← Payment Systems: Magstripe, Tokenization, NFC and EMV
Level 3 · Operator90 min
Offline terminals and the portable reader
Anyone can buy a certified EMV reader now, and some of them take a payment with no network. A protocol-level walkthrough of four 2025 attacks — a loyalty protocol standing in for identity, a status word misread for years, and a signature over the copy nobody compares.
Enrolment required
Module 1 of this course is free to read. The rest needs an enrolment — and so does nothing else on this site: the workbench, the APDU decoder and the whole capture corpus stay open to everyone, signed in or not.
What this module covers
- 01The thesis, before the attacks
- 02The bench, item by item
- 03A man-in-the-middle with two phases
- 04Attack 1 — how do you ask a card whether it is a phone?
- 05A detour: the same card behaves differently in two countries
- 06Attack 2 — the error that was not a refusal
- 07Attack 3 — a signature over the copy nobody reads
- 08Attack 4 — Mastercard, and nothing to flip
- 09Fixing it, and proving the fix
- 10What to take to an assessment