EMV Cards Decrease In-Person Fraud But Still Aren't 100% Secure

In a time long ago, there were a couple of very large data breaches. You may remember them: Target and Home Depot. Way back then, in 2015, the payment cards customers used at point-of-sale (POS) systems at these places and everywhere else in the United States required swiping a card, so the machine could read the magnetic strip on the back. Well, as is now well known, it’s not so hard for cyberthieves to recreate cards and use them to make their own purchases when they can get all the needed data from hacking into a location and just taking it.

After those biggies, the U.S. government started pressuring card issuers to provide EMV (Europay, MasterCard, Visa) chip cards to consumers for added protection. While the adoption rate was initially slow, according to statistics from Visa, EMV adoption is up to 2.7 million stores as of December 2017 and accounts for 59% of all U.S. storefronts. That’s an increase from 392,000 stores in September of 2015.

An even bigger benefit is that it has reduced payment card fraud by a whopping 70% in a little over two years. The number of EMV cards in use increased in the same timeframe from 159 million to over 481 million.

But while the EMV cards are more secure they are not 100% safe. The FBI warned users in 2015 that while it’s more difficult for these to be counterfeited, the risk of card-not-present (CNP) fraud is more prevalent. This refers to situations where the details from the cards are stolen and used to make purchases online. All the fraudster needs are the name, expiration date, and the verification code to do this.

Security firms are warning that malware can make it onto systems that run the online stores where it can steal payment card information when it’s entered into the payment pages on websites.

In addition to this risk, a different type of fraud is now being seen called account takeover (ATO) attacks. The cybercriminals are using passwords they gain in other ways to get access to online accounts and go shopping.

Password reuse is no laughing matter. The criminals will use login names and password combinations over and over until they are successful. The ones doing the ATO crimes may not even be the ones that stole the passwords in the first place. Often, very large lists of them can be found on the dark web. They use a brute-force type of attack called “credential-stuffing” to perform tests en masse using the stolen information.

So always use unique login credentials for online sites. It doesn’t matter what the site is for. It can be a financial site, a gaming site, or even just a blogger’s site where no sensitive information may be held. They should each have unique passwords so that a thief isn’t successful when they are performing these password reuse attacks.

And the guidelines for strong passwords always apply:

• Use at least eight characters

• Don’t use known information in them such as birthdates of people you know

• No dictionary words or names

• Use upper and lower case letters, numbers, and special characters

• Change them on a regular basis. Don’t leave them the same for years on end. That's just asking for trouble.