NPR : News

Filed Under:

Outdated Magnetic Strips: How U.S. Credit Card Security Lags

Criminals may have stolen information from 40 million credit and debit cards used at Target. A possible weakness? The magnetic stripe on credit cards — which fraudsters can pull credit card numbers and expiration dates from to make counterfeit cards.

Other countries moved beyond this technology years ago. The U.K., Canada and Hong Kong are already using chip-based cards, which are considered more secure. (Magnetic stripe technology is decades old.) Cards using the chip-and-PIN system have an embedded microchip. Instead of swiping the part with a magnetic stripe, you put the card into a terminal, then enter a PIN or sign your name. It's more expensive for criminals to forge these cards, says Brian Krebs, a security journalist who writes for Krebs on Security and broke the story on the breach at Target.

Target didn't give details on how the breach occurred. But Krebs, citing credit card industry sources, reported that it involved "the theft of data stored on the magnetic stripe of cards used at the stores."

The newer chip-and-PIN technology "simply raises the costs for the bad guys," Krebs told NPR. "It's not that they can't break the system — but it makes it more expensive for them to fabricate these cards."

Visa and MasterCard have plans to introduce these cards in the U.S. in around two years. But why hasn't the U.S. already adopted this technology?

That's the wrong question to ask, says Ross Anderson, who has worked on payment technology for almost 30 years and is a professor of security engineering at the University of Cambridge.

"Simply blocking off one of the avenues of attacks by fraudsters isn't enough to make fraud vanish," he says.

It can be a game of cat and mouse. Anderson says after it became common to pay with chip-based cards in the U.K., around 2003, the level of fraud went up because thieves turned to schemes involving mail and telephone orders.

Eventually, criminals figured out how to make fake terminals that steal information from the card. Also, the cards still have magnetic strips, in case European cardholders want to travel abroad. According to Krebs, some criminals simply steal the information from the cards in Europe, and because they can't pay with magnetic stripe cards over there, they send the information to crooks in the U.S. for illegal shopping sprees.

Americans are actually lucky, says Anderson, because they have the thing that matters more than technology — consumer protection.

"If there's fraud, the issue is who pays for it; is it me or is it the bank? And if the bank is running the system, then I want the bank to pay for the fraud," Anderson says. "American citizens are lucky because [since the 1970s and early 1980s, they have] very strong consumer protection in the form of Regulation E, Regulation Z and various decided court cases."

If U.S. cardholders become victims of credit card fraud, they can call their bank and be done with it, losing at most $50 or so. In the U.K., for instance, cardholders have to write a letter to file their claim.

"The U.S. is ahead in terms of consumer protection, and if you're thinking about the public interest and how things affect you as a bank customer, that's by far the most important thing," Anderson says. "How the banks use technical mechanisms to limit their own exposure then simply becomes an engineering problem for them to solve."

He says this consumer protection is why online shopping took off in the U.S.

Starting Oct. 1, 2015, Visa will encourage the use of the new chip-embedded cards in the U.S. After that, if someone uses a chip card at a store that hasn't adopted the new terminals for reading chip cards, the store may be responsible for any fraud that happens.

Anderson also says this is an exciting time for payment technology. There hasn't been much innovation for the past 30 years or so, but he says mobile payment systems like Google Wallet could be widely used in five to 10 years.

Copyright 2013 NPR. To see more, visit http://www.npr.org/.

WAMU 88.5

Rita Dove: "Collected Poems: 1974 - 2004"

A conversation with Rita Dove, former U.S. poet laureate and Pulitzer Prize-winner.

NPR

Frozen Food Fears: 4 Things To Know About The Listeria Recall

The FDA issued a massive recall of frozen fruits and vegetables this week. Here's what you need to know about the nasty bug that's causing all the problems.
WAMU 88.5

Back From The Breach: Moving The Federal Workforce Forward

A year after a massive cyber breach compromised the databases of the Office of Personnel Management, Kojo talks with OPM Acting Director Beth Cobert about her agency and key issues facing the federal workforce.

WAMU 88.5

Why Medical Error Is The Third Leading Cause Of Death In The U.S.

New research shows medical error is the third leading cause of death in the U.S., killing more than 250,000 people a year. Why there are so many mistakes, and what can be done to improve patient safety.

Leave a Comment

Help keep the conversation civil. Please refer to our Terms of Use and Code of Conduct before posting your comments.