Credit card fraud is one of the most pervasive crimes today. According to Jafizwaty Haji Ishahak, research analyst for smart cards and auto ID Asia Pacific at Frost and Sullivan, the credit card fraud level in Malaysia is the third highest in Asia-Pacific; out of the RM9.9 billion (US$2.6 billion) total transactions performed last year, credit card fraud losses amounted to about RM42.5 million (US$11.2 million).
The most pervasive credit card crime is cloning or skimming, where data stored on the magnetic-stripe of the original card is copied onto a blank card.
Issuing banks are constantly trying to find new ways to curb cloning, and the opportunity to stay ahead of perpetrators might just be around the bend with the introduction of the smart card based on chip technology.
Chip away
It is no wonder that chip-based cards have taken center stage in the cashless payment environment. According to Toni Merschen, senior vice-president, chip and mobile commerce center of excellence MasterCard International, chip-based technology is expected to reduce fraud by up to 90 percent.
The chip-based cards will, however, have to comply with specifications set by the EMVCo. The EMVCo was formed by Europay International, MasterCard International and Visa International to manage, maintain and enhance the EMV Integrated Circuit Card Specifications for Payment Systems.
This worldwide standard is hoped to lead the evolution from magnetic-stripe cards to chip-based cards as well as ensure the standard's interoperability and compatibility worldwide.
Where magnetic-stripe credit cards previously hosted only debit and credit payment information, smart cards--due to its storage capacity--provides a multi-application platform for issuing banks. Cards can now be customized to include various applications and functionalities to increase value.
Another positive note for chip technology is its offline transaction capability. This allows merchants to perform credit verification faster and at a cheaper rate than traditional means. In fact, environments such as fast food restaurants would be able to accept credit card payment with the chip-based cards.
"Chip technology is an overall risk management tool to reduce fraud," said Merschen in an interview recently.
smart cards can also host a variety of applications--depending on the size capacity of the card--such as electronic ticketing, loyalty programs, remote shopping and identification details.
MasterCard, for example, has introduced MasterCard Open Data Storage (MODS), an application programming interface (API) for storing and retrieving data. With MODS, cardholders can customize and have control over the personal information stored on the card.
Aside from the possible types of applications that can be tagged onto the cards, security is also one of the reasons to migrate to the smart card technology. Information stored on the smart cards is in electronic format and through various security measures, such as encryption, access to information on the card is controllable.
Hefty cost
The cost of migrating from existing technology to the chip-based technology is expensive. Technology upgrades will amount to new costs from equipment, field installation and installing newer EMV-compliant point-of-sale terminals.
Issuing banks will probably have to fork out about RM15,000 (US$3,950) to RM20,000 (US$5,260) to upgrade and integrate the server host. Meanwhile, investments for installing a new host could run up to approximately RM50,000 (US$13,160) or even higher, said Frost and Sullivan's Jafiz.
Equipping the cards with chips, meanwhile, involves another set of costs. Present prices for magnetic-stripe cards are around RM0.70 (US$0.18) to RM2 (US$0.53).
According to Shaun Ghaidan, vice-president of Advance Payment Systems Asia-Pacific Region MasterCard International, two to three years ago, chip cards cost about US$5 to US$6. But that price has now decreased to about US$2.40.
There are chips, said Ghaidan, that cost about US$1, but the capabilities of the card will also be less; the cheaper cards can only carry existing information from the magnetic-stripe cards.
Aside from the host upgrade and chip cost, there are also the point-of-sale terminals which need to be EMV-compliant. The current cost of these terminals is expected to range from RM1,500 (US$395) to RM2,000 (US$526), said Ghaidan.
Ghaidan is confident that economies of scale and with newer terminals being EMV-compliant, prices of terminals will reduce to below RM1,000 (US$263) each.
While cost is an issue to consider when moving forward with chip-based cards, one of the biggest challenges is to ensure the quality of the chip card, said MasterCard's Merschen.
In Malaysia however, chip-based cards are not a foreign concept. In fact, with the introduction of the multi-application national identity card called the MyKad, electronic cash application (MEPS) has been added as one of the applications on the card. However, usage is restricted to within the country.
The MyKad, which uses a proprietary platform, aims to put in the hands of each Malaysian by 2005, a single microprocessor-based smart card that contains identification, driving licence, international passport, and health information.
Is there then a possibility of including the EMV standard onto MyKad so that the electronic payment application can be used outside of Malaysia?
While it is technically possible to integrate the EMV standard onto the local chip-based national identification card, MasterCard's Merschen does not believe that personal identification will converge with financial cards.
"The ID card does not change. However, financial products either expire or change? We will have two to three cards," Merschen said.
Local banks are expected to roll out smart cards by the end of this year, and by 2006, about 80 percent to 90 percent of the credit cards in Asia-Pacific will be chip-based. At that time, all credit cards will not have the magnetic-stripe, said Frost and Sullivan's Jafiz.
Immediate solution
While it will still be some time before issuing banks witness a true reduction in fraud losses with chip-based credit cards, an immediate solution could be just months away.
MasterCard International Inc along with US-based card reader technology provider MagTek Inc announced recently that the companies have successfully beta tested an advanced risk management tool for anti-skimming or cloning with four local financial institutions.
The tool called Magneprint was created by MagTek and is believed to provide a complementary solution that will enable magnetic-stripe cards to co-exist with chip-based cards.
Magneprint reads the tiny particles on the magnetic-stripe of the physical card make-up or the card's fingerprint.
To ensure that a card is not a cloned one, the Magneprint capable terminal will read the properties of the card and measure the pattern of the intrinsic noise of each swipe.
According to Kiran Gandhi, MagTek's vice-president of marketing, the score of the noise pattern from each swipe will never be alike as the interface continuously changes, just like fingerprints. Factors such as the amount of pressure and position placed against the fingerprint scanner will affect the result.
As such, there will not be a perfect score, Kiran said. However, variance in scores from each swipe of the original card is almost negligible, whereas a skimmed card will produce much more significant variances compared to the original score, at every swipe.
Testing ground
The reliability of Magneprint was tested by card issuers, Citibank, HSBC, MBF cards (Malaysia) and Southern Bank about six months ago. For the test, 600 Magneprint capable terminals were deployed at over 250 merchant locations in Kuala Lumpur.
Kiran reported that as of Oct. 15, Magneprint has references on file for 65,817 cards. At a set threshold level, Magneprint claims it was able to detect every skimmed card that was swiped. "There is an almost zero rate to duplicate the intrinsic particles and replicate the patterns" Kiran said.
The cost of adopting this technology is minimal as cards need not be reissued, said Kiran.
According to Esmond Chan, MasterCard International's vice-president and regional head of security and risk management for Asia-Pacific, the tests in the region will conclude by year-end and technology deployment by the banks will likely take place early next year. At which point, Malaysian merchants will probably have to invest in terminals while issuing banks will have to invest in server host upgrades.
According to Jim Cheah, vice-president and country manager Malaysia and Brunei, MasterCard International, prices of terminals right now are between US$50 and US$60. Cheah, however, expects this cost to decrease as the company is presently working with terminal vendors to incorporate Magneprint in newer terminals. By then, the cost per terminal could come down to between US$20 and US$25, Cheah said.
Meanwhile, other investments that will have to take place in implementing Magneprint would be the host upgrade on the issuing side. Banks are looking at costs ranging from US$100,000 to US$150,000.
On MasterCard's side, Cheah declined to reveal the investment figure for Magneprint but said that investment over the years "runs into millions of U.S. dollars."
At present, the company does not expect to pass investment cost onto banks or members. It will be borne by card association companies such as Diners, JCB, Discover, American Express and Visa.
Chips beckons
With the impeding migration to chip-based cards, Joel Lisker, MasterCard International's senior vice-president of security and risk management, global technology and operations, believes that there is still a need for a holistic solution for credit cards. "The magnetic-stripe will still be on the card even with the successful roll-out of chip technology," Lisker said.
"There will be chip-capable terminals that will incorporate the use of Magneprint," Lisker assured. At the end of September, there was about 3 million MasterCard branded credit cards in the local market.
Play video
There are currently no comments for this post.