ATM, Debit Card PIN Technology Possibly Compromised

Without PIN technology, there would be no ATM or debit card transactions, period. The encryption technology, which includes PIN blocks to decrypt and re-encrypt user account and transaction information from the point of sale or ATM to the card-issuing financial institution, has become a gold standard for bankers and merchants, rendering the checkbook virtually obsolete aside from mail-in payments and utilities.

Now, however, in the wake of the TJ Maxx credit card theft that compromised more than 40 million accounts and other similar thefts, the PIN technology, which could only ever be compromised in theory, has a few cracks exposed that could cost financial institutions, merchants and account holders hundreds of millions.



The Achilles heel of the PIN technology is located in the PIN blocks where the sensitive information is decrypted and re-encrypted. Previous simulations had made the likely location for data compromise to take place in the financial institution itself, where the information is unencrypted for a time while the financial institution validates the information. Now, thieves have comprised several of these PIN blocks, making it possible for them to find PIN and account numbers without someone skimming data on the inside.

Credit card and check fraud, which in their own right can be difficult to prove and have long wait times for fund reinstatement, pale in comparison to the steps it would to take to prove fraudulent transactions involving debit cards. And, from the merchant and financial institutions’ perspective, deploying entirely new equipment and reinforcing or reconfiguring data transfer could cost hundreds of millions.

The amount of PIN theft cases involving PIN block hacks is still rare and probably hasn’t reached an alarm-worthy phase yet. However, for those concerned about compromised PINs, now might be a good time to reorder a few extra checkbooks.

For more tech news:

AT&T Offers $100,000 Reward for Saboteurs

Newest Conficker Variant Tries to Charge $50 to Remove Itself

Conficker Update: Using P2P to Send Files