In many countries, EMV is used to prevent credit and debit cards being cloned. But given that it's possible to perform online transactions using the details printed on the card, how does it add security?
4
-
A security measure can be broad or narrow; less information is needed for a card present transaction. While not required most online websites will ask for additional information for the verification which may be harder to get. It is reasonable to expect different solution sets for online and offline.– Eric GCommented May 6, 2014 at 18:32
-
@Eric: The forms I've seen don't ask for anything not written on the card. e.g. i.sstatic.net/UaDcu.png– GelatinCommented May 6, 2014 at 18:38
-
your billing address is on your credit card? The merchant can submit this information - if it doesn't match, they can deny it. If you have the physical card, you may be able to obtain some of this information in the cloning process, but if you just copied down the numbers you would have to get this info someplace else.– Eric GCommented May 6, 2014 at 19:04
-
As an aside, there are a lot of improvements which can be made to EMV - step in the right direction, but not enough.– Eric GCommented May 6, 2014 at 19:43
Add a comment
|
2 Answers
Thats what the VbV and Mastercard SecureCode solutions are for (also known as 3D Secure)
With merchants that implement these solutions, a secondary password, or a OTP is required to complete the transaction. This secondary password\OTP is entered on the banks site and not on the merchants site.
This PDF describes the system (and its limitations)
EMV was designed to improve the security of card present transactions (i.e. physical purchases and ATM withdrawals) and to prevent magnetic stripe card skimming.
It's unfortunate that card not present transactions can still be performed using only information printed on the card.
As Akash has mentioned in his answer, there are solutions to that problem, but they are a long way from being universally implemented.
