Mag-Stripe Credit Cards vs. Smart Cards

Smart cards, called so because they contain a chip, have long been touted as a safer alternative to the old-fashioned magnetic stripe-bearing bank cards. However, NYT’s Randall Stross takes a swipe at this notion in a recent article.

It is a rather interesting topic, with potentially far-reaching implications, considering the break-neck speed at which the payment card industry has been evolving over the past couple of years. It seems like every week we hear about yet another start-up promising to change the way we use credit cards, if not to render them obsolete altogether.

But is the mag-stripe card really all that inferior to newer generation chip-carrying plastic rectangles, so as to deserve such a fate? Stross doesn’t think so:

Cards containing chips, called smart cards, simply cannot match something that’s supposedly dumb and has been around since the 1970s: ordinary credit cards with magnetic stripes running across their backs. The dumb cards don’t need a brain of their own: the network supplies the necessary smarts.

Now, it should be mentioned that smart cards too have magnetic stripes, which allow them to be used as regular credit cards, a vulnerability criminals have been all too eager to exploit (you’ll see how below).

Stross goes on to quote a Visa executive who explains that, in the U.S. at least, using mag-stripe cards allows his network to centralize security and quickly apply upgrades to the system. This is a valid point, however system upgrades by themselves cannot prevent criminals from using stolen mag-stripe cards.

In fact, Stross quotes another industry insider, who states that criminals are only using the magnetic portion of stolen smart cards in the U.S., because they can’t do it anywhere else. Let’s take a look at why this is the case.

In Europe, more and more countries have been adopting the chip-and-PIN technology, which was never implemented in the U.S. Chip-and-PIN credit cards contain a tiny chip that is activated by a personal identification number, or PIN. If you don’t know the PIN, you can’t use the smart portion of the card. In Europe, you may not be able to use it altogether, which is why criminals would try to use stolen smart cards at U.S. retailers.

According to statistics from the U.K. Payments Administration, the implementation of chip-and-PIN credit cards has had a measurable impact in Britain, where total losses from in-store credit card fraud have fallen from 218.8 million pounds ($356.5 million) in 2004 to 98.5 million pounds ($160.5 million) in 2008. Faced with stiffer security, however, criminals have tried to use stolen smart cards abroad:

Chip and PIN has made it harder for fraud to be committed in UK shops and cash machines. Fraudsters have instead had to turn to stealing our magnetic stripe details and PINs in the UK and then making fake cards, for use abroad in shops and cash machines still without chip and PIN protection.

So PIN protection for credit cards does work, but the system hasn’t been adopted in the U.S. That may have begun to change, however, although it won’t happen quickly. A new start-up, called Dynamics, has developed a smart card that is deactivated and unusable by default. It has a blank LED screen that hides six of the 16 digits of the account number. In deactivated state, the card’s magnetic stripe is erased, so its information cannot be read. In order to use it, the cardholder must first enter a PIN code using the five buttons located above the account number. Citibank has now partnered with Dynamics and will begin testing a version of the smart card, although it will not be the one requiring the use of a PIN. Still, it is a start.

Another smart card technology uses near field communication (NFC) frequency to transmit payment data between a smart reader and NFC-equipped cell phones. The New York Metropolitan Transportation Authority (MTA) is currently testing this technology, allowing Visa payWave and MasterCard PayPass cardholders to pay for their fares by waving their cards by the reader. The NFC frequency allows data transmission within a range of less than 8 in., limiting the risk exposure.

Eventually, new technologies will replace magnetic stripe cards and that will be a welcome development. The process will be far from smooth, but the chances that the new platform(s) will help decrease credit card fraud are better than even.

Image credit: Newsweaver.com.