New Hack Lets Attackers Bypass MasterCard PIN by Using Them As Visa Card

Cybersecurity researchers have disclosed a novel attack that could allow criminals to trick a point of sale terminal into transacting with a victim’s Mastercard contactless card while believing it to be a Visa card.

The research, published by a group of academics from the ETH Zurich, builds on a study detailed last September that delved into a PIN bypass attack, permitting bad actors to leverage a victim’s stolen or lost Visa EMV-enabled credit card for making high-value purchases without knowledge of the card’s PIN, and even fool the terminal into accepting unauthentic offline card transactions.

“This is not just a mere card brand mixup but it has critical consequences,” researchers David Basin, Ralf Sasse, and Jorge Toro said. “For example, criminals can use it in combination with the previous attack on Visa to also bypass the PIN for Mastercard cards. The cards of this brand were previously presumed protected by PIN.”

Following responsible disclosure, ETH Zurich researchers said Mastercard implemented defense mechanisms at the network level to thwart such attacks. The findings will be presented at the 30th USENIX Security Symposium in August later this year.

A Card Brand…