Module 20 of 22 · Operator · 90 min
Offline terminals and the portable reader
Anyone can buy a certified EMV reader now, and some of them take a payment with no network. A protocol-level walkthrough of four 2025 attacks: a loyalty protocol standing in for identity, a status word misread for years, and a signature over the copy nobody compares.
Enrollment required
Module 1 of this course is free to read. Buying the course opens every other module, the transaction lab and search across the course. The workbench and the APDU decoder stay free for anyone.
The course is tied to your account, so you sign in first and come straight back here.
One payment for this course. Access for as long as the course exists, with every update and new research module that follows, at no further cost.
No hardware is sold here, and none is needed to read the course.
Payments are final. Module 1 is free so you can judge the course before you pay. Terms
Already enrolled? Sign in
Open the free workbench →What this module covers
- 01The thesis, before the attacks
- 02The bench, item by item
- 03A man-in-the-middle with two phases
- 04Attack 1 — how do you ask a card whether it is a phone?
- 05A detour: the same card behaves differently in two countries
- 06Attack 2: the error that was not a refusal
- 07Attack 3: a signature over the copy nobody reads
- 08Attack 4 — Mastercard, and nothing to flip
- 09Fixing it, and proving the fix
- 10Check it on a card you have
- 11What to take to an assessment