Getting Data
I’ll show you how to do some basic carding, to do so I’m using a small Android application that I build, called NFC EMV Track reader. Using this software, you can extract Track 1 and track 2 from any NFC enabled credit card just by bringing it close to your phone. Depending on the phone you are using the distance between android and the card varies for 0 cm to 3 cm. It will display the exact data to be encoded.
You can also use another version of this app that runs on windows with a smartcard reader, but the card has to be inserted in the reader.
You can also buy these info’s from suppliers on this site.
Making the physical card
As it is still impossible (as of today) to clone the EMV chip we will use the magstripe. Once you have the track data you use a Magnetic stripe encoder with it’s software to write the data on your card. You should use a chip card, reason being most POS are now using EMV with chip and PIN. But put a transparent scotch tape on the chip terminal, I’ll explain why later.
Testing your new card
Once the magnetic stripe is encoded, it’s time to test it. Find the place with a POS where you can make a test and do a basic purchase transaction. Cashier will input amount etc... on POS you will then insert your card just like you would do with a chip card. Since you have put a scotch tape on terminal, the POS won’t be able to communicate with the chip, and will fallback to a MSR transaction and ask you to swipe your card. You just remove your card and swipe it … the transaction will go thru without asking for a PIN.
To be on the safe side, use a chip card that you own so if the data of the card you encoded is declined you just remove discretely the scotch tape and retry with the chip.
Note : this will not work on Unattended terminal ( ATM, Most Gas pump) as the pin will be ask and Verified by the acquirer instead of the card like on a standard POS.
Depending on how long EMV has been implemented in your country, some providers do not provide the fallback feature after a certain time. Once you identify your target, try the scotch tape on your own card for a small purchase to see if the fallback is enable.
Next time I will be a bit more technical as I will discuss and show you the new generation of EMV skimming device that allows to grab both track data and pin at any POS without any modification. Stay tune
I’ll show you how to do some basic carding, to do so I’m using a small Android application that I build, called NFC EMV Track reader. Using this software, you can extract Track 1 and track 2 from any NFC enabled credit card just by bringing it close to your phone. Depending on the phone you are using the distance between android and the card varies for 0 cm to 3 cm. It will display the exact data to be encoded.
You can also use another version of this app that runs on windows with a smartcard reader, but the card has to be inserted in the reader.
You can also buy these info’s from suppliers on this site.
Making the physical card
As it is still impossible (as of today) to clone the EMV chip we will use the magstripe. Once you have the track data you use a Magnetic stripe encoder with it’s software to write the data on your card. You should use a chip card, reason being most POS are now using EMV with chip and PIN. But put a transparent scotch tape on the chip terminal, I’ll explain why later.
Testing your new card
Once the magnetic stripe is encoded, it’s time to test it. Find the place with a POS where you can make a test and do a basic purchase transaction. Cashier will input amount etc... on POS you will then insert your card just like you would do with a chip card. Since you have put a scotch tape on terminal, the POS won’t be able to communicate with the chip, and will fallback to a MSR transaction and ask you to swipe your card. You just remove your card and swipe it … the transaction will go thru without asking for a PIN.
To be on the safe side, use a chip card that you own so if the data of the card you encoded is declined you just remove discretely the scotch tape and retry with the chip.
Note : this will not work on Unattended terminal ( ATM, Most Gas pump) as the pin will be ask and Verified by the acquirer instead of the card like on a standard POS.
Depending on how long EMV has been implemented in your country, some providers do not provide the fallback feature after a certain time. Once you identify your target, try the scotch tape on your own card for a small purchase to see if the fallback is enable.
Next time I will be a bit more technical as I will discuss and show you the new generation of EMV skimming device that allows to grab both track data and pin at any POS without any modification. Stay tune
