Credit card's magnetic stripe vulnerable
Consumer credit cards are shown in North Andover, Mass., Match 5, 2012. Shopping and swiping your credit card could leave you at risk for fraud. So can dining and paying for your meal with a swipe of your credit card. THE CANADIAN PRESS/AP/Elise Amendola
MONTREAL - Shopping and swiping your credit card could leave you at risk for fraud. So can dining and paying for your meal with a swipe of your credit card.
Even though Canadians are increasingly using credit cards with chip and personal identification number (PIN) technology, there are still some businesses that rely instead on the swipe of a card's magnetic stripe to process transactions electronically.
"There is a misconception among consumers that if you have a chip and pin number, that credit card fraud isn't going to exist," McAfee online security expert Robert Siciliano said.
Credit card fraud will continue until the magnetic stripe, which can also access account information, is phased out and taken off the card, Siciliano said.
Thieves know they can still win big with the card's magnetic stripe and consumers need to pay close attention to their monthly statements for unusual charges, he said.
"These organized criminals are actually packing up, they're leaving their home country and flying into countries where those cards exist," Siciliano said from Boston.
They set up shop, swap point-of-sale terminals at stores and restaurants and install skimming devices on automated teller machines because they know the "clock is ticking" on credit card swiping, he said.
Siciliano said the United States, where chip and PIN technology isn't wide spread yet, is the main target — but Canada isn't immune.
"They know that the countries that have that technology still in existence will eventually go to chip and PIN. There's a tremendous amount of money to be made right now and all studies point toward a rise in these crimes."
In Montreal, RCMP recently dismantled an international criminal ring alleged to have been involved in a $100 million debit-and- credit-card scam.
RCMP have said the criminal ring's most popular scam involved stealing point-of-sale terminals — in which consumers insert their credit cards and enter a PIN number — from businesses and modifying them to steal credit card information.
RCMP said the terminals were rigged using short-range wireless technology to relay information to fraudsters remotely.
Visa Canada's Michael D'Sa said data on a credit card's magnetic stripe isn't encrypted.
But banks already do a higher level of scrutiny before approving a transaction with only a credit card's magnetic stripe, which helps detect fraud, he said.
If the magnetic stripe was copied and used fraudulently at a chip and PIN terminal, the bank would be "suspicious" as to why the chip wasn't read to process the sale, said D'Sa, head of payment system security at Visa Canada.
So far, the encryption on the card's chip has not been cracked by thieves, D'Sa said from Toronto.
"As cards expire, the banks have to issue the chip card with even greater encryption. Basically it's like having a bigger lock on your front door."
McAfee's Siciliano said the chip and PIN technology has been "cracked" in a controlled environment in a laboratory, but to his knowledge there are no known cases of thieves doing so. It's a much more secure technology, he added.
"If and when that day ever happens, there will be serious consequences to that."
Visa Canada said it's not able to disclose a timeline to phase out the magnetic stripe on its credit cards, and there would have to be complete migration to chip and PIN technology before it could be considered.
Visa Canada said fraud involving Canadian credit cards was $436 million in 2011, up slightly from 2010.
MSN.ca Money's editorial goal is to provide a forum for personal finance and investment ideas. Our articles, columns, message board posts and other features should not be construed as investment advice, nor does their appearance imply an endorsement by Microsoft of any specific security or trading strategy. An investor's best course of action must be based on individual circumstances.
Should new wireless companies Mobilicity, Wind Mobile and Public Mobile be allowed to fail?
Thanks for being one of the first people to vote. Results will be available soon. Check for results
- Yes, the market will decide if they are competitive enough to survive.
- No, the playing field in the wireless market is not level. The government should help these companies.
- I don't know.