Fighting fraud with chip & PIN

The popular but precarious signature-based magnetic strip credit card system is on its last legs, globally.

Today, it’s practically obsolete in Europe and the UK following a surge in counterfeit fraud; replaced by what’s deemed to be the more secure EMV chip technology, aka ‘chip and PIN ’.

Formed in February 1999, EMV is the technical specifications group that outlines the interaction between chip cards and terminals to ensure global interoperability, created by Europay International, MasterCard International and Visa International.

According to James Turner, advisor at analyst firm IBRS, the EMV standard presents a means of strong authentication: “By combining the chip and the PIN I have given two factors of authentication: something I had (the chip) and something I knew (the PIN).”

Aesthetically, a chip card mirrors that of a magnetic strip card, except it data is stored on an embedded encrypted microchip rather than on the magnetic strip. This in turn makes it allegedly difficult to defraud.

“The chip itself is designed to make the credit card harder to counterfeit,” explained Mike Bond, security director at UK-based Cryptomathic, a provider of e-security software including e-banking, two-factor authentication and EMV card issuing.

“The chip contains some secret information, a secret key [cryptography] that’s shared just between the chip and the customer’s bank, and that means that if you copy it you can’t get at the secret and so you can’t make a perfect copy.”

Peter Roeleven, general manager, Working Capital Services Transaction Products at National Australia Bank (NAB) – set to begin its roll-out of chip cards soon – explained that the nature of the way the chip interacts with the terminal, means that the ability for someone to use a counterfeit or copied card is virtually non-existent.

“I’ll never say absolutely non-existent because there’s always the game of staying one step ahead, but it makes it extremely difficult; then some would argue impossible for someone to counterfeit the card.”

Today, chip cards are prevalent in 45 countries, according to self-regulatory body the Australian Payments Clearing Association (APCA). In its 2007 annual review APCA reported that the United Kingdom alone has more than 100 million chip cards on issue.

According to Visa Asia, Europe is the most advanced region for EMV migration in the world where the UK, France, Spain and Italy committed to migration by the end of 2004.

Surprisingly, the US is just starting to get on board. Furthermore, as of June 2006 Japan had more than 30 million Visa EMV chip cards whilst more than 90 percent of terminals in Taiwan were EMV compliant; Singapore had 80 percent and still growing.

Fraud

Mass adoption of chip cards in Europe and especially in the UK has caused a dramatic decline in card present fraud rates instances where the card and the card holder are present for the transaction, in that region.

Financial institutions were worried about the rising instances of fraud, particularly of card counterfeiting, explained Cryptomathic's Mike Bond, while delving into UK’s fraud problem.

“A big organised crime industry has its own production lines, like black-market production lines, of counterfeit goods that you hear all about in China – except for credit cards.

"So they were churning out made-up credit cards using details that had been captured and then having people spending money on these counterfeit cards,” he said.

That was one problem with signature and magnetic strip credit cards, the other was the common typical incident of people using stolen cards to make purchases and payments.

“Steal someone’s handbag and go on a spending spree when signatures were not verified properly – people could actually do quite a lot of damage on a stolen credit card,” said Bond.

According to Card Fraud Facts and Figures from APACS – the UK Payments Association, in 2006 total card fraud losses fell by three percent in the UK to £423 million (A$905 million); ‘face-to-face fraud continued to drop’; ‘lost and stolen card fraud showed an overall decrease on 2005; ‘counterfeit card fraud increased by just three percent to £99.6 million (A$ 213.million), showing a further fall in growth rate from 2005”.

The same effects are taking place in Asia, especially in Malaysia, where the country’s domestic counterfeit fraud has virtually disappeared in the first quarter of 2006 from US$677,000, according to Visa Asia.

“The rate of fraud has halved in the past five years in APAC and if you look at somewhere such as Malaysia they’ve had an extensive chip program and fraud there has nearly been eliminated,” said Andrew Woodward, director of communications for Visa Australia.