This is technically old news - as the article states, it has since been resolved. Edit: I guess they're shedding new light on how they performed the hack.<p>Another thing, in context of USA, is that the authentication being done isn't much of a vulnerability as this only applies to offline chip transactions. In the USA (I believe) and here in Canada, all transactions are online, which means the pin will be rejected by your financial institute's back end systems in these scenarios.<p>These types of hacks have since been corrected using what is called CDA (Combined Data Authentication). Blurb on SDA/DDA/CDA here: <a href="http://www.cryptomathic.com/hubfs/docs/cryptomathic_white_paper-emv_key_management.pdf" rel="nofollow">http://www.cryptomathic.com/hubfs/docs/cryptomathic_white_pa...</a><p>Edit: Many Canadian financial institutes still use the weakest data authentication (SDA) because all transactions go online - spoofing a card PIN verification response doesn't fool the back-end system. Visa and Mastercard both have mandates to have newly issued cards be provisioned on chips with CDA (I believe, could be DDA which would still be susceptible to this attack).<p>Edit 2: When I say "offline", I mean at a point of sale machine - the POS does not reach out to the payment network to perform an "online" transaction where the PIN and card are validated by the back-end systems.<p>Edit 3: The article doesn't give EMVCo any credit for actually solving the issue before any real world hack was known to exist.