Misprinted Card Destruction and Chain of Custody
A personalization line produces 9,600 EMV cards for a single issuer. A printer calibration error causes the magnetic stripe encoding to fail on 1,200 cards; the chip personalization succeeded and the cards carry embossed PANs. The cards are moved to a locked 'reject cage' in the production room. The cage key is kept on a hook in the shift supervisor's desk and is used by six line leads. The facility's contracted destruction vendor visits every Thursday; the next pickup is in five days. The vendor uses a cross-cut shredder with a 4x40 mm particle size and provides a certificate of destruction listing weight, not card count. A line lead proposes to 'punch a hole through the chip' to render the rejects unusable and store them in cardboard boxes until pickup.
1. Identify the weaknesses in the handling of the 1,200 rejected cards. What is the realistic risk?
Read the worked answer
The rejects carry embossed PANs and personalized chips, so they are sensitive cardholder data even though they failed stripe encoding. The reject cage is locked, but the key is on a hook and used by six line leads-that is shared access without attribution or dual control. The cards sit for up to five days in a production room, and the proposed hole punch is not a reliable destruction method: it may not destroy the chip or stripe data, and it creates a false sense of security. Cardboard boxes are not a secure container. The vendor certificate records weight, not card count, so a missing card could go unnoticed. The realistic risk is diversion of live card data or theft of cards that could be used fraudulently; the control gap is custody, not just disposal.
2. What controls should be in place from rejection through vendor pickup and destruction?
Read the worked answer
At rejection, log each card's identifier or serial range, count them, and place them in a locked container with access controlled by dual custody or an auditable electronic access log. Do not leave the key on a hook; issue it per shift and record every opening. Transport the container under escort, with a signed handoff, and keep it segregated from good stock. At pickup, verify the vendor's identity and authorization, count the cards with the vendor present, and record the count and serial ranges on the destruction request. Destruction should be witnessed by a bureau representative or verified by video, and the certificate should state the count and serial ranges, not only weight. Reconcile the certificate to the rejection log. If on-site destruction is possible, that reduces transport risk. Retain records for audit.
3. Is the vendor's 4x40 mm cross-cut shredder acceptable for EMV cards? What evidence would you require before approving it?
Read the worked answer
Particle size alone is not enough to approve destruction of EMV cards. The magnetic stripe may be shredded, but the chip is a solid component and could survive a cross-cut shredder in a readable or recoverable form; the security value depends on the actual equipment and process. I would require the vendor to demonstrate destruction on sample cards of the same construction, including chip and stripe, and provide the resulting particle size and a description of the process (for example, a grinder or disintegrator if the cross-cut unit cannot process chips). I would also require a certificate that records card count and serial ranges, witnessed destruction or video, and a site audit. If the vendor cannot show that the chip is destroyed, I would use an approved destruction method or destroy on site. The 4x40 mm specification is a starting question, not the answer.