Is your chip card secure? Much depends on where you bank

You're entirely correct with EMV. Additionally, more gas stations are moving away from the old satellite connections, and an m2m cellular card in a POS terminal is a lot harder to shut down (at least without the cashier noticing).

So, your bank opts in to the Verified by Visa scheme (they can't opt individual account holders out, or at least my otherwise very co-operative "good" bank said they can't when I asked years ago)

If an online retailer performs Authorisation the API they talk to will examine your card number and conclude it needs this extra check, so it tells them to forward your browser to an HTTPS site you've never heard of, in the arcot.com domain. I guess if you're a huge bank you've heard of Arcot, but consumers haven't. The site claims to be from your famous bank brand, but the domain name clearly isn't, anybody who has learned anything about phishing ought to run screaming.

The arcot.com HTTPS site looks at the transaction and if you've never done this before it (presumably always? but maybe if there's a fraud flag this doesn't happen?) registers you for the "Verified by Visa" service. You can pick "No, I'm busy right now, just let me buy stuff" and it will give you a few passes, but I believe eventually it's mandatory.

Signing up requires giving them some details about the card, and also effectively creating yet another secret password. (Because we all know secret passwords are great right?). There might be an option to pick a picture or text greeting so you'll "know it's them" although of course a sophisticated attacker could duplicate that part...

On subsequent visits you may be asked for that secret if you've created it. Or, it might give up asking and just say everything is fine before returning you to the original payment flow. My transactions are reassuringly boring so I am never asked for anything these days.

The whole thing looks like it was built by people who were impressed by IE6 and are planning to buy a 17" display soon. The cryptography would be impressive for the IE6 era and not so much today, it's TLS 1.2, it has some basic precautions, but it's scarcely Fort Knox, your GMail is better protected.

Here's how this goes (everything in this story actually happened in England years ago, but that's before a change this story says wasn't entirely effective in eradicating the fraud)

Sarah lives in England where they are getting EMV terminals everywhere. Her cousin Terry lives somewhere which doesn't yet have terminals everywhere. Let's say it's Belgium, although in fact it was not.

Sarah owns a dozen petrol stations (that's what they call gas stations in England) and there are shiny EMV terminals arriving. Terry sends over instructions and electronic kits. The terminals are hollow and the instructions explain how to open one without the "anti-tamper" mechanism noticing and add more electronics in the convenient space.

Sarah teaches all her staff how to use the new terminals. She of course doesn't mention they've been tampered with.

You go to a petrol station, fill up your car, and hand your card to the clerk. "We got new machines" says the clerk and hands the card back. You put your card in the machine, and enter your PIN. I guess this is more secure?

In Belgium, Terry receives the magnetic stripe details of your card, retrieved from the chip using a convenient "Hey what is your mag-stripe?" API and sent over by a mobile chip in that circuit Sarah fitted. Terry has a mag-stripe writer and turns a cheap plastic card into a good-enough clone of your bank card. He sells this card to street level criminals in Belgium for €100, Sarah will get £10 per card as her cut.

Those street-level Belgian crooks need mag-stripe terminals because their cards have no chip, but you not swiping made no difference.

Edited to add:

While we're here. This is a recurring security problem. Old insecure systems can ruin it for new secure systems.

Imagine you have a brand new, up-to-the-minute TLS 1.3 only website. You use a cert for www.example.com with a nice shiny Elliptic curve public key & the corresponding Elliptic curve private key is in an HSM at a protected site, no problems. What can go wrong? Unknown to you, some numb-nuts who was angry about the company choosing Slack set up an "experimental" IRC server doing SSLv3 on port 6667 of their laptop using a *.example.com wildcard RSA cert that's still valid until next month. Bad guys who get even fairly limited access to your network can attack that IRC server, which is running on a high port on some idiot's laptop computer in corporate, not the secure datacentre where the web server is, and use it to flawlessly impersonate www.example.com if they can get on-path. They know this trick can work as soon as they find the IRC server, no special insight is needed.

We pay for fraud with increased transaction fees.