MagSpoof V5
Read a card's magstripe tracks, save them to the board, and replay them wirelessly through the built-in antenna — on systems you're authorized to test.
Price range: $35.00 through $100.00
- External magstripe readers, wired to the UART pins
- USB-C for power and CLI · UART reader · SWD programming
- Preloaded Serial CLI, auto-starts on power-up (v5.5.2.0)
- Web Serial Client in the browser, or PuTTY / Minicom
In the box
MagSpoof V5 board (32.5 × 76.5 mm), antenna coil integrated into the PCB
Preloaded Serial CLI firmware — auto-starts on power-up, no flashing needed to begin
Card reader variant only: magnetic stripe card reader that connects to the board over serial
Preloaded Serial CLI firmware — auto-starts on power-up, no flashing needed to begin
Card reader variant only: magnetic stripe card reader that connects to the board over serial
Not included
A case — 3D-print STL files are in the GitHub repo (CH55/V5/Case folder), not shipped with the board
You also need
If you bought the Simple variant: an external magnetic-stripe card reader (USB-connector or 4-wire header) to capture track data — it wires to MagSpoof V5’s UART pins, or to a PC. The Card reader variant already includes one.
A single-cell Li-Ion/LiPo battery, if you want to run it away from USB
A browser for the MagSpoof Web Serial Client, or a serial terminal (PuTTY on Windows, Minicom on Linux/macOS)
A card, reader or terminal you are authorized to test
A single-cell Li-Ion/LiPo battery, if you want to run it away from USB
A browser for the MagSpoof Web Serial Client, or a serial terminal (PuTTY on Windows, Minicom on Linux/macOS)
A card, reader or terminal you are authorized to test
- 114 GitHub Stars
- Designed and built in Aguascalientes, Mexico
- Hardware CERN-OHL v1.2 · firmware GPL-3.0
Audit a magstripe reader or POS terminal you are authorized to test
Situation: you have authorization to audit a POS or magstripe reader system. What you do: wire an external reader to MagSpoof V5’s UART pins, read and save the test card’s track data to EEPROM, then replay it with the Serial CLI (p1/p2/p). Aim at Track 2 alone — it carries the PAN, expiration and service code, and a standard POS reads both tracks in one physical swipe while MagSpoof transmits them one after another, so the terminal may only process the last track it receives. Result: the terminal accepts the emulated swipe as if a card had been swiped, which tells you whether that reader is vulnerable to spoofing.
Work a site visit with a phone instead of a laptop
Situation: you need to read, save and emulate magstripe cards in the field and carrying a laptop is not practical. What you do: power MagSpoof V5 from a battery or from a phone’s USB-C cable and send the same console commands over USB-Serial from an Android Serial USB Terminal app — a V5 addition over previous versions. Result: the full read, save and emulate workflow from a phone alone, on systems you are authorized to test.
Run a hands-on magstripe workshop or class
Situation: you are teaching magstripe security and want every participant on real hardware instead of slides. What you do: walk the group through the same four steps the project’s own tutorials use — set SW4 to VBUS or BATT and SW1 to ON, capture the track data of a card that is yours or that you are authorized to use for the exercise, decode the Format B fields (start sentinel, PAN, name, expiration, service code, discretionary data, end sentinel, LRC), then save and play the track back over the Serial CLI. Result: each participant has read, decoded and replayed a real magstripe track and understands the Track 1/2 structure well enough to reproduce it. The three published MagSpoof tutorials that cover this ground have drawn nearly 20,000 combined views.
Start in 10 minutes
- Set the power-source switch (SW4) to VBUS (USB) or BATT (battery), then flip the ON/OFF switch (SW1) to ON.
- Get the card’s track data: swipe it through an external magstripe reader and save it to a notes app on your PC, or — on MagSpoof V5 — wire the reader straight to the UART pins and read the track onto the board.
- Identify and complete the Track 1 / Track 2 fields (start sentinel, PAN, name, expiration, service code, discretionary data, end sentinel, LRC) with the magstripe Format B structure — the wiki walks the fields one by one.
- Save and play the tracks over the Serial CLI (
sto save,p1/p2/pto play) from a serial terminal — PuTTY on Windows, Minicom on Linux/macOS — or from the browser with the MagSpoof Web Serial Client.
| Microcontroller | CH552G — enhanced E8051 core, MCS51 instruction set, up to 24 MHz |
|---|---|
| Memory | 1 KB xRAM · 256 B iRAM |
| Power | Single-cell Li-Ion/LiPo battery or USB-C · 3.3 V I/O (never apply more than 3.3 V to digital/analog pins) |
| Dimensions | 32.5 mm (width) × 76.5 mm (length) |
| Connectors & controls | USB-C · UART pins · SWD pins · battery pins · coil pins · status LED · CHRG LED · ON/OFF switch (SW1) · BATT/VBUS switch (SW4) |
| Antenna / coil | Integrated into the PCB since the v5.0.0 refactor |
| Magstripe tracks | Track 1 and Track 2, Format B — transmitted sequentially, not simultaneously |
| Default firmware | Preloaded Serial CLI, auto-starts on power-up (h · s · p1/p2/p · l · d · e) |
| Latest firmware release | v5.5.2.0 (2024-07-16) |
| Programming | Arduino IDE — CH55xDuino (WCH CH55x MCS51) board core |
| OS support | Windows · macOS · Linux (Windows also needs the Zadig USB driver for bootloader mode) |
| Licenses | Firmware GNU AGPL v3.0 · Hardware CERN OHL v1.2 |
| Feature | MagSpoof V5 (current) | MagSpoof V4 | MagSpoof V3 (retired) |
|---|---|---|---|
| Microcontroller | CH552G | CH552G | Atmel SAMD11 (32-bit ARM Cortex-M0+) |
| Antenna / coil | Integrated into the PCB (v5.0.0 refactor, smaller board) | Coil pins on the board | 24AWG magnet wire coil |
| Firmware | Serial CLI (magspoof_V5.ino) — read, save, play, no code edits | Serial CLI (magspoof_V5.ino) — no code edits | Standalone sketch (magspoofV3.ino) — tracks hard-coded in the source |
| Getting track data in | External reader wired to the on-board UART pins | External reader connected to a PC to capture the track first | Type the track into the Arduino source and upload |
| EEPROM programming access for tracks | Yes | Not listed as a feature | No CLI |
| Console commands from a smartphone | Yes, over USB-Serial | Not offered as a feature | No CLI |
| Bootloader mode | Short the JP1 pads (same process as V4) | Short the JP1 pads | Double-tap the RST button |
Does MagSpoof work over NFC or RFID (13.56 MHz or 125 kHz)?
No. MagSpoof does not use NFC or RFID at any frequency. It generates an electromagnetic field that standard magnetic stripe and credit card readers pick up wirelessly — the same thing a physical swipe does — with no NFC or RFID involved. From V5 on it covers the whole suite: it reads tracks through a serial port and emulates them with its built-in antenna.
Do I need to know how to code?
Not on V4 or V5. Their firmware ships preloaded with a Serial CLI that auto-starts when you power the board: h for help, s to save, p1/p2/p to play, l to load from EEPROM, d and e to display RAM and EEPROM — driven from a serial terminal or the browser-based MagSpoof Web Serial Client, with no code edits. The older V3 standalone sketch is the exception: there the track data is hard-coded in the Arduino source before you upload it. If a firmware upload ever fails or bricks the board, WCHISP Tool V3.3 reprograms the CH552 directly.
What is the difference between MagSpoof V5 and MagSpoof V4?
V5 is the direct evolution of V4: same microcontroller, same reprogramming process. What V5 adds is the antenna coil integrated into the PCB with a smaller board (the v5.0.0 refactor), EEPROM programming access to store tracks, UART pins so an external reader can read a track straight onto the board, and console commands you can send from a smartphone over USB-Serial. The comparison table above has the row-by-row breakdown, including V3.
What am I allowed to use MagSpoof for?
Authorized security audits, and research or teaching on cards and readers that are yours or that you have permission to test. MagSpoof is a wireless penetration testing tool intended solely for use in authorized security audits, where such usage is permitted by applicable laws and regulations. The board provides no means or authorization to use credit cards or to engage in unauthorized financial transactions, and Electronic Cats holds no responsibility for unauthorized use.
