Are Chip Cards Counterfeit-Proof? Not Exactly

counterfeit-chip-card

Computer researchers may have found a flaw in chip-based credit cards. Though the cards are designed to combat fraudulent cloning, apparently there’s a way to rewrite the magnetic strip code so it resembles the standard Europay, MasterCard and Visa (EMV) card.

Researchers at the payment technology company NCR presented their findings at the Black Hat computer security conference last Wednesday, CNN Money reported. “There’s a common misperception EMV solves everything,” Patrick Watson, one of the researchers, reportedly told the site. “It doesn’t.”

All a thief has to do is alter the data on the magnetic stripe so that it fools the terminal, the researchers said. As a result, the researchers suggested retailers encrypt whatever they can to help protect customers.

For their part, major machine makers Verifone and Ingenico said that they offer end-to-end encryption on retailer’s machines, CNN reported. Meanwhile, Jason Oxman, a spokesperson for the Electronic Transactions Association, a trade group, said via email that the issue “actually has nothing to do with the chips” at all. Here’s why:

“Every magnetic stripe on a chip-enabled card has a code on it that tells the POS at a retailer that if the customer tries to swipe the card, they should be prompted to insert the chip card instead. This ensures that the chip is used instead of the magnetic stripe. What this researcher figured out a way to do is alter the code on the magnetic stripe to say to the POS ‘I am not a chip card,’ and then to ask the POS to send the transaction to the issuing bank for approval as a magnetic stripe transaction. This is called a fall back transaction because the transaction should be a chip transaction, but it will fall back to a magnetic stripe transaction.

The issuing bank, when it receives the authorization request, will know that the card is a chip-enabled card [despite] the bad code on the magnetic stripe card, and the issuing bank will make the decision whether to approve the fall back transaction or not, based on a variety of factors. (The hacked code on the magnetic stripe card can only fool the POS, not the issuing bank.)”

Doug Johnson, senior vice president of the Payments and Cybersecurity Policy division at the American Bankers Association, said it’s important to remember banks’ additional protections for customers.

“End-to-end encryption is an important security measure for retail point-of-sale transactions that merchants have endorsed and should implement,” he said. “At the same time, it is important to remember that bank customers will be fully reimbursed for any unauthorized transaction against their account.”

If you carry a chip card and believe you’ve been a victim of fraud, you’ll want to contact your credit issuer immediately to cancel the card. After that, it’s a good idea to monitor your credit reports for any additional signs of trouble. (You can see your free credit report summary, updated monthly, on Credit.com.) You may also want to change your financial account passwords and pins to be on the safe side.

Image: alice-photo

The post Are Chip Cards Counterfeit-Proof? Not Exactly appeared first on Credit.com.

Why You May Start Seeing More Chip Card Readers Soon

chip-credit-card-readers

The switch to chip-enabled credit cards last year came with a serious deadline: New rules went into effect in October making merchants more liable for fraud.

As is obvious to everyone who’s swiped when they should have inserted their card at a checkout line, the changeover hasn’t gone as smoothly as hoped. So, quietly, the credit card associations have taken steps to roll back the rules surrounding the changeover. The steps should be welcomed both by merchants, who will see their liability for fraudulent charges reduced, and consumers, who will soon see more chip-card machines as a result.

The new EMV credit cards were designed to take a bite out of credit card fraud. But in some cases, they’ve taken a bite out of merchant profits instead.

As of October of last year, merchants hit with fraud who weren’t using chip cards were declared responsible for counterfeit fraud by credit card associations Visa and MasterCard. The rule was intended to be the ultimate motivator to shift to EMV, encouraging stores to spend the $1,000 or so to upgrade their point-of-sale terminals.

Hundreds of millions of EMV chip cards have been put in the hands of consumers in the past year, and many are working as advertised at 1 million-plus merchants. But some stores have been slow to turn on chip card readers – they blame banks for a backlog in certifying the machines — which has led to huge fraud bills. One lawsuit alleged that some merchants have seen fraud rates rise 20-fold while they are waiting for new chip readers they purchased to get the green light from bank partners.

Other reporting by Credit.com found that in March, four out of five chip card readers weren’t turned on. (Again, a backlog in certification was blamed.) Perhaps in response, Visa announced in June that it was placing limits on the amount of fraud that non-EMV merchants could face. They also said they were working to streamline certification.

Effective July 22, Visa said it would temporarily prevent banks from forcing merchants to pay for counterfeit card frauds less than $25. Starting in October, banks will be limited to 10 counterfeit chargebacks per merchant account.

“These two changes together will significantly reduce the number [of] chargebacks that merchants are seeing,” Visa said in its statement. “Following these changes, merchants can expect to see 40% fewer counterfeit chargebacks, and a 15% reduction in U.S. counterfeit fraud dollars being charged back.”

The blocks will remain in effect until April 2018, when, theoretically, the kinks in the EMV conversion will be fixed. Visa also promised to give banks greater discretion in certifying EMV terminals, which should help merchants turn on all those chip readers.

“Visa recognizes the importance of having the industry help merchants get their chip terminal solutions up and running quickly so that everyone, especially consumers, can benefit from the powerful security protection of chip technology,” said Oliver Jenkyn, Group Executive North America, Visa Inc. “We’ve taken steps to simplify the process as much as possible and help reduce any challenges so merchants can move forward with chip adoption quickly.”

Fraud analyst Avivah Litan from consultancy Gartner Group applauded the move. “This is really meaningful,” she said. “The merchants must be getting totally slammed with every chargeback on the books.”

Also in June, MasterCard announced a similar program to speed up point-of-sale certification. In a statement, the association said it “continuously evaluates thresholds” relating to chargebacks.

“The whole industry wins when action is taken against counterfeit card fraud. Reducing terminal certification-testing time to a couple of hours from as long as a couple of weeks is one positive step we can take in a more mature market,” said Chiro Aikat, senior vice president of product delivery, EMV, for MasterCard.

Remember, EMV chip cards can help reduce fraud, but they’re not a fail-safe. In fact, the chip doesn’t protect your payment information when you’re shopping online, so it’s still a good idea to stick to trusted websites and monitor statements regularly for unauthorized charges. And, if you ever have reason to believe your personal information was compromised alongside your payment cards, it’s a good idea to monitor your credit for signs your identity has been stolen. You can do so by pulling your credit reports for free each year at AnnualCreditReport.com and viewing two of your credit scores for free each month on Credit.com.

Image:Rostislav_Sedlacek

The post Why You May Start Seeing More Chip Card Readers Soon appeared first on Credit.com.

10 States Where You Can Definitely Put Your Chip Card to Use

chip-card-to-use

You’re probably familiar with this situation: You’re at the register, get your plastic out to pay, and then wait for the store clerk to tell you whether you’re supposed to insert your chip-enabled credit card in the terminal or swipe the card.

Given new network fraud liability rules went into effect in October 2015, magnetic strip credit cards have been steadily replaced with EMV-enabled chip cards, so many Americans carry them now. However, that doesn’t mean we are using them every time we make a purchase, as not every retailer has flipped the switch on the updated technology yet.

But, according to the Visa U.S. Chip Update report for June 2016, the U.S. added more than 100,000 chip-enabled merchant locations in June of this year. With this increase, an estimated 28% of merchants now use this technology, making the U.S. the largest chip market in the world, the report notes.

And, even though Visa reports that our country is now chip-laden, all states are not equal when it comes to adapting to this technology. It is slowly rolling out nationwide, and cards can still be used in all states, but New Jersey is noted as having the largest percentage of chip-ready merchants followed by Pennsylvania, California, Connecticut and Florida, where one in three merchants are chip-enabled.

These are the 10 states with the most merchants who are chip-ready.

  1. New Jersey
  2. Pennsylvania
  3. California
  4. Connecticut
  5. Florida
  6. Michigan
  7. New York
  8. Delaware
  9. Ohio
  10. West Virginia

Methodology

Information about U.S. merchant locations is based on VisaNet data as of the end of June 2016. Visa reviewed operating certificate data from client financial institutions at the end of March 2016 to evaluate global card usage. Visa also compared chip-enabled merchants’ data from March 2016 to March 2015, using both U.S.-issued credit and debit cards, to review counterfeit fraud data.

The Visa report noted that chip technology may have played a role in decreasing credit card fraud, with chip-enabled merchants seeing a 35% drop in counterfeit fraud in March 2016 compared to the same month previous year.

Protecting Your Credit Card Information

Still, no matter whether your local merchants have upgraded to chip technology or not, nothing is fool-proof. EMV chips may provide extra security in-store, for instance, but they don’t guard against theft online. This is why it’s a good idea to check your credit card statements every month for fraudulent charges.

And, if you have reason to believe your personal data has been compromised, you can review your credit reports as well. When reviewing your reports you want to look for signs your identity has been stolen, like a sudden drop in your credit scores or new accounts showing up that you don’t recognize. You can get a copy of your annual credit reports for free at Annual CreditReport.com and you can see your free credit report summary, updated each month, on Credit.com.

More on Credit Cards:

Image: Petar Chernaev

The post 10 States Where You Can Definitely Put Your Chip Card to Use appeared first on Credit.com.

Do I Need a Chip & PIN Credit Card When I’m Abroad?

looking_for_credit_card

Consumers are starting to notice a growing adoption of embedded microchips in credit cards as opposed to magnetic stripes. These chips, often called EMV smart chips, have been in use in Europe and other parts of the world for more than a decade. Now that U.S. consumers are being issued cards with these chips, it would appear these cards would be compatible with credit card terminals around the world.

Unfortunately, that’s not always the case.

Two EMV Chip Implementations

There are two different ways EMV chips can authenticate transactions. The first is called chip and signature, and it works like traditional credit cards. Once the card is authenticated in the retailer’s terminal, a customer signs the receipt electronically or on paper. The other implementation is called chip and PIN and works more like an ATM card. The merchant’s credit card reader authenticates the transaction, and then the cardholder is required to enter a four-digit personal identification number, or PIN.

Where Each System Is Used

According to the nonprofit Smart Card Alliance, credit cards with microchips are currently accepted in more than 80 countries worldwide. In the U.S., chip and signature is becoming the standard, as migration to chip-enabled credit cards began in 2015. In Europe and other parts of the world, chip and signature is used for most transactions, but chip and PIN is often the standard for unattended terminals such as those at train stations, toll booths and gas pumps.

Should you encounter a terminal requiring a chip and PIN transaction but have a card with a chip and Signature implementation, you won’t be able to use it. Needless to say, this can be a major inconvenience since these merchants are theoretically supposed to have an attendant nearby to manually process the card. 

It’s a dilemma that’s plagued Americans traveling abroad for years, but fortunately it’s starting to change. Some credit card issuers, like Barclaycard, are giving customers cards compatible with the Chip and PIN implementation. Other card issuers plan to offer compatible cards later this year. In addition, Visa recently changed its acceptance rules to require businesses with unattended terminals to accept international chip cards without PINs or signatures regardless of an attendant’s presence. That should help travelers use their chip cards at train ticket kiosks, bike-sharing stations, vending machines and parking meters without problems.

Interestingly, Visa has even sent teams of secret shoppers to test for compatibility in countries such as Denmark, France, Italy, Spain and the U.K. It found more than 90% of transactions were approved without chip-and-PIN cards, up sharply from previous surveys. The 10% of declined cards was due to a number of factors, not just a lack of Chip-and-PIN compatibility.

By knowing how chip-enabled cards can be read, you’ll be better equipped to use your credit card anywhere in the world. You can check out some of the best cards to travel with here.

Remember, high credit card balances can hurt your credit, since the amount of debt you owe versus your available credit is a major factor of credit scoring models, like FICO. You can see where you currently stand by viewing your two free credit scores, updated each month, on Credit.com.

At publishing time, Barclaycard products are offered through Credit.com product pages, and Credit.com is compensated if our users apply and ultimately sign up for these cards. However, this relationship does not result in any preferential editorial treatment.

Note: It’s important to remember that interest rates, fees and terms for credit cards, loans and other financial products frequently change. As a result, rates, fees and terms for credit cards, loans and other financial products cited in these articles may have changed since the date of publication. Please be sure to verify current rates, fees and terms with credit card issuers, banks or other financial institutions directly.

More Money-Saving Reads:

Image: Wavebreakmedia Ltd. 

The post Do I Need a Chip & PIN Credit Card When I’m Abroad? appeared first on Credit.com.