Credit card chip fell off, what now?

October 21, 2016 12:35 PM

So the chip on my credit card fell off somewhere, what can somebody do with it if they found it?

It was delaminating and must have got caught on my wallet when I tried to put it back in. I've requested a replacement but should I report it as stolen? Could somebody conceivably get information about my credit card off the chip if they found it?

posted by crashlanding to Work & Money (5 answers total)

It seems so unlikely that the chip would happen to be found, undamaged, by a person who had the knowledge, means, and desire to extract and mis-use information that I wouldn't worry about it. More likely your chip has been stepped on a thousand times by now and peed on by a dog, and if anyone *were* to notice it on the floor, they wouldn't be sure what it was, and even if they did know what it was, would not happen to be a criminal mastermind ready to jump on the opportunity.
posted by If only I had a penguin... at 12:44 PM on October 21, 2016 [5 favorites]

And even if they did know what it was for, it has now been invalidated by the issuing bank, so nobody could use it anyway.
posted by kindall at 12:49 PM on October 21, 2016 [2 favorites]

Response by poster: If only I had a penguin..., I'm also just curious what could be done
posted by crashlanding at 1:22 PM on October 21, 2016

Best answer: you can read the information(*) printed on the card from the chip (if you want to google, the card standard is EMV and the protocol is referred to as APDU - you can buy readers that connect to a computer and can send arbitrary commands to the chip).

so someone could fake up a card and use it physically. if you have a PIN (i gather most americans don't) then they would also need to guess that. but since PIN numbers are limited it may be possible to get that by repeatedly guessing (i am less sure on this but i think it used to be possible to do this offline; these days perhaps you need to actually make a transaction to do this). without a PIN they only have to "forge" a signature (which is no problem at all since they can sign their fake card).

online use would be harder because they wouldn't have the CCV.

(*) but not the CCV code.
posted by andrewcooke at 1:58 PM on October 21, 2016 [3 favorites]

Best answer: update: it seems that the attack with chip + pin was to place an additional chip "in front" that stopped the pin from being verified by the card.

(so i was wrong about being able to guess it).
posted by andrewcooke at 2:09 PM on October 21, 2016 [1 favorite]