The recent theft of personal information of millions of Target and Neiman Marcus shoppers in the US has, in
addition to the crooks behind the heist, thrown up a rather unlikely culprit - the magnetic strip in the card itself. In what would seem to a belated exercise in the context, a new technology is on the way, in the US- the EMV chip card. The inability of magnetic strip technology to safeguard the critical account and personal data it contained was known since long, and the heist had served to highlight the need to junk the technology known to be vulnerable all these years. Forbes quoted Lamar Bailey, director of security research for Tripwire, a data security firm that worked with companies like Visa, MasterCard and Safeway, saying the magnetic strip contained all the data needed for credit card fraud. He added these strips were very easy to read and duplicate and were a favorite target for a wide variety of financial fraud. The so called EMV cards, derived from Europay / MasterCard / Visa were introduced in Europe in the 1990s and according to Robert Siciliano, the CEO of IDTheftSecurity.com, the cards contained an embedded microchip that was authenticated using a personal identification number, or PIN. He added, when a customer used a smart card to make a purchase, the card was placed into a PIN pad terminal or a modified swipe-card reader, which accessed the card's microchip and verifies the card's authenticity. The customer then entered a four digit PIN, which was checked against the PIN stored on the card. Smart cards, therefore raised the security bar higher to protect against identity theft, and offered a good explanation as to why global cyber criminals had targeted the US. It also meant that, whenever possible, American consumers needed to choose a payment card that offered EMV chip protection, which was particularly true for the growing number of Americans who utilised prepaid debit cards. For many credit and debit card issuers in the US, the change was underway and the completion was expected by 2017. Meanwhile, Tom Gara of The Wall Street Journal's business news blog, Corporate Intelligence, spoke to MasterCard's Carolyn Balfany, the company's expert on EMV. Responding to a question as to why the switch to EMV had taken so long in the US, she said other countries had migrated to EMV because of the higher fraud rates, which they wanted to combat. Secondly the system could operate in the offline mode-ie the card and terminal could authorise a transaction independent of communication with the bank's systems. In the other markets, telephony networks were not as robust as in the US, so the offline capacity was attractive. However, as the other markets switched to EMV, fraudsters turned to markets with lower security and the US. In response to whether the new system had anything more to offer apart from enhanced security, she said the migration really was not about a single device or technology, but about establishing a technological platform for the next generation of payments. The EMV standard that is being introduced in the US is not limited to chip and PIN cards, but also includes contactless payments, where one could tap the card against the reader, with the same level of security. ''Card issuers will probably always issue a card, but in this system an account can be resident in multiple places – so you can have the card, but also maybe a tag affixed to your phone for mobile payments, or a fob on your key ring'', she said. Meanwhile in India the implementation of EMV standard by Indian banks may not happen soon, despite the RBI directive to banks to implement the technology by 30 June, 2013. Though SBI Cards has taken the lead in replacing its cards with those embedded with a chip, other issuers site problems of logistics in switching over. CIOL, in a feature on the subject published on 2 July 2013, quoted B R Bhat, CIO, Corporation Bank, as saying that the bank had issued 10 million debit / credit cards and all these could not be replaced at once. He added, the cost of issuing an EMV card was five times higher than Master/Visa Card, which had to be borne by the banks. Source: Domain-b.com
