Microchips in credit cards to beat ID thieves

Microchips in credit cards to beat ID thieves
Thu Dec 22 2005

By Sarah Staples

STUNG by recent massive breaches of customer information, Canada's major banks and credit card processing companies say they will outfit MasterCards with microchips designed to thwart identity thieves and at the same time offer a range of "personalized" marketing promotions.
Bank of Montreal, National Bank, HSBC Bank Canada and Presidents' Choice are among 12 major banks and five payment-processing companies that have agreed to insert microchips into the credit cards they issue.
The new cards, due to be introduced between 2007 and 2010, will function as miniature computers running sophisticated software.
With them, businesses would be able to offer custom rewards, coupons and special promotions tailored to their customers' individual shopping habits.
The cards will also keep information encrypted and will carry a personal identification number, or PIN, as extra security features. Experts say the move -- an industry first in Canada -- represents a technological leap forward from the comparatively meagre power and security of today's PIN-less magnetic stripe cards.
And it brings Canada in line with Europe and Asia, where banks and credit-card companies have been faster to put in place new technologies designed to counter fraud and offer personalized shopping experiences.
Microchipped credit cards are "the natural evolution from the magstripe, much like people moved from film to digital cameras," said William Giles, vice-president of distributed product management for MasterCard Canada.
Although the agreement commits most major Canadian banks to issue microchipped MasterCards, the timing of the rollout is voluntary.
However, "I think you'll find it difficult to find a card in the market that doesn't support chips after (2010)," Giles said.
The chip-embedded cards will be used to launch a suite of MasterCard-brand marketing initiatives dubbed OneSmart.
Aside from custom coupons and rewards, the MasterCards would double as a contactless pay system -- a "smart card," in other words, that could speed customers through busy checkout lines by letting them simply wave or tap the card at a reader-cum-cash register ECR.
The OneSmart Authentication system would introduce new security checkpoints for purchases both in stores and online. Before doing any online shopping, customers would introduce their credit card into a calculator-sized reader, enter their PIN and receive a one-time use number to enter into shopping websites or give over the phone.
The two-step verification process establishes that the PIN was entered correctly, using an authentic number, and that the credit card is in the hands of its rightful owner, he said. The spokesman would not confirm whether the additional measures are being introduced in response to an incident in June that saw as many as 40 million mostly U.S. Visa and MasterCard holders exposed to identity theft when hackers penetrated the defences of CardSystems Solutions Inc., an Atlanta credit-card payment processor.
Cardholders are "fully protected" from financial liability in the event their card is hacked or physically stolen, Giles said, "but the real value is in all the other stuff (the new smart credit card) will provide."
Ryan Purita, of Totally Connected Security, is a Vancouver forensic computer examiner who is one of a handful of experts in Canada certified to testify in court cases. Purita called the addition of PINs and encryption "definitely a step in the right direction," adding it could eliminate an illicit practice known as "skimming" altogether.
Skimmers install card-reading devices near ATM machines that illegally swipe credit-card numbers and associated security codes.

More