[Symbiote]

> Card can be duplicated with the strip and without the chip, then used as a regular legacy card (until those become uncommon).

I don't think so. The card reader would demand that the chip be used. If there's no chip, the cashier should then call the police, as that's evidence of fraud.

[chipperyman573]

If there's no chip, do you really think a cashier would call the police? The cashier would assume the reader is broken, stick the card (without a chip) in the chip reader 3 times to force a swipe and apologise for a "broken reader"

[ThisIs_MyName]

True enough, but most of my chip cards will not work with the mag strip if the card reader supports chip. If I slide the card, I get a message on the POS screen telling me to use the chip.

The guy who steals my mag stripe has to find a store without chip readers to make use of the stripe.

[cplease]

> The guy who steals my mag stripe has to find a store without chip readers to make use of the stripe.

Like 90% of stores in USA today? Oh the pain. And what is likely to happen after the clerk apologizes for the reader being broken is that he keys in the card number manually. What, manual entry is going to be blocked too? Good luck with that. As long as lost sales to nonworking transactions >>> fraud, it's happening.

Edit, source, Krebs: http://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no...

In February, Visa claims all of 17% of retailers have chip-capable terminals. My experience is that only a small fraction of chip-capable terminals are actually integrated with a POS system that enables them. Leading to the ridiculous situation of consumers facing 83% of retail locations with no chip reader, having to swipe, most of the rest having a useless chip slot and icon, and some small percentage <10% of locations actually having a working, functional chip slot (visually indistinguable from nonfunctional ones). Even where they do work, usability is poor. Beeps, lights, multitudinous prompts or even spoken instructions, and processing times in excess of five seconds or more where the stripes are just swipe and sign a second or two later.

[chipperyman573]

On one of my old cards, the chip broke (physically). On every single reader I used, putting the side without a chip in the reader 3 times would allow me to swipe.

[terinjokes]

With how slow this roll out is, I fear the thief won't be able to find any stores accepting a chip, even if they tried.

[clinta]

The indicator that tells the machine that "This card is a chip card" is a single bit on the mag stripe. Turn that bit off when cloning the card and the machine never knows it should have asked for a chip.

[Symbiote]

Hmm, I'd assumed it was known by the card's first few numbers, or similar, but you're correct.

I've had chip cards since 2004, and their use here is universal. To swipe without raising suspicion requires an American accent. It's no problem in McDonald's, but any expensive purchase will either be denied by the clerk, require the manager's approval, or a phone call to the card processor. Criminals simply don't do it any more -- it's far easier to send stolen numbers to the USA, or make purchases online.