Chip-enabled credit and debit cards will almost entirely replace magnetic strip cards within the next five years – perhaps sooner, e-payment experts say.
Vastly improved security will be the most tangible impact of this transition, they say.
Magnetic strip cards used today have certain inherent weaknesses.
Criminals can today steal the magnetic stripe data, copy it on to a counterfeit card and put any signature on the back of the fraudulent card.
Chip and pin technology can minimize such fraud, says Sameer Mustafa, assistant professor, department of accountancy at Montreal’s Concordia University.
Knowing the account information and personal password aren’t enough to access a bank account, he says. “The physical presence of the chip is needed.”
While chip-based systems have been used in Europe since 2005, in Canada the technology is just gathering momentum.
Today’s there’s growing awareness of its benefits thanks to the efforts of companies such as MasterCard Canada, Desjardins Group, Visa Canada, and the Interac Association – organizations that participated in the Kitchener-Waterloo chip trial that started last year. The trial officially ends today (October 31, 2008).
The transition to chips is a “global movement,” notes Caroline Hubberstey, director of public affairs at Interac Association. She says markets that are left behind put themselves at risk as “fraud migrates to the weakest point.”
Interac announced its Canada-wide rollout of chip technology this week.
“We didn’t want Canada to be at risk,” Hubberstey said.
Countries adopting chip technology for e-payments witness a huge decrease in “skimming,” according to François Labrie, project director at Desjardin Group headquartered in Quebec.
A common fraud associated with e-payments, skimming refers to the practice of recording information – such as a PIN number – entered by customers through a device placed in the shop’s card reader.
Typically, fraudsters steal the card reader from the shop (or obtain it in collusion with a staff member), install the device, and then put the reader back in the shop, supermarket, or gas station.
Information entered by customers is logged and used by scam artistes to create fake cards.
Labrie says this form of fraud has moved to countries that haven’t yet implemented chip technology.
Many Canadian organizations today are positioning themselves to migrate towards this new technology.
Part of the reason is awareness-generation initiatives – spearheaded by many of the same organizations involved in the Kitchener-Waterloo migration trial.
More than 20 organizations representing debit card issuers, credit card issuers, ABM providers, payment service providers, merchants and payment brands participated in the trial.
One finding of the trial was that more than 80 per cent of chip card holders and 75 per cent of frontline staff find transactions with a chip card easy or easier than transactions using a magnetic stripe card.
“We do need to change over,” says David Malamed, a forensic accountant partner at Toronto-based legal firm Grant Thornton. “What we have now is not working.”
The fact that chip technology involves two-part authentication, provides an additional level of protection, experts say.
The power of a computer is put on the chip – making it very difficult to duplicate, Hubberstey notes.
She said fraudsters not only have to find a way to crack into the encrypted microprocessor, they also have to know the PIN.
“It creates an added layer of security.”
But that’s not to say magnetic strip technology is unsafe, Huberstey noted. “99 per cent of [Interac] transactions go through incident free.” Chip technology makes an already safe system “even more secure”, she said.
While this may all be true, some industry insiders question who it is that chip technology really protects.
For instance, Malamed notes card holders are assured that in incidents of fraud most credit card companies will credit back purchases they (the cardholder) didn’t make.
With this new technology companies may want to push back the responsibility on the card holder, and ask them to provide proof they didn’t make the purchase or give out their PIN.
But that’s not an issue within MasterCard Canada, according to Oliver Manahan, vice-president of advanced payments with the credit card organization.
“For us [the card holder] is not held responsible for a fraudulent transaction on a magnetic stripe card – and it’s the exact same thing for a chip card.”
Other potential weak spots Malamed points to are around the actual rollout of this technology.
As many POS terminals can’t read the chip there may be various options such as upgrading the entire terminal or using add-on devices such as memory sticks, which fraudsters can take advantage of.
“It’s not that they’re not hackable.”
He says aside from possible vulnerabilities of each smart card, there is a database that stores card data. The vulnerability of the server-based system is no different from any other just because it’s linked to a smart card.
This new technology may need to address privacy issues relating to spending records and patterns, and who sees that information, according to IDC Canada analyst Marc Perrella.
And Malamed says it’s only a matter of time before scam artistes are able to hack into data storage centres – such as those found at any retailer – and copy the information onto a blank smartcard.
But according to Perrella that’s not going to be easy. “Reproduction of chip information on to a new chip is not happening currently.”
He agrees the human element could be the weak spot in a national roll-out. “The weakest points will be the people processing the technology and the challenge is going to be updating the whole infrastructure with an overhaul of machines and terminals.”
Machines can’t do everything, Perrella notes. It’s also the responsibility of staff to look out for fake credit cards being used.
Manahan says that MasterCard is encouraging card users to maintain control of their cards. He says with this new technology there is no need to surrender your card to any merchant.
In many U.K. restaurants, the waiter will bring over a wireless terminal to your table to make the payment transaction. That’s a technology Canada plans to adopt.
“Now by having a terminal brought to you, you don’t surrender control of your card therefore there’s no ability or opportunity for them to skim your card,” he said. “It’s in those instances that you lose sight of your card that skimming can happen.”
