Old Credit Card Tech Facilitates Skimming Fraud

Saturday, July 17, 2010

Robert Siciliano


Credit and debit cards in the U.S. use old magnetic stripe technology. The magnetic stripe is the black or brown band on the back of your credit or debit card.

Tiny, iron-based magnetic particles in this band store data such as your account number. When the card is swiped through a “reader,” the data stored on the magnetic stripe is accessed.

Card readers and magnetic stripe technology are inexpensive and readily available, making the technology highly vulnerable to fraud. One extremely prevalent example of such fraud is ATM skimming.

Skimming occurs when a criminal copies the data stored on your card’s magnetic stripe and burns the stolen data onto a blank card, creating a clone can that be used like any normal credit or debit card.

According to the Smart Card Alliance, twenty-two countries, including China, India, Japan, Mexico, Canada, and many in Western Europe and Latin America, are migrating to encrypted microprocessor chip and PIN technology for credit and debit payments.

These new “smart cards” contain an embedded microchip and are authenticated using a personal identification number, or PIN. When a customer uses a smart card to make a purchase, the card is placed into a “PIN pad” terminal or a modified swipe-card reader, which accesses the card’s microchip and verifies the card’s authenticity.

The customer then enters a four digit PIN, which is checked against the PIN stored on the card. The U.S. has yet to adopt the new smart card technology, possibly due to the higher cost.

According to consulting firm Javelin Strategy & Research, converting to chip and PIN technology would cost the U.S. payment card industry about $8.6 billion, which doesn’t sound so expensive to me, considering that identity theft is a reported $50 billion problem.

U.S. travelers are encountering difficulties when attempting to use old magnetic stripe credit and debit cards abroad, since their cards do not contain the new microchips. This is especially problematic at automated kiosks, which are common in Europe.

Vending machines at regional rail stations, bicycle rental racks in Paris, parking meters in parts of London, toll roads, and gas stations only accept chip and PIN cards.

Visa claims that most payment terminals in countries that have adopted chip payment technology can still process old magnetic stripe U.S. cards, and, “in the rare instance that a card holder encounters a problem” at a self-service machine, Visa advises American travelers to present their cards to attendants.

My dad has U.S.-based magnetic striped cards, and he travels all over Europe and has yet to encounter a problem paying at a restaurant or in any scenario in which the card is processed by a person.

However, CreditCards.com reports that the European Payments Council, the governing body responsible for achieving a single payments market throughout Europe, is considering a ban on old technology magnetic stripe cards.

This would cause major commerce problems in Europe and raises the question of whether U.S. credit card merchants will make the switch.

In the meantime, if you travel to Europe, make sure to carry cash. And if you are likely to use a kiosk that can only process cards with chip and PIN technology, do your homework ahead of time to determine whether an alternative payment methods is available.

Robert Siciliano, personal security adviser to Just Ask Gemalto, discusses credit card fraud on NBC Boston. (Disclosures)


Possibly Related Articles:
PCI fraud
Post Rating I Like this!
Michael Allen According to Professor Ross Anderson of Cambridge University, this technology is also fundamentally broken.

Robert Siciliano To date I haven’t seen a report of bad guys exploiting contactless payment systems.

Hackers, whether they be black-hat (the bad guys) or white-hat (security professionals) are always looking for vulnerabilities in technology. The bad guys intention is to exploit these vulnerabilities for ill-gotten gain and the security professionals do so in-order to make them more secure.

Nobody likes to expose the flaws in systems that we think are secure more than me. I love pointing the finger and saying I told you so. But here, I just do see it.

The Smartcard Alliance in response to reports of the question of security in contactless stated “Contactless smart card technology includes strong security features optimized for applications involving payment and identities. Every day tens of millions of people around the world safely use contactless technology in their passports, identity cards and transit fare cards for secure, fast and convenient transactions. Multiple layers of security protect these transactions, making them safe for consumers and merchants. Some of these features are in the contactless smart card chip and some are in the same networks that protect traditional credit and debit card transactions.”
In a controlled environment where the researcher manipulates the penetration test to come to a desired outcome that establishes vulnerability is not the same as real world penetration testing in the wild.
Ray Tan This problem has caused concern of a lot of people, we are moving forward to the smart card.
However, due to the cost, it will take a long time.
Cost is one of the biggest block to security, of course.:)
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.