Crack the PIN

re: Crack the PIN

Slav — Fri, 20 Apr 2007 00:55:50 GMT

Ken, the issue is that fraud monitoring systems are implemented at the issuer bank, but PIN validation is sometimes done by Visa/Mastercard (esp. for smaller banks and credit unions) - before transaction is sent to the issuer. The fraud monitoring system will flag your card and account if you make purchase in Sydney and Istanbul within a hour; but not necessarily if you try to validate PIN.

And then there are integration issues: the fraud monitoring system may not automatically put the card on the stop-list.

re: Crack the PIN

Ken Schaefer — Thu, 19 Apr 2007 13:32:17 GMT

Hi Slav,

You probably know more about this than me (since you work for a bank), but I remember reading in Bruce Schneier's "Secrets and Lies" book that bank ATM networks are able to detect the use of the same card across multiple ATM machines (basically to prevent someone "skimming" a card and then using a cloned card at a nearby ATM). In that case, a bank's ATM netwok would be able to detect the near simultaneous use of the same card across multiple ATMs, especially in a geographically dispered manner.