Fighting EMV Counterfeit Fraud

Start-up CardLatch is creating technology it believes will effectively eliminate losses to fraud from counterfeit EMV-compliant cards. Currently, there are more than 9 billion EMV-compliant chip cards in circulation worldwide. While fraud from counterfeiting is an $8-billion problem worldwide, those losses occur substantially from transactions initiated by a magnetic stripe, even when the card has a chip. CardLatch anticipates that as mag-stripe cards completely fade from use on the global brand payment networks, criminals will increase efforts to steal card account details from EMV cards.

Skimming devices that sell for about $150 are already available for sale from online marketplaces. They can be used to steal data from contactless chips when operated from within three feet of a card. Other vulnerabilities in the EMV network infrastructure include cryptogram harvesting, remote data extraction, man-in-the-middle attacks at ATMs, and malicious code attacks in POS devices (called POS impersonation).

CardLatch’s answer is software that turns every EMV card into a digital wallet capable of initiating a one-time-only virtual card number for each transaction. This will be combined with patent-pending technology that uses EMV protocol boundaries to “kill” authorization attempts from counterfeit cards.

Unlike the unique cryptographic number that accompanies an authorization request initiated when an EMV card interacts with an EMV terminal, CardLatch’s digital wallet-like protection generates numbers that cannot be predicted.

CardLatch says its system will work within the existing card network infrastructure, leveraging servers deployed at participating card issuers or their card account processors. A proof of concept is planned for the first quarter of 2020.

Eyal Brosh is CEO at CardLatch in Tel Aviv, Israel, eyal@cardlatch.com, www.cardlatch.com.