Where Cards Are Stolen

45.0 What this chapter gives you#

1. You will be able to name the five places card details are actually taken — the stripe, the shim, the radio, the breach and the guess — and say which of them still costs anybody real money.
2. You will be able to explain why watching a chip talk to a terminal gets you a used ticket, while reading a magnetic stripe gets you a key that works for ever.
3. You will be able to say why the chip did not make card fraud go away, and point at £423.5 million of remote purchase losses in the United Kingdom in 2025 as the evidence of where it went instead.
4. You will be able to answer somebody worried about contactless in a queue with the actual proportion: £46.8 million of £703.4 million of unauthorised losses, under seven per cent.
5. You will be able to explain why a shim yields far less than a skimmer ever did, and name the issuer-side checks — iCVV, service code, transaction counter, fallback constraint — that decide whether it yields anything at all.
6. You will be able to distinguish a server-side breach from client-side e-skimming, and say why a merchant’s own logs stay clean throughout the second one.
7. You will be able to cite PCI DSS requirements 6.4.3 and 11.6.1, mandatory since 31 March 2025, as the two controls written specifically for payment-page script theft.
8. You will be able to do the enumeration arithmetic — ten million accounts under an eight-digit issuer identification number, sixty expiry dates, a thousand three-digit codes — and explain why centralised counting rather than merchant rate limiting is the fix.
9. You will be able to read the Visa Acquirer Monitoring Program thresholds and say why the enumeration ratio deliberately counts declined authorisations on both sides of the fraction.
10. You will be able to state a United Kingdom cardholder’s legal position under regulations 76 and 77 of the Payment Services Regulations 2017, including the £35 cap and the circumstances that disapply it.

Everything in the four volumes before this one described a system working. This volume describes the same system under attack, and the first thing to establish is that “card fraud” is not one crime. It is at least five, they have almost nothing in common technically, and the defences that stopped the first one did nothing at all about the fifth.

This chapter is the threat model. It is written to be useful to somebody who has to defend a payment system, not to somebody who wants to attack one, and that distinction shapes what is on the page: how each attack works and why each control exists, without the operational detail that would make any of it a recipe. Where a control is mandated by a rulebook or a regulator, the figure and the date are given, and both are marked as accurate at the time of writing, because in this volume more than any other they will move.

The plain version#

Think of your card as a key to a door.

For the first forty years of the card industry, it was a very simple key: a shape stamped into a piece of metal. Anybody who could get a good look at the key could file an identical one. The magnetic stripe on the back of your card is exactly that. It is a strip of iron oxide with your card number, expiry date and a few other details written into it, in the clear, and it never changes. A machine that reads the stripe learns everything it needs to make a stripe that behaves identically. That is why, for decades, the standard card crime was to read stripes and write copies.

Then the industry replaced the key with a locksmith.

The chip in your card is a very small computer with a secret inside it that it will never tell anyone, including you. When you put the card into a machine, the machine does not ask “what is your key”. It asks a question, and the chip writes a short note in reply, sealed using the secret. Crucially, the question is different every time, because the machine throws in a fresh random number, and the chip adds a counter that ticks up on every single transaction it has ever done. So the reply is different every time too.

Copy that reply and you have a note that answers one question that will never be asked again. Watching the conversation between a chip and a machine gets you a used ticket. Watching a magnetic stripe gets you a key.

That single change is why the crime moved.

Where it moved to#

Here are the five places card details are actually taken, in the order they became important.

The first is the stripe. Put a reader over the slot on a cash machine, or run a card through a second reader behind the counter, and you get a perfect copy. This is skimming, and where chips are used properly it is close to dead. The industry’s own numbers show why: EMVCo, the body that owns the chip specification, reports 15.6 billion cards in circulation using its specifications, and that 97 per cent of card-present transactions worldwide are chip transactions, most recently reported as of the fourth quarter of 2025. There is very little stripe left to skim.

The second is a thin device slipped into the slot of a chip reader, sitting between the card’s metal contacts and the machine’s. It is called a shim, and it listens to the conversation. It gets the card number, the expiry date, and a great deal else. What it does not get is the secret. The reply the chip wrote is a used ticket, and so a shim is worth far less than a skimmer ever was.

The third is the radio. A contactless card answers anyone who asks, from a few centimetres away, without a PIN. So the obvious idea is to put one machine near a real card and another machine near a real terminal and pipe the conversation between them, so that a card in a pocket in one place pays for something in another. That is a relay attack. It works in laboratories. It is limited in the world by two things: the radio only reaches centimetres, so somebody has to physically get close to the card, and the terminal times the conversation and gets suspicious if the answers come back late.

The fourth is the one that actually matters now, and it is not clever at all. Break into the shop’s computer, or the payment company’s computer, and take the list. In November and December 2013, attackers who had obtained a supplier’s credentials got inside the American retailer Target and took details for up to 40 million payment cards, along with contact details for up to 70 million more people. No skimmer, no shim, no radio. One break-in, forty million cards.

The modern version of the same idea does not even need to get into the shop. It gets into the shop’s website. A few lines of code slipped into a checkout page will quietly copy what you type into the card fields and send it somewhere else, before it ever reaches the shop. This happened to British Airways in 2018. The Information Commissioner’s Office found the attacker was in a position to access the personal data of approximately 429,612 customers and staff, including the payment card details of around 244,000 customers, and issued a penalty notice of £20 million on 16 October 2020.

The fifth is guessing. A card number is sixteen digits, but the first eight identify the bank, and the last is a check digit calculated from the others. So under one bank’s range there are about ten million possible accounts. An expiry date within the next five years is one of sixty possibilities. The three digits on the back are one of a thousand. Nobody can guess a whole card. But if you already have the number from a breach, you only need the expiry and the three digits, which is sixty thousand combinations, and a machine can try them at a website far faster than a person can. This is called card testing, and the small charity donation page with no shipping address and a five-pound minimum is its favourite target.

What the totals look like#

The Nilson Report, which counts this for the industry, published in January 2026 that worldwide payment card fraud losses were $33.41 billion in 2024, against global card volume of $51.920 trillion. That is 6.43 cents of fraud per $100 spent, down from 6.58 cents the year before.

Six and a half pence in a hundred pounds. Card fraud is enormous in absolute terms and small in proportional terms, and both facts are true at once, which is why arguments about it are so bad-tempered.

In the United Kingdom, UK Finance reported on 15 June 2026 that criminals stole £1.28 billion through payment fraud in 2025. Of that, £703.4 million was unauthorised fraud, meaning transactions the customer never made at all. The breakdown is the point:

Remote purchase fraud, on its own, is more than sixty per cent of all unauthorised card losses. That is card details typed into a website. Contactless, the thing people worry about in queues, is £46.8 million out of £703.4 million: under seven per cent.

The lesson of the plain version is this. The chip did not make card fraud go away. It made one kind of card fraud, the counterfeit card, extremely hard, and everything else moved to the internet, where there is no chip to consult.

Where the plain version stops being true#

“The chip ended counterfeit fraud” is a claim about a control, and controls only work where they are switched on. The Federal Reserve Bank of Kansas City published a research briefing on 12 February 2025, using the Federal Reserve Board’s biennial debit card data, which found that the United States migration to chip cards did not produce a uniform fall in card-present fraud. On dual-message networks the counterfeit fraud rate was 9.0 basis points in 2015, fell to 6.6 in 2017, and was back to 9.1 by 2021. Over the same period the lost-or-stolen rate on those networks rose from 1.6 to 4.5 basis points, and overall card-present fraud rose from 10.1 basis points in 2017 to 14.9 in 2021. Only single-message networks showed the expected pattern, with counterfeit falling from 3.2 basis points in 2015 to 1.7 in 2021. The chip is sound. Its deployment was uneven, its fallback paths were exploitable, and fraud is a fluid: squeeze it and it goes somewhere else in the same container.

The chip protects the reply, not the number. I said the chip never reveals its secret, and that is true. What the chip does reveal, in the clear, on every transaction, is the card number, the expiry date and a block of track-equivalent data. Reading a chip conversation does not let you counterfeit a chip card. It does let you obtain the details that a website will accept. The plain version implies the chip made your card details secret. It did not. It made them non-replayable at a terminal. On a website, where there is no terminal and no cryptogram, they are as useful as they ever were, which is exactly why remote purchase fraud is the largest category in the table above.

Most stolen card data is now not stolen from cards at all, and a growing share is not stolen at all. The dominant modern source is a breached merchant, processor or checkout page, which touches no physical card and no physical terminal. Alongside it, and rising fast, is a category that involves no theft of card data in the conventional sense: the criminal already has the card number and telephones the customer to obtain the one-time passcode, then uses it to provision that card into a digital wallet on their own device. UK Finance’s report of 15 June 2026 names this explicitly as a driver of 2025 losses. The result is a wallet credential that passes every check the network can make, on a device that is not yours. No skimmer, no shim, no breach. An authentication defeat dressed as a card theft.

Relay attacks are famous out of all proportion to their share of losses, and the reason is worth understanding. A relay does not break the cryptography. It borrows it. The issuer receives a genuine cryptogram from a genuine card, correctly computed, correctly verified. Nothing in the message says the card was three hundred miles away. That makes a relay attack unfalsifiable from the issuer’s side and turns the dispute into an evidential argument rather than a technical one, which is what makes it interesting to researchers and to lawyers. It does not make it common. The £46.8 million of contactless fraud UK Finance reported for 2025 is dominated by ordinary use of ordinary stolen cards, not by relays.

“Card data” is not one asset. A PAN alone, a PAN with expiry, a PAN with expiry and CVV2, full track data, a PIN block, and a network token are six different things with six different resale values, six different attack paths and six different controls. Treating them as one category is the single most common analytical error in this field, and it is the reason people build defences in the wrong place.

The technical version#

What lives where on a card#

Three credentials coexist on a typical card, and each fails differently.

The magnetic stripe follows ISO/IEC 7811. Track 1, the IATA track, carries up to 79 alphanumeric characters including the primary account number, cardholder name, expiry date, a three-digit service code and discretionary data. Track 2, the ABA track, carries up to 40 numeric characters: PAN, expiry, service code and discretionary data. The discretionary data contains the card verification value written at personalisation, CVV1 on Visa or CVC1 on Mastercard. The service code matters more than its size suggests: its first digit encodes interchange rules, with values in the 2xx range signalling that the card carries a chip and that the chip must be used where the terminal is capable, and its third digit encodes cardholder verification requirements.

Nothing on the stripe changes. It is a bearer credential in the purest sense.

The chip follows ISO/IEC 7816 for the contact interface and holds an EMV payment application, a set of records read by the terminal, a card private key or shared symmetric keys it never discloses, and an application transaction counter. Among the records is tag 57, track-2 equivalent data, which looks like Track 2 but carries a different verification value in the discretionary field: the integrated circuit card verification value, iCVV. It is deliberately different from CVV1. That difference is the entire defence against turning chip data into a stripe.

The contactless interface follows ISO/IEC 14443, operating at 13.56 MHz with a baseline data rate of 106 kbit/s in each direction, half duplex, over a designed range of a few centimetres. In full EMV contactless mode it produces a cryptogram exactly as the contact interface does. The older magnetic-stripe emulation modes, which produced a dynamic CVV or CVC3 instead, are the modes that most published contactless attacks targeted, and their retirement is a large part of why those attacks have narrowed.

The card-not-present credential is different again: PAN, expiry, and the CVV2, CVC2, CID or CAV2 printed on the card but written into neither the stripe nor the chip. It exists precisely so that stripe or chip data alone is insufficient online.

Finally, the tokenised credential. Under the EMV Payment Tokenisation Specification, a device token or DPAN is provisioned in place of the funding PAN, restricted by domain to a particular device, channel or merchant, and accompanied by a cryptogram of its own. A stolen DPAN outside its domain is inert.

Magnetic stripe cloning, and why the chip ended it#

A stripe clone is a replay attack against a credential with no freshness. The attacker acquires the track data by any means, writes it to a stripe, and presents it. The issuer sees identical data to the genuine card and has no basis on which to distinguish them. CVV1 in the discretionary data defends against a specific and narrower threat: card details harvested from receipts, embossing or a manual imprint, which do not include it. Against a full track read it is no defence at all, because it was read too.

EMV removes replay by three mechanisms working together. The terminal supplies an unpredictable number, tag 9F37, which is fresh per transaction. The card supplies an application transaction counter, tag 9F36, which increments monotonically and never repeats. The card computes an authorisation request cryptogram over transaction data including both, using a key derived from an issuer master key that the card holds and never emits. The issuer recomputes the cryptogram and compares. A captured cryptogram authenticates one transaction, with one nonce and one counter value, and is worthless afterwards.

The migration was driven by liability rather than by technology, and the dates are worth having exactly. In the United Kingdom the liability shift took effect on 1 January 2005, moving responsibility for fraudulent magnetic swipe transactions from issuers to retailers who could not accept chip, and the national rollout completed on 14 February 2006. Counterfeit card fraud losses in the United Kingdom, reported by what was then the UK Cards Association, fell from £169.8 million in 2008 to £80.9 million in 2009. In the United States the equivalent shift for most point-of-sale acceptance took effect on 1 October 2015, roughly a decade later, with automated fuel dispensers deferred beyond that.

The stripe itself is now being withdrawn. Mastercard announced on 12 August 2021 that newly issued Mastercard credit and debit cards would not be required to carry a stripe from 2024 in most markets, that United States banks would no longer be required to issue chip cards with a stripe from 2027, that no new Mastercard credit or debit card would be issued with a stripe by 2029, and that no Mastercard credit or debit card would have a stripe by 2033, with prepaid cards in the United States and Canada exempt at the time of the announcement. Those dates are the scheme’s published plan as of writing in August 2026 and are subject to change by the scheme.

Until then, the residual controls are issuer-side and they are the ones that determine whether a shim or a chip-derived clone is worth anything. They are: validating CVV1 on any stripe-read transaction; validating iCVV separately on chip transactions and refusing to accept one where the other is expected; checking the service code against the card’s actual profile so that a stripe claiming no chip is present on a card that has one is treated as suspicious; monitoring the application transaction counter for non-monotonic or duplicated values; and constraining technical fallback, where a chip read fails and the terminal reverts to the stripe, by volume, geography and merchant category.

Shimming, and why it yields far less#

A shim is a passive device placed in the card slot between the card’s contacts and the reader’s, recording the application protocol data units exchanged under ISO/IEC 7816-3. The reason it exists is that the chip’s dialogue with the terminal is not encrypted; confidentiality was never its security property. Authenticity was.

What the exchange discloses is the static record content the card returns during read records: the PAN, the expiry date, the cardholder name where present, the track-2 equivalent data of tag 57 including the iCVV, the application transaction counter, and the cryptogram computed for that one transaction. What it does not disclose is any key. The card never transmits its private key or its derived session keys, and the cryptogram is a one-way function of data including a nonce the attacker cannot control.

So a shim produces two products, and both are constrained.

The first is card-not-present abuse. PAN and expiry are enough at any merchant that does not require CVV2, and are a strong starting point at any merchant that does, because they reduce the guessing problem to the remaining fields.

The second is what Recorded Future named EMV-bypass cloning in 2020: writing chip-derived track-2 equivalent data onto a magnetic stripe and presenting it as a stripe transaction. This should fail, because the iCVV in the chip record differs from the CVV1 the issuer expects from a stripe. It succeeds only where the issuer does not validate the value, or validates the wrong one, or does not check the service code. Krebs on Security, reporting Royal Canadian Mounted Police material in January 2017, made the same point when shimmers first appeared publicly: shimmers exist because some issuers did not implement the standard correctly. The vulnerability is not in EMV. It is in a small number of issuer authorisation stacks, and it is closable by configuration.

Defences are correspondingly split between the issuer and the device. On the issuer side, the controls listed at the end of the previous subsection are the whole answer, and an issuer that applies all of them reduces a shim to a source of card-not-present data. On the device side, cash machine and unattended terminal manufacturers have added physical countermeasures to the card path, and terminals are certified against the PCI PIN Transaction Security Point of Interaction requirements, currently at version 7.0 as of writing in August 2026, which cover tamper detection, tamper responsiveness and physical security of the card reader and PIN entry path. What no device countermeasure can do is make the chip dialogue secret, because the terminal must be able to read it.

Relay attacks on contactless, and the timing that limits them#

A relay attack is a proxy. One device presents itself to the genuine card as a terminal; a second presents itself to the genuine terminal as a card; the two are linked. Nothing is decrypted, forged or replayed. The cryptogram is genuine, the counter is correct, and the issuer’s verification succeeds, because from the protocol’s point of view the card really did participate.

Three things constrain it.

The first is physics. ISO/IEC 14443 is a proximity standard. The reader field falls away over centimetres, so one end of the relay must be brought very close to the victim’s card. That is a physical-access problem, and it is why relay attacks appear in demonstrations and disputes far more often than in loss statistics.

The second is the protocol’s own patience. ISO/IEC 14443-4 defines a frame waiting time, and EMV contactless kernels enforce an overall transaction time budget, commonly cited in the research literature at around 500 milliseconds, because the entire commercial proposition of contactless is that the customer does not wait. A relay adds latency at both radio interfaces and across whatever link joins them, and that latency competes against a budget that was set for user experience rather than for security but happens to serve both.

The third is an explicit countermeasure. EMV specifies a Relay Resistance Protocol, defined in the EMV Contactless Specifications for Payment Systems, Book C-2, the Mastercard kernel, and carried forward into EMVCo’s Kernel 8. It works by adding a timed exchange. The terminal issues an EXCHANGE RELAY RESISTANCE DATA command carrying terminal entropy and starts a timer. The card replies with its own entropy and with its Device Estimated Transmission Time For Relay Resistance R-APDU, a two-byte value in units of hundreds of microseconds stating how long it expects its own response to take. The terminal records a Measured Relay Resistance Time in the same units and compares the measurement against the card’s declaration, its own Terminal Expected Transmission Time For Relay Resistance R-APDU, and configured Relay Resistance Minimum and Maximum Time Difference Limits. If the measurement falls outside the window, the terminal can decline or force the transaction online.

It is important to be precise about what this achieves, because it is routinely overstated. RRP is a latency bound, not a cryptographic distance-bounding protocol in the academic sense. Its granularity is hundreds of microseconds; one hundred microseconds is thirty kilometres of light travel in free space. The protocol therefore cannot localise a card geometrically at all. What it does is impose a ceiling on the additional processing and network latency an attacker can introduce, which is a real and useful constraint against a relay built over general-purpose networks, and a much weaker one against a purpose-built low-latency link. Published analysis, including the systematisation-of-knowledge literature on EMV contactless security, notes that measured RRP timings vary with card position and orientation, which forces the acceptance window wider than a security engineer would like.

The academic record is worth citing accurately, because it is what drove the fixes. Francis, Hancke, Mayes and Markantonakis demonstrated practical relay of contactless transactions using ordinary NFC-capable mobile telephones in 2010. Radu, Chothia, Newton, Boureanu and Chen published “Practical EMV Relay Protection” at the IEEE Symposium on Security and Privacy in 2022, demonstrating a relay against Apple Pay in Express Transit mode with a Visa credential, exploiting the fact that transit modes deliberately relax cardholder verification so that a locked phone can pay at a gate; Apple and Visa subsequently addressed it. A cluster of work between 2019 and 2021, much of it by Galloway, Yunusov and colleagues, showed cardholder verification and limit bypasses achieved by manipulating terminal transaction qualifiers and card transaction qualifiers in the contactless dialogue rather than by attacking cryptography at all.

The economic constraint deserves its own paragraph because it is the control most people actually experience. Contactless transactions are bounded by the strong customer authentication regime. In the European Economic Area, Article 11 of the PSD2 regulatory technical standards permits an exemption for contactless payments at point of sale up to €50 per transaction, with cumulative limits of €150 or five consecutive transactions since the last application of strong customer authentication. In the United Kingdom, the corresponding Article 11 of the UK SCA-RTS was set at £100 per transaction and £300 cumulative, following the Financial Conduct Authority’s policy statement PS21/2, which raised those figures from £45 and £130.

That position changed recently and the change is the kind of thing this volume exists to track. On 19 December 2025 the Financial Conduct Authority announced, through Handbook Notice 136, rule changes taking effect in March 2026 which allow firms with strong fraud controls to set their own contactless limits rather than being bound by the regulatory figures. The FCA stated it did not expect immediate changes to the £100 single-transaction limit, and that firms remain obliged to reimburse consumers for unauthorised transactions and to communicate limit changes under the Consumer Duty. As of writing in August 2026, the £100 and £300 figures therefore persist as industry practice rather than as a hard regulatory cap in the United Kingdom, and any reader relying on this paragraph after 2026 must re-check it.

For a relay attacker, those limits are the binding constraint. A relayed contactless transaction below the floor limit yields a small amount, exhausts the cumulative counter quickly, and then triggers a PIN or biometric prompt that the relay cannot satisfy, because a device-based wallet requires consumer device cardholder verification on the genuine device.

Breaches at merchants and processors: the dominant modern source#

Everything above concerns single cards. Breaches concern lists, and lists are what the economics reward.

There are two families and they need separating.

Server-side compromise means card data taken from inside a merchant’s or processor’s environment: from a database, from a log file, from application memory, or from network traffic. The canonical era was point-of-sale memory-scraping malware, which exploited the window in which track data existed in the clear in a till’s memory between being read and being encrypted. TJX in 2007, Heartland Payment Systems disclosed in January 2009, Target in 2013 and Home Depot in 2014 are the reference cases; Target alone was up to 40 million payment card records taken between 27 November and 15 December 2013, using credentials obtained from a supplier and BlackPOS malware deployed on till systems.

The structural answer to that family is point-to-point encryption. If the reading device encrypts card data inside its own secure hardware, using keys the merchant never holds, then the merchant’s environment never contains card data in a usable form and the memory-scraping window closes. This is why PCI Point-to-Point Encryption solutions are built on PCI PTS POI devices with the Secure Reading and Exchange of Data capability, and why a validated P2PE deployment collapses a merchant’s PCI DSS scope so dramatically. It is also why tokenisation matters: replacing stored PANs with tokens means a stolen database of tokens is a stolen database of nothing.

Client-side compromise, usually called e-skimming or by the threat-actor label Magecart, is the modern replacement. The attacker does not enter the merchant’s environment at all. They compromise a script that the merchant’s checkout page loads into the customer’s browser, often a third-party script for analytics, chat or tag management, and that script copies the card fields as they are typed and sends them to an attacker-controlled endpoint. The merchant’s servers never see the theft. The merchant’s own logs are clean. The card data is taken between the customer’s keyboard and the merchant’s form handler.

British Airways in 2018 is the reference case in the United Kingdom, and the regulatory outcome is instructive. The Information Commissioner’s Office issued a notice of intent on 4 July 2019 proposing a penalty of £183.39 million, and after representations issued a penalty notice on 16 October 2020 for £20 million, finding infringements of Articles 5(1)(f) and 32 of the General Data Protection Regulation as it then applied. The attacker was in a position to access the personal data of approximately 429,612 customers and staff, including the payment card details of around 244,000 customers. The reduction from the notice of intent to the final penalty is itself worth noting by anyone modelling regulatory risk: it was not a finding that the breach was less serious, but the product of representations and of the Commissioner’s five-step penalty methodology.

The controls that address e-skimming are now explicit in the standard rather than implied. PCI DSS version 4.0.1 is the current version of the standard as of writing in August 2026. Its future-dated requirements ceased to be best practice and became mandatory on 31 March 2025. Two of them exist specifically for this attack:

The PCI Security Standards Council published an information supplement, “Payment Page Security and Preventing E-Skimming — Guidance for PCI DSS Requirements 6.4.3 and 11.6.1”, on 10 March 2025, which is the primary reference for how to satisfy them.

The rest of PCI DSS matters here too and is frequently misremembered, so it is worth stating plainly. Sensitive authentication data — full track data from stripe or chip, the CVV2 family of codes, and PINs or PIN blocks — must not be retained after authorisation, by anyone, under any circumstances, even encrypted. The PAN may be stored but must be rendered unreadable wherever it is stored. Those two rules between them determine what a breach can actually yield, and they are the reason a well-run breached merchant loses PANs and expiry dates while a badly run one loses everything needed to transact.

Two reporting obligations attach in the United Kingdom, and they run on different clocks. Under UK GDPR Article 33, a personal data breach must be notified to the Information Commissioner’s Office without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Separately, under the Payment Services Regulations 2017, a payment service provider must report major operational or security incidents to the Financial Conduct Authority. Card scheme rules add a third: an account data compromise event triggers scheme notification and, above thresholds set by each scheme, a PCI Forensic Investigator engagement. All three are live as of writing in August 2026.

Card testing and enumeration attacks#

The last category is aimed at issuers, executed through merchants, and paid for by both.

The mechanism is straightforward. An attacker sends authorisation requests through a merchant’s payment endpoint using candidate card credentials and reads the response. An approval, or in some configurations a decline code that distinguishes “wrong CVV2” from “no such account”, tells the attacker which candidates are live. The merchant is not the target. The merchant is the oracle.

The arithmetic explains why this is worth doing and where the defences must sit. Under ISO/IEC 7812:2017 an issuer identification number may be eight digits within a PAN of up to nineteen, and the final digit is a Luhn check digit. For a sixteen-digit PAN under an eight-digit IIN, that leaves seven free digits: ten million candidate accounts, of which some fraction is issued. Expiry dates within a typical five-year validity window give around sixty combinations. CVV2 gives one thousand. Guessing a complete credential from nothing is not economic. Completing a partial credential is: given a PAN from a breach, expiry and CVV2 together are sixty thousand combinations, and an attacker who can make unlimited attempts will find them.

That “unlimited” is the vulnerability, and it was documented precisely. Ali, Arief, Emms and van Moorsel of Newcastle University published “Does the Online Card Payment Landscape Unwittingly Facilitate Fraud?” in IEEE Security and Privacy in 2017, describing what they called the distributed guessing attack. Their finding was structural rather than cryptographic: because merchants require different combinations of fields, and because no party was counting failed attempts across merchants, guesses could be spread across many sites so that no single site saw enough failures to react. They reported that Mastercard’s centralised network detected the pattern within fewer than ten attempts even when distributed, and that Visa’s did not. The fix is not at the merchant. It is centralised counting.

Enumeration has a variant that is particularly awkward: account verification messages, zero-value or nominal-value authorisations whose purpose is to check a card is live. They produce no clearing record, no settlement and no cardholder-visible charge, which makes them ideal for testing and invisible to the person whose card is being tested.

The scheme response, and the figures a practitioner will be measured against, is the Visa Acquirer Monitoring Program. Visa’s own published material states that VAMP took effect on 1 April 2025 with an advisory period from 1 April 2025 to 30 September 2025, that it consolidates five existing fraud and dispute programmes into a single acquirer programme and thirty-eight remediation processes into one, that it incorporates enumeration criteria based on the count of enumerated authorisation transactions and an enumeration rate, and that enumeration attacks account for $1.1 billion annually in fraud losses.

The numeric thresholds do not have to be taken on trust from acquirers and risk vendors, because Visa publishes them itself. Its fact sheet “Visa Acquirer Monitoring Program Overview”, hosted on the corporate Visa site, sets them out as follows, and they stand as below at the time of writing in August 2026:

Two features of that table are worth dwelling on. The enumeration ratio counts declined authorisations in both numerator and denominator, which is correct, because a card-testing run is overwhelmingly declines and a ratio built only on approvals would be blind to it. And the VAMP ratio counts a TC40 fraud report and a TC15 dispute arising from the same transaction as two events, so one bad transaction can move the ratio twice.

Defences against enumeration are layered, and each layer catches a different thing.

At the merchant, the controls are rate limiting by internet protocol address, device and session, bot management, a minimum transaction amount, removal of free-text amount fields on donation pages, cardholder verification challenges on low-value flows, and monitoring of the approval ratio and the mix of decline codes as a leading indicator. A merchant whose approval rate collapses overnight is usually being used as an oracle, not losing customers.

At the gateway and acquirer, the controls are velocity rules by card, by BIN range and by merchant, pre-authorisation screening that never lets the request reach the network, and specific treatment of zero-value account verification traffic.

At the issuer, the controls are CVV2 attempt counters that block a card after a small number of failures, velocity monitoring across the issuer’s own BIN ranges regardless of which merchant the attempts arrive from, and deliberate parsimony in decline codes. This last point connects directly to the response codes discussed in Volume III: “do not honour” is uninformative on purpose. Every extra bit of information in a decline is a bit of information for an enumeration attacker, and the industry’s decision to be vague is a security decision, not laziness.

At the scheme, the controls are network-level enumeration detection of the kind Visa markets as Account Attack Intelligence, the monitoring programmes above, and financial penalties on acquirers that transmit the traffic.

The threat model in one table#

The pattern in the right-hand column is the argument of this chapter. Every control that worked, worked because it was placed where the attacker could not choose to avoid it. EMV worked because the card is in every transaction. P2PE works because the reading device is in every transaction. Centralised velocity counting works because the network is in every transaction. Every control that failed, failed because it was placed at a merchant, and there are millions of merchants, and the attacker picks which one to use.

What the law does when it fails#

The consumer position in the United Kingdom is governed by the Payment Services Regulations 2017, and it is more favourable than most people assume. Under regulation 76, where a payment transaction was unauthorised, the payment service provider must refund the amount and restore the account to the state it would have been in, as soon as practicable and in any event no later than the end of the business day following the day on which it becomes aware of the unauthorised transaction, unless it has reasonable grounds to suspect fraudulent behaviour by the payment service user and notifies the appropriate person under section 333A(2) of the Proceeds of Crime Act 2002.

Under regulation 77, the payer may be made liable for a maximum of £35 for losses arising from the use of a lost, stolen or misappropriated payment instrument, and even that does not apply where the loss was not detectable by the payer before the payment, where it resulted from an act of the provider’s employee or agent, where the payer had already notified the provider, or where the provider did not require strong customer authentication. The £35 figure and both regulations are as they stand at the time of writing in August 2026. In practice UK Finance reports that customers are fully refunded in more than 98 per cent of unauthorised fraud cases, which is why the losses in the table at the start of this chapter fall on banks and merchants rather than on cardholders.

One structural change is pending and worth flagging for anyone reading this after 2026. On 11 March 2025 the United Kingdom government announced its intention to abolish the Payment Systems Regulator and consolidate its functions primarily within the Financial Conduct Authority. As of writing in August 2026 the PSR continues to exist and to exercise its functions, and the legislation required to complete the consolidation is awaited. The National Payments Vision has also committed the government to revoking the strong customer authentication provisions from the Payment Services Regulations 2017 in favour of an outcomes-based approach, which, if delivered, will change the regulatory footing of several paragraphs in this chapter.

That is the honest state of this material. The mechanisms in this chapter — replay, interception, relay, bulk theft, enumeration — are permanent, because they follow from what a credential is. The numbers, the caps, the thresholds and the regulators are not, and this chapter will need rewriting before the rest of the book does.

45.98 Common wrong ideas#

Wrong: The chip ended counterfeit card fraud. Right: The chip is sound, but its deployment was uneven and its fallback paths exploitable; on United States dual-message networks the counterfeit fraud rate was 9.0 basis points in 2015, fell to 6.6 in 2017, and was back to 9.1 by 2021.

Wrong: The chip keeps your card number secret. Right: The chip never reveals its key, but it reveals the primary account number, the expiry date and track-equivalent data in the clear on every transaction; what it removed was replay at a terminal, not disclosure.

Wrong: Most stolen card details come from stolen or copied cards. Right: The dominant source is a breached merchant, processor or checkout page that touches no physical card at all, and a fast-growing share involves no card-data theft whatsoever, only a telephoned customer reading out a one-time passcode so the criminal can load the card into their own wallet.

Wrong: Relay attacks are the main contactless threat. Right: A relay borrows genuine cryptography rather than breaking it, which makes it interesting to researchers and lawyers; the £46.8 million of contactless fraud reported for 2025 is dominated by ordinary use of ordinary stolen cards.

Wrong: The Relay Resistance Protocol proves the card was physically at the terminal. Right: It is a latency bound with a granularity of hundreds of microseconds, and one hundred microseconds is thirty kilometres of light in free space, so it cannot localise a card geometrically at all.

Wrong: “Card data” is a single asset to be protected. Right: A PAN alone, a PAN with expiry, a PAN with expiry and CVV2, full track data, a PIN block and a network token are six different things with six different resale values, attack paths and controls, and merging them is the commonest analytical error in the field.

Wrong: A successful shim-derived clone proves EMV is broken. Right: It proves an issuer failed to validate iCVV, validated the wrong verification value, or ignored the service code; the defect sits in a small number of authorisation stacks and is closable by configuration.

Wrong: Card testing is a merchant problem, fixed by rate limiting at the merchant. Right: The merchant is the oracle rather than the target, and because attempts can be spread across many merchants the only counting that works is centralised at the network or the issuer.

Wrong: Decline codes should tell the merchant precisely what went wrong. Right: Every extra bit of detail in a decline is a bit of information for an enumeration attacker, so the vagueness of “do not honour” is a deliberate security decision rather than laziness.

Wrong: Cardholders end up carrying the losses in the fraud tables. Right: Regulation 76 requires refund by the end of the following business day, regulation 77 caps the payer at £35 and disapplies even that in most cases, and more than 98 per cent of unauthorised fraud cases are fully refunded, so the losses fall on banks and merchants.

45.99 Chapter summary in 20 lines#

1. Card fraud is not one crime but at least five, and they have almost nothing in common technically.
2. The magnetic stripe is a bearer credential in the purest sense: static data that a reader learns in full and a writer can reproduce exactly.
3. The chip replaced that key with a locksmith — a secret it never discloses, a terminal nonce and a counter that ticks on every transaction — so every reply is fresh.
4. A captured cryptogram is therefore a used ticket, which is why copying a chip conversation does not produce a working counterfeit card.
5. Skimming is close to dead where chips are used properly, with EMVCo reporting 15.6 billion cards and 97 per cent of card-present transactions on chip as of the fourth quarter of 2025.
6. A shim can read the chip dialogue because that dialogue was never confidential; authenticity, not secrecy, was its security property.
7. What a shim yields is the account number, the expiry and track-2 equivalent data carrying iCVV, which is useful on a website and useless at a terminal.
8. EMV-bypass cloning succeeds only against issuers that fail to check iCVV or the service code, so the weakness lies in a few authorisation stacks rather than in EMV.
9. A relay attack borrows genuine cryptography rather than breaking it, which makes it unfalsifiable from the issuer’s side and famous out of all proportion to its losses.
10. Three things constrain relays: centimetre-range radio, a transaction time budget commonly cited at around 500 milliseconds, and EMV’s Relay Resistance Protocol.
11. That protocol is a latency bound and not academic distance bounding, and its granularity leaves the acceptance window wider than a security engineer would like.
12. In practice the binding constraint on contactless is the authentication regime, with the United Kingdom’s £100 and £300 figures now industry practice rather than a hard cap after Handbook Notice 136.
13. The dominant modern source of card data is the breach: Target lost up to 40 million payment card records in three weeks of 2013 with no skimmer, shim or radio involved.
14. Point-to-point encryption and tokenisation answer server-side theft by making the merchant’s environment hold nothing worth taking.
15. E-skimming moved the theft into the shopper’s browser, where the merchant’s servers never see it, and British Airways in 2018 is the United Kingdom reference case, penalised £20 million on 16 October 2020.
16. PCI DSS requirements 6.4.3 and 11.6.1, mandatory since 31 March 2025, exist for exactly that attack, while the storage rules on sensitive authentication data determine what any breach can yield.
17. Enumeration completes partial credentials rather than guessing whole ones: sixty expiry dates against a thousand codes is sixty thousand tries, which only unlimited attempts make economic.
18. The merchant is the oracle rather than the target, and the documented fix is centralised counting at the network, as the Newcastle work on distributed guessing showed in 2017.
19. The Visa Acquirer Monitoring Program supplies the discipline, with a combined fraud and dispute ratio, an enumeration ratio of 2,000 basis points that counts declines on both sides, and penalties landing on acquirers.
20. Every control that worked was placed where the attacker could not choose to avoid it — the card, the reading device, the network — and every control that failed was placed at a merchant, and the attacker picks the merchant.

Sources: UK Finance Annual Fraud Report 2026 and 2025 press releases; Home Office call for evidence on unauthorised fraud, July 2026; The Nilson Report, January 2026; EMVCo worldwide deployment statistics, Q4 2025; Federal Reserve Bank of Kansas City payments research briefing, February 2025; PCI Security Standards Council document library and e-skimming information supplement, March 2025; Visa corporate publications on the Acquirer Monitoring Program; FCA press release of 19 December 2025 and Handbook Notice 136; Payment Services Regulations 2017 regulations 76 and 77 as published on legislation.gov.uk; ICO penalty notice against British Airways, October 2020; Mastercard magnetic stripe announcement, August 2021; EMV Contactless Book C-2 and CPACE terminal kernel specification for the Relay Resistance Protocol; Radu et al., IEEE S&P 2022; Ali et al., IEEE Security and Privacy, 2017; Krebs on Security and RCMP material on shimmers, January 2017.