US lags in credit card security
Target data breach highlights problem of old technology that leaves millions of American consumers wide open to high risk of fraud
The massive data breach at Target this past week has again highlighted how the United States remains a relatively insecure backwater when it comes to credit card technology.
Over the last decade, most countries have moved towards using credit cards that carry information on embeddable microchips rather than magnetic strips. The additional encryption on so-called smart cards has made the kind of brazen data thefts suffered by Target almost impossible to pull off in most other countries.
Because the US is one of the few places yet to widely deploy such technology, the nation has increasingly become the focus of hackers seeking to steal such information.
The stolen data can easily be turned into phoney credit cards that are sold on black markets around the world.
"The US is one of the last markets to convert from the magnetic stripe," said Randy Vanderhoof, director of the EMV Migration Forum. "There's fewer places in the world where that stolen data could be used. So the US becomes more of a high-value target."
EMV stands for Europay, MasterCard and Visa and is the technology standard that involves placing an integrated circuit of some kind onto a credit card. Most European and Asian countries began adopting the technology a decade ago, pushed by regulators in those countries.
About 80 countries use smart credit cards, which allow for greater encryption and security. By comparison, only about 1 per cent of credit cards issued in the US contain such technology.
Smart cards in most countries are so widely adopted that US travellers are running into problems using their magnetic stripe cards when they travel abroad. Banks and credit card companies often advise customers to request a smart credit card they can use for foreign travel.
The reason such technology has been embraced is simple: Hacking into a system to collect information on a chip and then creating a counterfeit credit card using similar technology is too complicated. As a result, hackers have increasingly turned to the US, where the cards are significantly easier to duplicate because information is stored on a common magnetic strip.
"The US is slowly issuing these cards to users," said Joram Borenstein, vice-president of security advisory Nice Actimize. "It's harder to commit fraud against these cards. You have to steal the chip information, and that's a lot more difficult."
The US lags so badly in adopting smart cards because there has not been the political will to demand that businesses and financial institutions make the change.
Analysts also say the payment processing system in the US is more complicated, with merchants, credit companies and banks reluctant to spend the big bucks it would take to convert a system with 1 billion credit cards to EMV from magnetic stripes.
"Moving in that direction is going to be costly for the card industry and retailers."
The good news for consumers is that the US is indeed moving to embrace smart credit cards. In the last couple of years major card issuers have laid out road maps for upgrading the card technology, and many have set out to achieve this by October 2015.
Still, it will take a while for the switch to happen.
Vanderhoof's organisation estimates there are 10 million to 15 million smart credit cards now in the US. It projects that number to grow to 50 million to 70 million by next year.
Several observers noted that it was possible the latest breach at Target would provide additional financial and political momentum to make the switch happen faster, though Vanderhoof cautioned it was too soon to say.
