Outdated Magnetic Strips: How U.S. Credit Card Security Lags
Criminals may have stolen information from 40 million credit and debit cards used at Target. The likely weakness? The magnetic stripe on credit cards — which fraudsters can pull credit card numbers and expiration dates from to make counterfeit cards.
Other countries moved beyond this technology years ago. The U.K., Canada and Hong Kong are already using chip-based cards, which are considered more secure. (Magnetic stripe technology is decades old.) Cards using the chip-and-PIN system have an embedded microchip. Instead of swiping the part with a magnetic stripe, you put the card into a terminal, then enter a PIN or sign your name. It's more expensive for criminals to forge these cards, says Brian Krebs, a security journalist who writes for Krebs on Security and broke the story on the breach at Target.
"It simply raises the costs for the bad guys," Krebs told NPR. "It's not that they can't break the system — but it makes it more expensive for them to fabricate these cards."
Visa and MasterCard have plans to introduce these cards in the U.S. in around two years. But why hasn't the U.S. already adopted this technology?
That's the wrong question to ask, says Ross Anderson, who has worked on payment technology for almost 30 years and is a professor of security engineering at the University of Cambridge.
"Simply blocking off one of the avenues of attacks by fraudsters isn't enough to make fraud vanish," he says.
It can be a game of cat and mouse. Anderson says after it became common to pay with chip-based cards in the U.K., around 2003, the level of fraud went up because thieves turned to schemes involving mail and telephone orders.
The Two-Way
Breach At Target Stores May Affect 40 Million Card Accounts