On: Asus refunds Zenfone buyer for failing to provide ...

[jjmarr]

They do, but you can't get the card number from reading the chip. The protocol is a challenge-response one based on a private key stored within the chip.

https://en.wikipedia.org/wiki/Chip_Authentication_Program

You need to read the entire card number + cvc2 + expiry date with your camera. That's not skimming, that's just taking a photo of the card.

[lxgr → jjmarr]

No, you can most certainly get the card number and expiry via the chip and even over contactless, as it’s a vital part of transaction routing/processing. There are Android apps that can do it.

[jjmarr → lxgr]

If I could I'd delete my original comment since I did more research and you're right.

https://stackoverflow.com/questions/14861908/apdu-command-to...

[worewood → jjmarr]

Yeah, and it's easily solvable with a sticker or a dremel to scrape the number off

[lxgr → worewood]

You can't dremel it out of the chip, though.

[justinclift → lxgr]

Well technically you can. The card won't be so usable after that though. ;)

[lxgr → justinclift]

Destroying the chip is easy, actually chiseling away the correct trapped electrons making up the PAN in the EEPROM is the challenge ;)