Community

Vision Direct say the data was not extracted from the VE database but captured as customers typed the data into the web site.  This could be done by a Javascript keylogger running on the web site activated by a fake Google Analytics script.  

Vision Direct also say that they hold no payment card data, which is held at their payment providers.

Sounds like this is not a PCI-type breach.

The second chip passed through the EMV commands and data between the terminal and genuine chip apart from the command to the chip to verify the PIN.  The terminal generated the VERIFY command correctly but the second chip intercepted this command without forwarding it to the genuine chip. The second chip automatically responded with SW1 SW2='9000' whatever PIN was entered to indicate to advise the terminal that  PIN verification was successful.  The PIN was not exposed in the fraud.

This attack would not be successful in an online environment where the PIN is verified by the issuer.  It would not be successful with Combined Data Authentication (CDA) cards and one would hope that US issuers are not sending out Static Data Authentication (SDA) cards.

If these had been Chip and Signature cards, the fraudsters would not have had to go to all the trouble of transplanting chips from one card to another and attaching second chips.  They could have simply used the stolen cards and signed for the transactions confident that the signature would not be checked thoroughly by the retailer.

Perhaps she will now press for the USA to move to EMV chip cards?