Credit card tricks -

Credit card tricks

Why having a new microchip card in your wallet doesn’t mean you’re safe from fraudsters

Credit card tricks

Photograph by Jessica Darmanin

Credit card fraud is big business in Canada. Last year, crooks racked up nearly $366-million worth of charges on lost, stolen or otherwise compromised cards, targeting nearly half a million customers, according to figures from the Canadian Bankers Association. That explains why the industry has been pushing the adoption of more secure microchip cards that require users to slide their plastic into a terminal and enter a PIN, similar to the way debit cards work. But a word of caution: just because you have a new chip card in your wallet doesn’t mean you’re safe.

While the industry says it has already seen instances of fraud drop since the new cards were first introduced two years ago, the expensive process of moving cardholders and merchants to the new technology has also created new opportunities for crooks—including some scams that can make it appear as though it’s the cardholder that is at fault, possibly leaving them on the hook for losses.

The problem stems from the fact that chip cards are still equipped with a magnetic stripe. That’s so cardholders can pull out their plastic at stores that may not have the latest equipment, or use them in the United States, which so far has balked at the cost of adopting the technology. Like regular credit cards, the stripes can be “skimmed” by thieves using special equipment and a compromised terminal. The new twist is that if crooks also manage to observe the cardholder entering their PIN—either by watching over their shoulder or by setting up a hidden camera—it may be possible for them to use the forged cards either in bank machines without chip and PIN technology, or on machines designed to fall back on verifying magnetic strips (to accommodate foreign visitors without chip cards).

This was the type of fraud that spiked when the U.K. moved to chip cards about six years ago, according to Steven Murdoch, a researcher in the security group at the University of Cambridge. “The reason chips made things worse in the U.K. was because now customers were suddenly entering their PINs in many more places than they used to,” says Murdoch, whose research has raised serious questions about the security of the chip and PIN system. “Now criminals didn’t need to put a skimmer in an ATM, they could just put one in a shop.” He said there have also been instances where fraudsters have made imperfect clones of chips that will work in “off-line” transactions, where the terminal isn’t communicating directly with the bank.

Once the transition is complete, the industry argues that chip cards will dramatically reduce the problem of counterfeit cards since the chip itself is virtually impossible to copy. They point to countries that have already adopted the technology, such as France, where fraud is down by 80 per cent. In Canada, instances of fraud resulting from counterfeit cards is already on the decline—down 30 per cent since 2008. “Although we’re seeing good progress in rolling out chip cards to market, fraudsters are very creative and are trying to take advantage of things while they still can,” says Mike Bradley, the head of products for Visa Canada, which estimates that nearly 70 per cent of Visa cardholders in Canada now have chip cards.

But while efforts to reduce credit card fraud make sense for banks, which issue most cards and accept the phony charges as a cost of doing business, it’s not yet clear whether cardholders will also be winners. One side effect is that it’s becoming tougher for them to convince their issuer that a fraud has actually taken place. That’s because the cardholder is the only one who is supposed to have access to the PIN. The challenge of determining whether a chip and PIN fraud has been committed is at the heart of Toronto businessman Jason Monaco’s current efforts to sue CIBC after thieves allegedly copied his card and used it, along with his PIN, to purchase an $81,276 race car. The bank is claiming that Monaco is responsible for the transaction, as per the card agreement.

Catherine Johnston, the president of Advanced Card Technologies Canada, which represents the various stakeholders in the secure payment industry, acknowledges that as the security surrounding credit cards increases, banks will naturally become more skeptical of fraud claims. “I think what’s happening is that the banks look at it and say, it’s easy to fake a signature, but how do you fake a four-digit number?”

Similarly, Murdoch says the introduction of chip cards in the U.K. has led to a “liability shift” when it comes to how credit card fraud is dealt. But that’s troubling, he says, given that no card system will ever be perfectly fraud-proof. He’s even demonstrated in the lab a way to defeat the chip-and-PIN system that doesn’t rely on outdated magnetic strips. “We’re not sure if criminals are using this at the moment,” he says. “But they could be.”


Credit card tricks

  1. Mag-stripe cards have been around since the 1970s and their age is showing in rising rates of card skimming and counterfeiting.  The U.S. is now alone among developed countries and in the company of some non-industrialized countries in Africa in sticking to this aging technology.  The reason seems to be that credit card companies are willing to tolerate mag-stripe related losses.

  2. The whole purpose of chip and pin is to shift liabilities to the consumer.. This is the whole point of this CIBC lawsuit against Monaco.. The issue doesn’t stem from a mag stripe.. The issue stems from having the ability to commit the fraud in the first place.. Apart from lost or stolen cards these days the amount of cracks in the new chip cards are mounting.. Usually you got convenience on the left and security on the right.. New technology introduced that hasn’t passed the test of time is usually considered less secure.. 

    So I don’t use my chip.. It’s taped up.. As for the tap & go feature I like the feature however security always comes into question with the scanner itself etc.. I use it conservatively only at terminals I know cant be tampered with and/or unobserved for long periods of time.. I override all other purchases to mag stripe.. Let’s see if TD / Capital One tries to sue me.. I do understand the cardholders agreements have essentially changed allowing for the banks to take on this kind of suit but it’s really what they are claiming that scares me more.. This assumes Monaco’s story is legit though.. 

  3. Anytime the government or any other entity spends billions of dollars then there is a higher risk of people trying to defraud the system and profit off of it. But I don’t think its impossible for the government to crack down and limit fraud and waste. We could easily reduce tax fraud by increasing the amount of IRS audits but the average tax payer doesn’t want that to happen. Its a difficult balance to find the proper amount of enforcement to limit fraud but not excessively inconvenience the innocent people. Lisa from