Card doesn't even need to leave victims pocket to read it.
You can't make this stuff up.
Card doesn't even need to leave victims pocket to read it.
You can't make this stuff up.
And yes, it is unencrypted in a lot of countries.
There are even apps in the play store for reading them.
Card processes transactions internally, tracks usage limits for offline, etc. Other way you couldn't read transaction history with these android apps. (but I think history access is now restricted and can't be read from new cards)
It pretty much is the same thing as swiping the magnetic stripe.
I've read out the information from the card myself and there are multiple demonstrations of it where they have a more powerful antenna and read it from peoples pockets in their wallets.
It's not, magnetic stripe is dumb data store, EMV transaction does cryptographic authorization on card. If final amount isn't known it performs transaction with some dummy value, but from EMV view it is still transaction.
Maybe it is highly advanced data store that in the end just sends out the secret in plaintext. Doesn't really make a difference though.
Whole point of EMV is that card cannot be cloned, as is trivially done with magnetic stripe card. You can do relay attacks, but this is so cumbersome, with PIN required at higher amounts, that I doubt anyone actually does it in practice.