Credit card fraud is big business in Canada. Last year, crooks racked up nearly $366-million worth of charges on lost, stolen or otherwise compromised cards, targeting nearly half a million customers, according to figures from the Canadian Bankers Association. That explains why the industry has been pushing the adoption of more secure microchip cards that require users to slide their plastic into a terminal and enter a PIN, similar to the way debit cards work. But a word of caution: just because you have a new chip card in your wallet doesn’t mean you’re safe.
While the industry says it has already seen instances of fraud drop since the new cards were first introduced two years ago, the expensive process of moving cardholders and merchants to the new technology has also created new opportunities for crooks—including some scams that can make it appear as though it’s the cardholder that is at fault, possibly leaving them on the hook for losses.
The problem stems from the fact that chip cards are still equipped with a magnetic stripe. That’s so cardholders can pull out their plastic at stores that may not have the latest equipment, or use them in the United States, which so far has balked at the cost of adopting the technology. Like regular credit cards, the stripes can be “skimmed” by thieves using special equipment and a compromised terminal. The new twist is that if crooks also manage to observe the cardholder entering their PIN—either by watching over their shoulder or by setting up a hidden camera—it may be possible for them to use the forged cards either in bank machines without chip and PIN technology, or on machines designed to fall back on verifying magnetic strips (to accommodate foreign visitors without chip cards).
This was the type of fraud that spiked when the U.K. moved to chip cards about six years ago, according to Steven Murdoch, a researcher in the security group at the University of Cambridge. “The reason chips made things worse in the U.K. was because now customers were suddenly entering their PINs in many more places than they used to,” says Murdoch, whose research has raised serious questions about the security of the chip and PIN system. “Now criminals didn’t need to put a skimmer in an ATM, they could just put one in a shop.” He said there have also been instances where fraudsters have made imperfect clones of chips that will work in “off-line” transactions, where the terminal isn’t communicating directly with the bank.
Once the transition is complete, the industry argues that chip cards will dramatically reduce the problem of counterfeit cards since the chip itself is virtually impossible to copy. They point to countries that have already adopted the technology, such as France, where fraud is down by 80 per cent. In Canada, instances of fraud resulting from counterfeit cards is already on the decline—down 30 per cent since 2008. “Although we’re seeing good progress in rolling out chip cards to market, fraudsters are very creative and are trying to take advantage of things while they still can,” says Mike Bradley, the head of products for Visa Canada, which estimates that nearly 70 per cent of Visa cardholders in Canada now have chip cards.
But while efforts to reduce credit card fraud make sense for banks, which issue most cards and accept the phony charges as a cost of doing business, it’s not yet clear whether cardholders will also be winners. One side effect is that it’s becoming tougher for them to convince their issuer that a fraud has actually taken place. That’s because the cardholder is the only one who is supposed to have access to the PIN. The challenge of determining whether a chip and PIN fraud has been committed is at the heart of Toronto businessman Jason Monaco’s current efforts to sue CIBC after thieves allegedly copied his card and used it, along with his PIN, to purchase an $81,276 race car. The bank is claiming that Monaco is responsible for the transaction, as per the card agreement.
Catherine Johnston, the president of Advanced Card Technologies Canada, which represents the various stakeholders in the secure payment industry, acknowledges that as the security surrounding credit cards increases, banks will naturally become more skeptical of fraud claims. “I think what’s happening is that the banks look at it and say, it’s easy to fake a signature, but how do you fake a four-digit number?”
Similarly, Murdoch says the introduction of chip cards in the U.K. has led to a “liability shift” when it comes to how credit card fraud is dealt. But that’s troubling, he says, given that no card system will ever be perfectly fraud-proof. He’s even demonstrated in the lab a way to defeat the chip-and-PIN system that doesn’t rely on outdated magnetic strips. “We’re not sure if criminals are using this at the moment,” he says. “But they could be.”