Foreigners visiting America are taken aback by how lax locals are when using credit or debit cards to make purchases. Allowing a sales clerk to swipe a card at a check-out — instead of doing it personally on a shielded terminal while keying in a PIN number — is the first surprise. Handing over a credit card to a waiter in a restaurant, who disappears out of sight for five minutes before returning with a counterfoil for signature verification, is considered unimaginably stupid. Yet we all do it with only minor reservations.
No wonder America leads the world in credit-card fraud. The US accounts for 47% of global credit and debit card fraud, even though it is responsible for only 27% of the total volume of purchases, according to a study by the Nilson Report, a newsletter for the payments industry. Though figures are notoriously hard to come by, the amount of fraud based on stolen card numbers in the US is around $14bn/year, reckons Javelin Strategy & Research, a financial information company based in Pleasanton, California.
With the rest of the developed world having embraced more secure “smart cards” (or at least in the process of doing so), America remains the only major country that still relies on antiquated payment cards that encode their sensitive data in a magnetic stripe on the back. In security terms, that is about as safe as writing your account details on a postcard and sending it through the mail.
Inevitably, international fraud migrates from places where security is high to places where it is low. It happened when Britain introduced “chip-and-pin” cards nearly a decade ago, causing credit-card fraud to plummet there, but to increase elsewhere in Europe. As tougher security measures have come into effect around the world, fraudsters have begun to focus their credit-card scams more than ever on the US.
Credit-card fraud is usually perpetrated by copying or stealing card-authorisation forms from restaurants, stores or even a person’s own trash. Hacking into a credit-card processor’s database is another profitable approach for criminals. Meanwhile, fitting clandestine magnetic-stripe skimmers on petrol pumps and ATM machines has become increasingly common. And the old standby of using “phishing attacks” over the phone or the Internet — to con individuals into parting with their card’s security details — remains as widespread as ever.
Several years ago, Symantec, a supplier of security software, found by far the most popular category of goods available on criminal networks was credit-card data — that is, the individual’s name, the 16-digit account number, the expiry date and the three-digit security code that is printed on the back of the card but not encoded in the magnetic stripe. Stolen credit-card details are sold in bulk, ranging in price from US$0,10 to nearly $1 per item.
The answer, of course, is for American card companies and banks to do what has been done in the rest of the world — and start issuing chip-based credit and debit cards. Unfortunately, the payments industry in the US has been locked in a chicken-and-egg situation. Stores have had little reason to install smart-card readers while banks have been reluctant to issue smart cards; and banks have refused to issue them while stores do not accept them.
The problem is compounded by the brutal competition in America between card issuers for free-spending customers. Few banks have been willing to force card holders to change their habits for fear of antagonising them. For their part, merchants fear it would take years to recoup the investment needed to upgrade their terminals and build new communications infrastructure. Javelin reckons adopting smart cards will cost the American payments industry $8bn.
Meanwhile, Americans travelling abroad have been finding it increasingly difficult to use their old-fangled credit cards in shops, restaurants, hotels, stations and travel agencies. While merchants in Europe and elsewhere are obliged to honour all the credit cards they list as accepting, many find excuses for rejecting them. And automated kiosks for subway tickets and the like simply eject them. For customers who travel a lot, the bigger American banks will issue smart cards that conform to the international standard.
So, it is not as though American issuers do not have the necessary technology. Indeed, the irony is that it was the American card companies, MasterCard and Visa, that did most to create the global standard back in 1996. Over the past decade, both card companies have introduced smart cards widely around the world. The international standard for such cards (as well as the point-of-sale terminals and ATMs used to read them) is known as EMV, which stands for Europay, MasterCard and Visa (Europay has since been absorbed by MasterCard).
Nowadays, the standard’s management organisation, EMVCo, is owned by MasterCard, Visa, JCB of Japan and American Express. Its smart cards are used in various countries under the name “IC Credit” or “Chip and Pin”. They can take the form of either “contact” cards that are inserted in a terminal, or “contactless” ones for waving in front of a reader. To date, more than 1,3bn EMV cards have been issued globally, and some 21m point-of-sale terminals can now accept them. This represents nearly one out of two payment cards in use globally, and three out of four terminals on merchants premises around the world.
Embedded in the surface of an EMV payment card is a microprocessor for storing the information and instructions needed to make a purchase. The chip’s contents are protected by security features based on both symmetric- and asymmetric-key technologies. Symmetric encryption uses a single mathematical key (or at least two closely related keys) to encrypt the plain-text version of a person’s account details for storing in the chip’s memory. For the card to be authenticated, the cypher-text stored in the chip is decoded using the same key. The key is thus a secret shared only by the user and the authenticator.
By contrast, an asymmetric (or public key) approach requires two separate keys — one made public and the other kept secret — to encrypt the plain-text of an account, and then to decrypt the cypher-text for authentication. Asymmetric algorithms allow the authenticity of a message to be checked by creating a digital signature of the original plain-text using the private key, which can be authenticated using the public key. In countries where EMV cards using such encryption have been deployed credit-card fraud has fallen by as much as 80%.
Finally, this year, Visa plans to bring EMV cards to America. To break the deadlock between merchants and banks, the card company will free retailers from having their payment systems checked for security every year — if, that is, they agree to upgrade their terminals. According to the National Retail Federation, such audits cost merchants hundreds of millions of dollars annually. In 2015, Visa intends to up the ante by shifting the liability for certain kinds of fraud from the banks to the stores. MasterCard has recently announced similar plans.
By law, credit-card users in America are only responsible for the first $50 of any unauthorised charge. In practice, banks waive the fee and swallow the cost rather than risk having disgruntled customers defect to another card issuer. But in future when a customer presents a smart card to a store that cannot accept it — and the transaction has to rely instead on the card’s insecure magnetic stripe — then the store will be liable for the loss if there is any problem.
Freed of the liability for fraud, the banks are going to have a huge incentive to hand out chip-and-pin cards to all their customers. Meanwhile, the stores will then have good financial reasons for upgrading their terminals. Doing so will help prevent their fraud costs from soaring out of control.
But the real pay-off from smart cards, worldwide, will only come when they finally ditch the magnetic stripe they continue to sport for fallback purposes and become embedded in smart phones. People will then be able to make purchases securely with a click of a few buttons and a wave of the hand. The Japanese have been doing that for years. It is time the rest of us enjoyed similar benefits. — (c) 2012 The Economist
- Image: Allan Donque
- Subscribe to our free daily newsletter
- Follow us on Twitter or on Google+ or on Facebook
- Visit our sister website, SportsCentral (still in beta)