Community

It has been known for thieves to take the genuine card, use it and return it, unnoticed by the rightfull owner. If the bank has security cameras this may be checked.

The IBM idea is not related to OTP, except that it replaces it. In the IBM scenario the device displays important elements of the transaction, such as the amount or the beneficiary, which are authenticated cryptographically between the device and the bank without the user's PC being involved. This means that malware and other attacks (MITM - man in the middle - in the IBM description) cannot change these elements.

"We're mobile phone salesmen, you can trust us".

Why do you think the mobile phone, which uses the same technology as EMV but with less robust crypto, would provide better security?

If the transaction is online, the card cannot be cloned.

With the present state of the technology there is no justification for offline any more.

And the "track 2" information from the chip should be useable magnetically. This has been known and possible for many years.

In the EMV specifications, see Book 3, clause 10.5, Cardholder Verification, and appendix C3, Cardholder Verification Rule Format. There are X and Y amounts, and a condition code that says how they are to be used.

1. Under the current scheme, shops are indeed required to get the PIN if the card indicates so, but may waive the requirement at their own risk. Doing so is not going against any rule.

2. I was suggesting that the rules ought to be changed, and a floor limit established for using the PIN. The EMV specifications do allow this, but the brands and the banks chose not to use this feature.

With an EMV card, the card number is not enough. You need to obtain a cryptographic signature from the card to get an approval.

With EMV you do not need to protect card numbers for card present transactions, and for card not present anyhow the bank and the cardholder have limited liability.

The need to protect card number, and the cost involved, could be saved with EMV.

EMV is not relevant to PIN security at the ATM, as the EMV enabled ATMs use "online PIN".

On the other hand, using the PIN for low value transactions unnecessarily exposes it to various scams.