www.bradyharan.com
never thought I'd hear the word whorehouse in a computerphile video lol
I know to rewind to double check he just said that. Pretty epic professor.
n it's a place of scientific discovery :)
FOR SCIENCE!
He needs a class on being politically correct and sensitivity training or else he won't be a professor for long...
looks like we have a snowflake!
Anything nightlife or gambling related should be cash-only. Going out for a wild night? Take a couple hundred pounds with you and NO CARD. Spend it all, have fun and when you're out of money, it's time to go home.
+NewFormofSilence That's how smart people actually do it. Especially in Casinos, where it doesn't even have to be fraud for you to get rekt financially
+Stoppi Even better, keep your winnings separate from your initial gamble. Come in with $1000 in your left pocket, and put all your winnings in your right. When the left is empty, go home and count your winnings.
+Joe Mills Of course. Still no reason to lose more than you start out with.
+Joe Mills The amount you get back from most forms of entertainment is exactly zero.
+Stoppi Especially as banks now recognise gambling transactions and factor them into their credit decisions. Spend too much on gambling (even if you win and/or you can afford the loss) bye bye mortgage offer.
"You wouldn't dream of walking into a whorehouse on a Saturday night with 20,000 pounds of cash"
That is EXACTLY what I dream about, sir.
I like you.
It’s not all what’s it’s hyped to be ...
@Mdmchannel True. lol
So long as you *expect* to leave without your money, all's fine :P
@@ryledra6372 Why would I care? In my dreams, I'm a billionaire 250 times over.
"Cambridge students could do it, but real criminals couldn't." Implying Cambridge students can't be criminals :p
All thanks to on @AnthonyHood telegram he help with bitcoin flips and fresh cc and it work I don't no what I will do without you ....you are the real deal
Also implying that Cambridge students are intelligent/ criminals aren’t lol the countries ran by criminals Ffs
And in the US we're all "It's 2016 time for more security than just a magstripe! Oh the chip is enough security, you can't have a PIN."
+SilentS I laughed at the "in the old days" part too. Yeah, in the US it is perpetually the old days on technology like this. And forget about getting places to support pay-by-phone. The only ones that do force you to use their stupid app instead of the built in apps on iPhone and Android.
+SilentS How is it that when you use the chip on the card the interface on the machine suddenly looks 20 years older. "MASTERCARD AUTHORIZATION IN PROGRESS DO NOT REMOVE CARD"
+SilentS In Australia you just wave your card over the terminal
+Natasha Taylor My german card actually refused to work in Australia. Called my bank and they told me the ATM system in Australia is too insecure won't be able to use it no matter what ...
+SilentS Moving from one flawed system to another flawed system isn't really much of a move. If we're going to upgrade we ought to move to something solid, not just already-broken chip and PIN. We won't even get the benefit of that temporary dip in fraud Europe got when chip and PIN was new.
This was a very, very informative video. Thank you for all of your hard work in putting this together!
Brilliant as always. This youtube channel is becoming my favourite by far.
The thing is, the protocol is overly complicated and has all these fall backs to old knowingly flawed transaction types. There are simple protocols that could be used to stop most these attacks. But on-line verification and no backwards compatibility to things like signature support is needed for them, and the banks like their backwards compatibility way too much.
+Ewan Marshall Exactly, It would work fine if chip and pin was the only transaction method, but the fact that you can still use the mag stripe and sign completely negates the security benefits that chip and pin should have against physical card theft. 2-factor doesn't work if the second factor is optional.
I thought "chip & pin" sounded brilliant until I learned that the keypad is on an external device. At that point, it's already a losing game.
+Ewan Marshall Customers like backwards compatibility, too. Also, one of the design constraints was that the system had to work without network connectivity. That makes things a lot harder to get right as you are lacking one of the routes of authentication which might be possible.
+Garrett Kajmowicz I certainly don't I specifically asked for an online auth only no NFC card from my bank, however, I know it's still vulnerable.
why was I automatically unsubscribe to computerphile? I watch and thumbs up every video :(
+Justin Giglio I don't know, it certainly wasn't our doing - glad you're enjoying the videos >Sean
+Justin Giglio it's a visual youtube bug and can happen with every channel.
+Justin Giglio Someone hacked your PIN and unsubscribed you. Better check your bank account!
that's not funny, i'm telling my mom on you!
CZcams automatically unsubs me from channels too :/
Ha! I live in Vilnius. So far I've never heard of/encountered these modified devices. But thanks for the heads up, the whole topic is quite interesting actually, wouldn't mind a followup.
The problem is the pin when entered should be encrypted and sent to the bank with the encrypted chip info as separate channels. At no time should the Pin open up the chip at the terminal.
All thanks to on @AnthonyHood telegram he help with bitcoin flips and fresh cc and it work I don't no what I will do without you ....you are the real deal
I love listening to this guy talk, I think he would make a great teacher. I learn alot, this is so interesting to me. :)
I'm just enjoying looking at the books he has in the background - a very interesting collection.
Please do more episodes like this. loved it
This is very interesting. Thank you for publishing this!
Is this different than the chip and signature we're rolling out in the US now? From what I understood of the US systems, the chip doesn't actually pass your card number but rather a unique payment code that's cryptographically derived from your card number, the merchant ID, and your transaction counter (which gets incremented each time to prevent replay attacks). I was under the impression that this was done inside the chip which prevents MITM attacks. The examples he was giving seemed to date back a decade so I'm not sure if still applies to current day cards (namely in the US). Can anyone shed light on this?
This was great! How about another video about RFID technology?
Go shop with @Discovercirculation on telegram he is the best he has been helping me with card for about three months 100%
Best advice I've heard for combating this from Linus on the WAN Show: give yourself a low limit. People can't steal $10,000 from your card if your card only allows you to spend $500 at a time. "Well what if I need to spend $10,000!" Then you can just put more money on BEFORE you spend it, you silly goof!
I've joked with friends about this before. I'm a broke student, so I have exactly one credit card with a $500 limit on it, and one debit card that I keep about $100 on at any given time (the rest are in a savings account). Whoever robs me can fun not even making a month's rent 😆
...and here I thought the little gold chip in my debit card was supposed to be more secure than the black stripe but it sounds like it's actually less. Or did I misunderstand?
would love to see a similar video on "tap" (NFC) fraud via wireless
. . . and this is why you should always use end to end encryption and best practices for security, rather than trying to roll your own system. It is so easy to mess up security if you make a mistake and didn't think of something. Sad to see that a man in the middle attack is so easy with chip & PIN.
+logicalfundy But encryption would mean that terrorists will *something something*!!! Whatever the FBI is peddling that day.
I don't have much knowledge in chip and pin machines, but I thought that encryption from terminal to provider does take place, only after the terminal completes creates a transaction and then is ready to send transaction details to the provider. So I thought it was the last step, but because of that, it's really easy to catch data before.
Since 2003? We're just now VERY recently starting to get chips here where I live in USA.
Not so speedy then are you? Do you have contactless? ;)
Victor Tran America is speedy but we get complacent
They've been in Europe for a long time. The technology has had plenty of time to be hacked.
Victor, depends, some chains have it, some don't
USA is SO BEHIND on this tech.
I'm taking an IT class at my high school. This channel inspired me!!!
All thanks to on @AnthonyHood telegram he help with bitcoin flips and fresh cc and it work I don't no what I will do without you ....you are the real deal 😘
Why are authorization codes from chip+signature compatible with chip+pin protocol? Or did I miss something from that explaination at 4:45?
Superb video guys. Keep it up
Oh my gosh, this is eye-opening!
So what are the mitigations around NFC relaying. It seems like they are just as vulnerable as chips, unless there are some workarounds using maximum latency. I would assume they are fairly lucrative as they do not require PIN number under certain amount of purchase.
This is the best youtube channel !! For real !!
7:20 This is why you should always get the receipt for absolutely everything every time and KEEP IT. At least then you have proof that you've been lied to.
Fuzzballfox Onionring to be honest, if the criminals can manipulate the terminal to show small numbers but make big transactions, they should be capable to print you fake receipts. 😐
Eemeli Saarelainen but they can't print 50 pounds on the receipt when they charge you 5000.... It would be proof that they are criminals
Only hoarders keep that many receipts
But they could print 5000 pounds and you'd have no way of complaining anyway.
thats why the receipts are on thermopaper which turns blank. The banks are actively supporting the fraudsters and fighting law abiding customers
Great video, I just wish he had covered his ideal solution or fixes to these attacks... or perhaps what the future holds. (Part 2??)
In other words: if you go to the club, use cash :)
+Yannique1 Well, frankly, I don't understand why people don't use cash all the time. For many reasons:
1) I don't want the bank (or gov, or hacker, or ...) to know where and what I shop for
2) I am not a huge fan of getting my card info stolen
I always just get the cash from the ATM and use it how ever I like. I've used the credit cards only a few times (outside of ATMs), when I misjudged how much cash I'd need.
+Филип Брчић Well, I'm not a huge fan of having cash with me which can easily be stolen or that I could loose. If my card gets stolen or I loose it, I can just block it and get a new one.
+Филип Брчић You are still tracked when you cash out with your simple debit. If you are using constant locations then they map use quite easily. Also today they can get easy meta-data with social networks and websites like CZcams. So they kind of know where you are pulling out money from (which ATMs in what locations) but less about the shopping, yes.
Alexandru Gheorghe
Yes, of course. But they don't know if I buy pink underwear, beer or new shoes, nor do they know where I lunch nor what.
Филип Брчић
Definitely. Except if you want to buy off the web, then you are in "trouble" :-)
Great video. Very informative.
Love uni. Of Nottingham !
Where can I find an article that talks about the fraud that happened between Dubai, Karachi and the UK?
What about the dangers of these machines that you can just hold your card against and it will do the transaction without even needing a PIN. I would love to learn more about those machines. I find them... scary
Is there a link to the story Ross mentions between 3:08 - 3:45?
And what about the contactless payment skimming that is now going on as well?
Will mobile payments solve many of these problems? I've used mobile payments whenever I can for the past 2 years or so, but I have just moved to Samsung Pay which is, besides NFC, compatible with mag-stripe and chip-and-pin terminals.
A pseudo card number and tokenization would be more difficult to forge, right? I have difficulty thinking of ways to forge the pseudo card and tokenization method.
Eh.. I prefer Fish and Cushion tbh.
hahahahha high five!
**is high five**
+a flock of sea-cows, esquire :D
I see what you did there.
i only clicked on this video to make exactly the same comment! It appears I wasn't quick enough
Shim -- A washer or thin strip of material used to align parts, make them fit, or reduce wear (Oxford)
The funny thing about the last attack he mentioned, you can always refute the charges if you ask for a receipt. It's not likely the evil verification boxes are going to print out a receipt that shows the charges being fed to the bank. Either way, they're hosed.
I remember when I was in the military they would warn us about these relays at ATM's and how to spot counterfeiting hardware. Now that I know what's possible it freaks me out everytime I use an ATM. Plus, many credit cards now have the chips but not all stores are required to operate using those chips. As long as that is possible, counterfeiting will remain fairly easy - despite these sophisticated chips.
Wow! So how do you get around this? Is there any way of ensuring you don't get had? Does Ross use a card?
want to know more about designing protocols from security standpoint, thanks.
are pay by phone more secure or less...
like how easy is it for someone to clone your phone sim-card and other unique information sent by your phone when making a purchase.
Wasn't aware of these more than "check the sum on the machine and always demand a receipt" and "watch the atm for suspicious devices/components". Of course then came the proximity "swipe" transaction or whatever and people were just scanned from their pockets in night clubs.
Well, it seems as if there's not much, if any advantage over a magstripe. Is there any solution other than simply not owning one?
Can we have a video about those slim shims? Those sound cool on their own!
Very good and informative video.
Is Apple Pay with a credit or debit card on a iPhone safer than using the physical debit card as it’s a new technology or is it just a vulnerable?
how about using a phone like samsung pay, apple pay and android pay etc are they safe?
I take from this that there could go *a lot* more work into ensuring that the EC-technologies they want to throw onto the market are actually somewhat safe. Though they still keep messing it up again and again.
please make more videos about security frauds and stuff alike.
With due respect to the professor, he's completely, utterly missing the main point of why EMV/chip-card authentication is an important step forward over using magnetic stripes to do transactions.. Which is simply this: To pull off the attacks he describes against chip cards a bad guy has to physically alter the merchant's reader/terminal that talks to the chip on the card. On the other hand, with the way that magnetic stripe cards are still processed by many merchants today a bad guy that can hack into a store's Point-of-Sale machines can steal your credit/debit card info remotely, from anywhere in the world. Which is exactly how the huge breaches at Target, Home Depot, Kmart, and many other retailers here in the U.S. over the past few years happened.
uniquelycommon exactly the way they're doing it at bank atms while parked in lot they receive your card info via Bluetooth .
uniquelycommon He is not saying it's bad. He's just saying how people commit fraud with the new systems.
uniquelycommon sounds like u know how to do it
Would mobile payments like Android and Apple Pay be more or less secure?
A 'shim' is a very thin piece of material that is inserted to make very fine adjustments to positioning. It's got nothing to do with shimmying as in dancing.
it makes very fine adjustments to electron positioning
oh and it also measures your camshaft rocker arm clearances.
Clever tactics used. I tend to use cash where it's an unknown place. Who knew these terminals would be dodgy from manufacturer (like text your details to Karachi).
Russia and North Korea are basically sovereign states that at least partially support themselves through crime. The prevention measures against most crimes of counterfeiting, hacking, etc. are often based on the idea that the person you're combating is some punk kid on the street. It would be too costly for that kid to source linen paper and manufacture cash with watermarks and metal strips and stuff. But Russia has put people on the Moon and has professional spies with the newest equipment. If they want to grift the European nations, it's purely a matter of deciding to do so. The technical abilities to make the devices, determine where the originals are being manufactured, and infiltrate those locations is not beyond their reach.
Whether that's the case in these instances, I don't know. But drug cartels, for example, are making billions of dollars a year, which puts them well in the NASA spending range. They can certainly put some R&D investment into developing out further criminal sources of money.
This is why I always use Western Union to wire money to people that I don't know.
The Hoax Hotel And this is also why mobile wallets such as Apple Pay, Samsung Pay, etc are safer than chip cards. Instead of the actual card number, they transmit to the terminal a different number assigned to the specific device being used along with authentication information so that the charge will only be approved if the actual device linked to the transmitted “card number” is being used to make the purchase. Otherwise, the transaction will be declined.
Plus the limit of £30 per transaction make it a lot harder to withdraw massive amounts of money so work to deter people from even bothering to try to find a way of forging it.
GoOhmGaming The £30 or €30 limit only applies in the UK and Europe, though, because contactless payments there are processed without requiring authentication from the customer. No such limits exist for nfc contactless payments in the US, where all payments require authentication regardless of the amount, either via signature or more recently electronically, just like regular card payments always have.
Luigi A Oh thats cool to know. Cheers for enlightening me :)
I only accept chip cards when ubering the zamboni
Great video, very interesting
I got a new card...from now I use cash internationally and shady small-store businesses. 300 dollars gone from my account at an atm machine from another state in the U.S. And I still had possession of my card. This video made me more aware that there are smart criminals out there. Thank you.
You don't even need that these days thanks to PayWave. Now all you need is a wireless POS machine registered to a company called something like "administrative fee", program the machine to withdraw a small amount, like a couple of pounds, then walk through a train passing it near people's pockets and handbags. You can do that to hundreds of people in a day, make thousands of bucks and when people check their bank statements (if they even bother to check their bank statements) all they see is a tiny transaction labelled "administrative fee" and think nothing of it.
You’d have to get the device real close to people’s pockets or handbags to do that. Paywave and other contactless payments use nfc, which can’t transmit or receive information at a distance greater than about 5 cm (plus, in countries such as the US or Mexico there are hardly any contactless cards). It would be really hard to do what you describe without being noticed. What the thieves normally use is an RFID device, which will work at a greater distance (several meters maybe) and will read card information from the magnetic stripes on people’s cards, not from the nfc chips inside them.
What about the "pay-wave" wireless card technology any fraud there we should be worried about?
The one thing I don't understand is...
Isn't every issue he mentioned also an issue with magnetic stripe transactions?
- [ ] Wow just got my fresh BTC from @Darkbolt1 what of 5k on telegram his the only legit vendor that sell cc and dumps I got some from him.......guys make sure you deal with him.......thanks so much bro 💯💯
Oh, nice to know that he had some experience in Vilnius Lithuania, my town :D
All thanks to on @AnthonyHood telegram he help with bitcoin flips and fresh cc and it work I don't no what I will do without you ....you are the real deal 😘
Would it not make sense to eliminate chip and signature entirely to prevent some of this?
Dylan Taylor No. Bank managers and there buddies need an effortless way to get rich in America. Thats how the economy works kid.
I though Chip & PIN was a UK bank association name created after the initial issuance of EMV cards without PIN as a PIN marketing education campaign. Isn`t the global name of the chip card technology specified by the EMVCo consortium, for its payment network members really EMV. And Chip & PIN just a local terminology used in the UK?
Also I thought chip cards leveraging PIN authentication were globally issued since early 90s in countries like France before UK adopted them with the EMV standard at the turn of the century?
Thanks for your analysis on EMV fraud issues.
cool to highlight the problems. solutions would be nice though too :D
Very interesting. What is Apple Pay going to change about this in your opinion? Is it going to be more safe or are there different ways to hack Apple Pay? Looking forward to your answer Brady and Mr. Anderson.
Man... I really want to be as knowledgeable as this guy some day.
well, they sort of ban mythbuster do an episode on this right?
Where I work (most transactions >£100) the card machines reject swipe unless the chip can't be read properly, if you stick the card in the wrong way 3 times it'll automatically switch and ask the customer to swipe it. Really easy to do low-key. Not quite as advanced as the methods in the video but it's pretty scary to think that somebody could pick up my card off the floor and rack up £1000's (assuming I wasn't broke lol) with little more than a few seconds fiddling, before I even knew I'd lost it.
So… what's the solution? If one can't trust hardware, and one can't trust a bank to have my back, what's to do? My bank doesn't even have the chip. The store I work at doesn't take chips. Should I be shopping only at places that take Apple Pay?
MORE from this guy!!!!!
I have always found it strange, that here in Germany, there is no way a cash machine would give you a receipt of the amount you just withdrew from your bank account.
There is no paper and no print function in the cash machine anyway here.
Whereas in all the other countries that I visited (UK Spain Netherlands Poland etc) I automatically got a printout of the amount withdrawn.
Slim Shim (two sided flexible sim card with which both sims can sit in the one phone), that then sits between the card reader and the bank card (rigged to lie to both).... what a literal man-in-the-middle attack.... so literal.
Nice simple and clear.
Which one is safer? NFC or chip n pin?
Pretty impressive book collection
That is all I could see
@josefsson no not necessarily ; withdrawals can be made if you're using an account from which you can loan money ((names differ by country))
A friend of mine worked at a Taco Bell about 5 years ago. She said the CC machine somehow got stuck on one guy's CC @ the drive through, and every time she swiped someone's CC, this one guy from before's CC info would go through and pay for everyone's order after him. It was like this one guy's CC info got stuck in the memory, and was reactivated every time she swiped a new customer's card. This guy ended up paying for dozens of people's orders before it got noticed!!!!
How to make programs ATM?
what about rfid (nfc)?
Does mobile NFC payments stop a lot of these hacks?
What is the name of the device at 4:36?
did you ever find it
Didn't mention the thermal cameras which record the pin according to the temperature colour on the keys of the machine.
+Tanmay Agrawal ha good luck doing that where im from, its always fookin freezing :)
You can protect yourself from this by pressing random keys after you're done to put heat signatures on incorrect keys
edit: double post, thanks google
+Dave Birney If its freezing then its probably going to be easier for the camera to read the temperature difference.
wasn't there a thing once upon a time where an barlcleys atm was hacked and huge sums of money was stolen? I just started uni in uk, and I still don't know the safest places to cash out...
thanks for the advice!
I wish more people subscribed to this channel.
It's so weird to hear the name of my countries capital (Vilnius) being talked about in chip pin fraud video.
Wait a minute, wait a minute, I thought the whole point of chip cards is that the communication is encrypted? The data sent across the wires that are being tapped with these techniques should not contain the user's information plaintext, it's private-key encrypted and hashed against the clock, so why are these attacks working? Is this an older version of the technology that sends the data plaintext?
I can see how the third example, with the false-card inbetween could work, but that will be fixed in the future as soon as credit card companies get with the times and stop allowing signature transactions. The other two, though, shouldn't be able to work as the technology works right now.
The one thing I thought would be helpful was
Transaction:
machine asks card for bank info
machine reads LAST transaction signature from card
machine gets pin
machine asks bank if card is valid based on info and last transaction; all encrypted to high hell
machine authorizes transaction, and saves new signature to card.
If someone skims it then the card gets burnt when the last transaction doesn't match what the card thinks.
If they man-in-the-middle it can't write the correct signature to the old card.
+frollard how would you burn a card? That would also be highly inconvenient. Also, "encrypted to high hell" - Most encryptions can be broken if needed, especially when money is involved.
Great video.
What happened to the next step in security that was advertised in the early '00's because even in the ,'90's it was known the chips are already defeatable.
And we have plenty of guys on Tube that recommend removing the chips and going back to the swipe, along with a common thing now is doing a triple ( because so many people refuse to wait the 5-10 seconds, before putting a chip card in to give the cashier time to use the program to make ready for the card. They jump ahead, while things are still being rung in, as fast as possible, slip the card in, and get angry that the transaction isn't completed the very moment a last item is scanned. So we then have to do the 'triple'. Remove the card, wait, re- insert( wait for the error response), remove, wait, re- insert(..error response), remove, then, swipe,..and the card gets approved. All because people refuse to apply a little patience. And of course, if it's a rigged reader, the bad guys were just now given 4 chances to get info off their cards.
This ( the 'triple')happens over and over again everyday.
Things on their mind, new card( why it's like a new toy, it's remarkable, let's play), just plain immature users..?
CXO blogs list all this stuff we have had for next steps, for years, yet we're still only at chips. What's wrong with the processes applicable on this.
Thanks you skim lord for for having the best with your cc
To be fair to the issuers you should also explain how big data and risk based authentication is being used to combat these techniques of fraud.
But every chip you purchase has a hard coded serial number (read only) hence theoretically cannot be duplicated.
A payment card has form factor of a smartcard.
The chip has the physical interface of a smartcard (I haven't compared, but at least it's very similiar).
So why the hell doesn't it work like a smartcard? I always assumed that when I input a PIN on the keypad with the card inserted, some cryptographic transaction was taking place where the terminal would input hash of the transaction to the card which would sign it when unlocked with a PIN.
But then "contactless" cards came along and I realized it was not even close. You swipe the card (obviously there's at most a pre-shared key to do anything at that point) and then input the PIN without the card present afterwards. What the hell? How's that supposed to help anything?
Any idea why this isn't it implemented like a smartcard? Even for wireless, you could type the PIN, then hold the card over the reader and it could still unlock with PIN and sign - just wirelessly.
Instead there's some obscure insecure-by-design protocol that can never work when you start looking at it even as a user!
I was suspicious of pins right away. If they can steal your magnetic stripe information by swiping your card in an electronic device, why can't they steal the same information stored on a chip the same way?
Yes yes, but where do we GET one of those machines!?
This happened to me in 2014. My card was being used all over southern California when the whole time it was in my possession. Check your bank statements. I went to a motocross track in riverside,ca and i used my card to get gas on the way there. So i think i put my card into one of those devices. Charges showed up after that day. Spread out all over Southern CA. My bank doubted me. I told them how can i be at that many places from riverside,ca to los angeles,ca in less than hour to make purchases.
So isn't Apple/Android/Samsung Pay better than any of this since it creates dummy account #'s during each transaction?
Theoretically, without a doubt. Samsung Pay does have one security flaw that may allow thieves to guess and steal tokens (which expire within 24 hours and are thereafter useless). The keyword is "may". Salvador Mendoza discovered it and notified Samsung who then clarified that it is a risk but a very minimal one and has never been implemented in practice...yet.
...and how it tells you exactly how much was taken out of your account as soon as it is taken out? :)
Until they ditch the SDA protocol its easy money. For under £100 you can purchase the required reader/writer and suitable blank cards, bins etc. Some of the issuers haven't addressed this, because in terms of percentages, the losses caused by use of cloned cards, are relatively very small, whereas implementing cda/dda is costly.