Taking a swipe at credit card fraud

The credit card industry has one big headache that refuses to go away. To be more specific, it’s a $2 billion headache. It seems that as technology progresses, so do the crooks.

Skimming, one of the most prevalent methods utilized by criminals around the world (it’s the number three problem in the US and number one in Asia), is creating huge losses for banks and aggravating cardholders. According to the Nilson Report, a US publication covering the consumer payment industry, skimming costs the industry $111.64 million in America alone. In Asia Pacific, fraud-prone counties include Malaysia, Japan, Hong Kong, Taiwan and Australia. In Malaysia alone, 80 percent of credit card fraud is due to skimming.

With skimming, criminals don’t even have to steal your card to be able to use it. Instead, they steal your information encrypted in the magnetic strip (or magstripe) at the back of your card when you use it in a store or restaurant (with the merchant as accomplice,) and other means. With a pocket-size device called skimmer, they will swipe your card, copy the information – billing address, account status, mother’s maiden name, etc. – and then produce multiple cards with your information. You still have your card in your wallet, but someone else is buying that Hermes bag you really can’t afford, or that Rolex watch you said you’ll buy if you remain a good girl all year. These criminals shop without shame around the world – not even author Sophie Kinsella’s Becky Bloomwood can hold a candle to them. And then they’ll sell these items, and send you the bill, so to speak.

Enter MasterCard International, or as they like to put it, the credit card accepted in 28 million establishments – any one of them can be swiping a skimmed credit card at this very moment without knowing it! – and carried by 1.7 billion cardholders.

MasterCard is taking a giant leap to curb skimming with a new system called Magneprint. In a conference held last week in Kuala Lumpur, Malaysia, MasterCard officers announced the results of a beta test done in Malaysia and the how a skim-free future might look.

The Magneprint system was invented by Professor Ronald Indeck, director of the Magnetics and Information Science Center at Washington University. In 1994, Indeck and his colleague Marcel Muller made what the university calls "the most striking engineering insights of the decade." And like most discoveries, this one was accidental.

"They were studying data density when they made the discovery," says Kiran Gandhi, vice president of MagTek Inc., a company that manufactures magnetic stripe and smart card readers for retailers and financial institutions, such as MasterCard, among others.

The discovery was very simple (the magnetic stripe has been around since credit cards were invented in the 1960s) but astounding in that it promises so many uses in the future. But for now, MagTek and MasterCard are in the early stages of using this discovery to combat skimming.

The two scientists found out that magstripes on the back of the cards have millions of magnetic particles that are unique on each card – unique in the same way that no two human fingerprints are alike. These particles are arranged at random, "a naturally occurring phenomenon," says Gandhi. They can’t be duplicated – the scientists proved that after years of research. When the magnetic media are applied to, say, a credit card or a computer disk, "billions of particles are fixed into a random pattern," according to the Washington University. "Information is imprinted on the particles by magnetizing them with a strong magnetic field; this information is recognized and turned into an electrical signal in the card reader. Until the development of the Magneprint, all that this (magstripe) does for the sales clerk who swipes your credit card through a magnetic card reader is give a confirmation of your number that the credit card company assigns to you."

This doesn’t tell the merchant if the card is a funny card or not. The Magneprint system, however, does.

Gandhi says that the consumer doesn’t have to get a new card since all cards already have the magnetic stripe. The merchant is given a Magneprint-ready terminal (by the banks) which, with the first swipe of the credit card, records all the data and the magnetic "noise" (the pattern of the billions of particles) of this card. This information is then sent to the host bank, which stores and uses it as reference to authenticate succeeding transactions.

In a demonstration in Kuala Lumpur in front of Asian journalists, MagTek’s Kiran Gandhi demonstrates how, with the use of a skimmer terminal, he is able to copy his own credit card and then transfer the info to a blank card. The blank card is read by a reader like the ones you find in stores today and reads the card as real. (This illustrates how skimming has become such a huge global problem – nobody reports the card as stolen or lost, and the fake card is accepted!)

But when Gandhi uses a Magneprint-ready terminal, it registers a low "score" – mathematical formulas are used for authentication – rejecting the forgery because it doesn’t match the reference file he had made when he first swiped the car . Still like the human fingerprint (which is never the same because you don’t put your finger on a scanner exactly the same way each time), even the "good" card doesn’t get a perfect score because the interface changes ever so slightly with each swipe says Gandhi, which is why the real card gets a score like .94 or .96.

"The beta test in Malaysia has so far been a success," says Jeffrey Perera, HSBC Bank Malaysia senior manager for card services. Four Malaysian member banks (Citibank, HSBC, MBF and Southern Bank) were included in the six-month test, which will be completed in December. Six hundred Magneprint-capable terminals were deployed in over 250 merchant locations.

The test included intentionally skimmed cards, all of which were detected by the Magneprint reader. Some good cards were rejected, too, and MasterCard is investigating this. And two real-life skimmed cards were detected (the criminals were not apprehended, but they were not able to use the cards again).

So what happens when the thief beats you to the first transaction at a store which uses the Magnetprint system? Gandhi demonstrates this by storing the info of his fake card as reference. He then uses his real credit card. It is rejected. MasterCard’s Joel Lisker, senior vice president for Security and Risk Management, Global Technology and Operations, says, "You should always check your billing statement." We often take that for granted, but most of the time, that’s all that’s needed to ensure that everything is in order. Once you alert your bank that your card has been skimmed and the fraudulent card now has the "reference," the bank’s goign to issue a new credit card. And as the Magneprint system is put in place, all new credit cards’ reference information will be stored in the host terminal.

Skimming, is just one of the many ways criminals commit credit card fraud. MasterCard’s Esmond Chan, vice president and regional head of Security and Risk Management for Asia Pacific, describes a network of thieves who steal, skim and copy credit cards, and shop like hell. They work with a network of people and international contacts who use the credit cards all over the world and then fence the goods.

"You can imagine the things they buy – high priced merchandise like Rolex, Gucci handbags, electronics. Of course, ultimately, the best thing is to get cash, so you have criminals making cash advances over the counter. You also see situations where customers’ pin numbers are compromised and they use counterfeit cards to withdraw cash from ATMs," he says. Chan used to be with the Hong Kong Police. He’s not new to dealing with cases such as bank and credit card fraud; during his tenure as police inspector, he specialized in major commercial fraud investigations and earned a commendation from the Hong Kong Governor for his contributions to the successful investigation of a major bank fraud case in Hong Kong.

"The criminals are certainly transnational in nature and they’re organized. But I would not characterize them as organized in the sense that they’re like the Mafia or the old traditional organizations in the old days of Hong Kong. We think they belong to different societies, different organizations, different nationalities, but they all come together, they don’t fight even if they belong to one arena because they have a common interest, which is money. They recruit people from different places, they’ll do credit card fraud, then they’ll move on."

Chan says that the Magneprint is the best way to deal with skimming, though he admits they have not yet gotten a commitment from MasterCard member banks. He and other MasterCard came to the Philippines to talk to member banks (in the Philippines there are 11 issuing banks and 6 acquiring banks) and like all their talks around Asia, the results were "encouraging."

With the eventual migration to chip technology, why is there a need for banks to make investment in this new system? Joel Lisker says "Magneprint is a tactical solution and is complementary to chip migration." In countries such as France, where credit cards already use a computer chip, they still have the magstripe at the back because most countries still use the magstripe. "Remember," says Kiran, "the key is to be universal. In France they’re using 100 percent chip cards, but still with the magstripe because they use their cards outside France – in countries that haven’t migrated to chip. In France, the ATMs use only magstripe, which also explains the hybrid card (with both a chip and magstripe) in Europe where chip migration has started."

The estimate for the chip cards to be used universally is 10 years. Meanwhile, some form of protection must be used against skimming. Kiran Gandhi says that if Malaysia were to proceed with the Magneprint system, the country’s credit card industry could save (from skimming) up to $50 to 55 million in five years – money that could be invested in chip migration.

Chan admits that skimming is just one part of credit card fraud – there’s e-commerce fraud, identity stealing, etc.

MasterCard is also lobbying in some countries for tougher legislation for such crimes. "One of our major areas of support for our membership is to lobby legislation changes in those countries where legislation is weak," he says. "Taiwan was one of those countries; last year they passed enhanced payment-control legislation."

He says that many forgers go to Malaysia because they know that the risk of being arrested is very low and if they are arrested, unless they are caught in the act of using the counterfeit credit card, the police can’t do anything. They could be importing hundreds or thousands of credit card into the country and even when caught at customs or immigration, the worst that could happen to them is that they would be deported back to their country of origin with the funny cards. "That was a problem for Japan and Japan is a major destination market, so for criminals, there are a lot of good reasons to go there with counterfeit cards."

The company supports law enforcement efforts in combating payment card crime by providing investigative assistance, expert testimony, training and other necessary support. Recently, MasterCard developed a law enforcement training guide and is currently working with the Interpol to incorporate the guide as a component of their online training course to be developed under the auspices of the Interpol Universal Classification System for Counterfeit Payment Cards. It has also developed a tool kit to aid officers at the scene of the crime to examine suspicious cards.

The Magneprint system could effectively and significantly lower such crimes.

Joel Lisker said at the beginning of the conference that MasterCard is always the first to introduce innovations in the industry. It was the first to introduce the hologram security feature on the credit card. Back then, other companies said, "Why would anyone put a hologram on a credit card?" After MasterCard did that, their fraud cases dropped dramatically and their competition’s soared significantly. They were also the first to introduce the tamper-evident signature panel (before that people would be erasing owners’ signature to use the card) and the reverse italics on the back of the card.

And now, the Magneprint system.

Bet you that in a few years, other cards will be using this system, too. Which is just as well for us cardholders, because if anybody should be buying an Hermes bag we really can’t afford…