When you’re out there doing your holiday shopping and you hand your credit or debit card to the store clerk, keep a keen eye on what he does with your card. Credit card skimming is on the rise, and we have 30-year-old technology to blame for it.
This week’s article is a little off-topic for “IT best practices,” but it is data security and technology related. And, the timing is perfect, considering we are now in the midst of the busiest shopping season of the year. Let’s talk about all those reports and warnings in the news lately about credit card skimming. The warnings are scary, and it’s almost enough to make you put the credit card on the shelf and — sorry, American Express — “leave home without it.”
Skimming is the illegal act of copying the information stored on the magnetic stripe of a credit or debit card, using a small device called a skimmer to capture the data electronically. In the case of a debit card where the card owner uses a PIN to initiate a transaction, the thief uses a strategically placed camera to capture the consumer’s PIN as he types it in. The skimmer might be placed over the real card slot of an ATM device, or held in the hand of a merchant employee who is using your card to complete a transaction in a store or restaurant.
Holiday Gift Guide: Cool Yule Tools
Analysts at Javelin Strategy & Research say that skimming is on the rise, with losses now approaching $1 billion. Almost 1 in 5 fraud victims in 2009 reported having his credit or debit card PIN information stolen. The Secret Service Electronic Crimes Task Force is trying to get the word out that all electronic card users need to be vigilant.
But why is skimming on the rise, particularly now? In part, the increase can be attributed to a change in card security technology outside the United States. Almost every major financial market except for the United States has adopted a more secure type of technology for credit and debit cards. This is pushing thieves to operate where security is weak, and unfortunately, that is the United States at this time.
The weakness is that magnetic stripe on the back of our cards. Using technology that has been around for three decades, that stripe is encoded with enough information to allow a thief to use your personal account to make illicit purchases or withdraw funds from an ATM. The data on the stripe is static; it never changes from the time the card is issued until the card is destroyed or deactivated. All it takes is one pass through a skimming device for your information to be captured by a miscreant, and from there the data can be imposed onto a “white card” — a counterfeit card that works just as well as the original.
The technology that is supplanting magnetic stripe in other countries is called EMV chip + PIN. “EMV” comes from Europay, MasterCard and Visa, the three organizations that originally developed the technical specification for how payment cards based on this new technology interact with ATMs and point-of-sale (POS) devices. The EMV chip + PIN technology uses a chip embedded in the card to store and transmit account information to a card reader when the card is used in a transaction. In addition, the cardholder must enter his PIN into the ATM or POS terminal. The PIN that is manually entered is validated against the PIN that is stored on the card’s computer chip. If they don’t match, the transaction won’t go through.
Chip + PIN technology has another advantage: the data doesn’t need to be static, as it does on a magnetic stripe card. Because the chip data can vary, some companies in the payments industry have developed solutions around dynamic data, where the consumer’s account data on the card changes frequently. If the card is breached and the data is stolen, it is only usable one time, if at all.
By now you must be wondering why the U.S. financial industry hasn’t adopted EMV chip + PIN technology to protect consumers from skimming fraud. The primary reason is the cost of replacing the entire infrastructure that currently supports the magnetic stripe cards. Today there are more than a billion — that’s billion, with a “b” — credit and debit cards in the United States, and almost all of them have magnetic stripe technology. There are more than 15 million point-of-sale devices in every conceivable business from retail stores to restaurants to service kiosks, as well as more than 360,000 automated teller machines. All of this infrastructure would be rendered obsolete if we wanted to make a wholesale switch to EMV chip + PIN. Experts conservatively estimate the replacement cost to be around $8 billion.
That doesn’t mean that cards based on magnetic stripe technology and static account data are certain to be compromised. The players in the U.S. financial industry — card issuers, banks, payment networks, etc. — all know the inherent weaknesses and have implemented extensive compensating controls to prevent or at least limit fraud. For example, one anti-fraud measure checks to see when and where a card is being used. If the same card number is presented in two geographically dispersed locations within a very short period of time, it can be assumed that at least one card is counterfeit because of the physical impossibility of being in two places at once.
As for card skimming, here are a few “consumer best practices” to keep your card and your account safe:
* Inspect ATMs and POS devices for skimmers , especially at gas stations. View this blog post for tips on how to spot a fake card reader device. Be aware that some fakes are so good that even employees of the bank or retail outlet can’t detect them.
* Pay attention to who has your card. If paying a bill at a restaurant, ask the waiter if a card reader can be brought to your table instead of letting him take the card from you.
* When using an ATM or POS device, cover your hand when typing in the PIN. This might prevent a camera or “shoulder creeper” from observing your PIN.
* Check your credit card and bank statements regularly — as often as every few days if possible. Your liability for fraudulent use of your card is limited if you report a problem promptly.
* Use ATMs in well-lit, high-traffic areas that are under video surveillance. They are less likely to have been compromised.
