Outdated Magnetic Strips: How U.S. Credit Card Security Lags | WAMU 88.5 - American University Radio

NPR : News

Filed Under:

Outdated Magnetic Strips: How U.S. Credit Card Security Lags

Criminals may have stolen information from 40 million credit and debit cards used at Target. A possible weakness? The magnetic stripe on credit cards — which fraudsters can pull credit card numbers and expiration dates from to make counterfeit cards.

Other countries moved beyond this technology years ago. The U.K., Canada and Hong Kong are already using chip-based cards, which are considered more secure. (Magnetic stripe technology is decades old.) Cards using the chip-and-PIN system have an embedded microchip. Instead of swiping the part with a magnetic stripe, you put the card into a terminal, then enter a PIN or sign your name. It's more expensive for criminals to forge these cards, says Brian Krebs, a security journalist who writes for Krebs on Security and broke the story on the breach at Target.

Target didn't give details on how the breach occurred. But Krebs, citing credit card industry sources, reported that it involved "the theft of data stored on the magnetic stripe of cards used at the stores."

The newer chip-and-PIN technology "simply raises the costs for the bad guys," Krebs told NPR. "It's not that they can't break the system — but it makes it more expensive for them to fabricate these cards."

Visa and MasterCard have plans to introduce these cards in the U.S. in around two years. But why hasn't the U.S. already adopted this technology?

That's the wrong question to ask, says Ross Anderson, who has worked on payment technology for almost 30 years and is a professor of security engineering at the University of Cambridge.

"Simply blocking off one of the avenues of attacks by fraudsters isn't enough to make fraud vanish," he says.

It can be a game of cat and mouse. Anderson says after it became common to pay with chip-based cards in the U.K., around 2003, the level of fraud went up because thieves turned to schemes involving mail and telephone orders.

Eventually, criminals figured out how to make fake terminals that steal information from the card. Also, the cards still have magnetic strips, in case European cardholders want to travel abroad. According to Krebs, some criminals simply steal the information from the cards in Europe, and because they can't pay with magnetic stripe cards over there, they send the information to crooks in the U.S. for illegal shopping sprees.

Americans are actually lucky, says Anderson, because they have the thing that matters more than technology — consumer protection.

"If there's fraud, the issue is who pays for it; is it me or is it the bank? And if the bank is running the system, then I want the bank to pay for the fraud," Anderson says. "American citizens are lucky because [since the 1970s and early 1980s, they have] very strong consumer protection in the form of Regulation E, Regulation Z and various decided court cases."

If U.S. cardholders become victims of credit card fraud, they can call their bank and be done with it, losing at most $50 or so. In the U.K., for instance, cardholders have to write a letter to file their claim.

"The U.S. is ahead in terms of consumer protection, and if you're thinking about the public interest and how things affect you as a bank customer, that's by far the most important thing," Anderson says. "How the banks use technical mechanisms to limit their own exposure then simply becomes an engineering problem for them to solve."

He says this consumer protection is why online shopping took off in the U.S.

Starting Oct. 1, 2015, Visa will encourage the use of the new chip-embedded cards in the U.S. After that, if someone uses a chip card at a store that hasn't adopted the new terminals for reading chip cards, the store may be responsible for any fraud that happens.

Anderson also says this is an exciting time for payment technology. There hasn't been much innovation for the past 30 years or so, but he says mobile payment systems like Google Wallet could be widely used in five to 10 years.

Copyright 2013 NPR. To see more, visit http://www.npr.org/.

NPR

These 'True Tales' Add Nuance To The Immigration Discussion

President Obama announced an executive action on immigration this week. For an in-depth look at the issue, author Gustavo Arellano recommends two nonfiction collections about Mexican immigrants.
NPR

Need A New Sweet Potato Recipe For Your Thanksgiving Table? Try Gnocchi

Because some cooks like to mix it up for Thanksgiving, we offer a Found Recipe from our archives: Julia Della Croce's purple sweet potato gnocchi.
NPR

House Panel Finds 'No Intelligence Failure' Before Benghazi Attack

The final report by the House Intelligence Committee concludes the CIA "ensured sufficient security for CIA facilities in Benghazi and ... bravely assisted the State Department" on Sept. 11, 2012.
NPR

Electric Bikes, On A Roll In Europe, Start To Climb In U.S.

Electric bicycles have been popular in Europe for some time. But recently there has been a surge in U.S. sales amid changing perceptions that e-bikes aren't just for the elderly.

Leave a Comment

Help keep the conversation civil. Please refer to our Terms of Use and Code of Conduct before posting your comments.