Detached smart card chips trigger privacy concerns

At a time when the U.S. EMV (Europay, Mastercard and Visa) migration is nearing completion, reports of chips separating from plastic payment cards triggered heated debates among payments analysts and others in the electronic payments sphere. Some consumers and merchants, formerly convinced that EMV technology would nearly eliminate counterfeit card fraud, expressed concern that missing EMV chips could present a new and severe threat to the payments chain due to the levels of personally identifiable information on the chips' embedded microprocessors.

Major news outlets around the country poured gas on the fire, sounding the alarm about falling chips and claiming fraudsters can use a separated chip to create a perfectly functioning counterfeit card. In a tweet, SecurityMetrics (@SecurityMetrics on Twitter) shared a link to an ABC news story that detailed the vulnerability, along with the statement, "Any card can be compromised if the chip falls off!"

Reporter Jason Knowles, of Chicago ABC news affiliate WLS-TV, said he was not aware of exactly when his smart card chip and credit card separated. "I didn't realize for days because I was still allowed to swipe my card at many places with the magnetic strip," he said. "When I called Chase, they told me I had to get a new card with a new number because if someone found my chip intact, it could be placed on another card."

Sleight-of-hand card trick

In accepting magnetic stripe cards, merchants are trained to compare credit card numbers on those cards to the truncated numbers on payment receipts. Some analysts speculated that without a quick resolution to smart card manufacturing issues, merchants may have to use the same tactics with smart cards at the POS.

In a televised appearance on Chicago's WLS-TV, Shawn Kanady, Principal Security Consultant at Trustwave Holdings Inc., demonstrated how a fraudster could easily glue a smart card chip onto a different payment card or similarly sized business card. "I peeled off the chip of two cards and swapped them," he said. "I took that card to a retailer and ran a transaction. On the receipt, you could tell that it didn't match the card I actually used." While most chips are well-adhered to payment cards, repeated wear and tear can loosen them over time and eventually cause them to fall off, he added.

Are smart cards bridge technology?

Most payments analysts are confident in the security and safety of the smart card form factor in use today, but some suggested that isolated incidents involving falling chips may shape public opinion and accelerate adoption of other form factors, such as mobile wallets, in-app payments and even embedded microchips in humans.

Experts familiar with smart card technology have said there is little cause for alarm, because most chip cards are adhered to a gold contact plate that is activated when the card is inserted into a reader. This was corroborated by Credit.com journalist Jeanine Skowronski in an interview with JPMorgan Chase. The spokesperson advised her that the gold contact on the front of the chip card contains no data, adding, "If the chip loses contact with the gold plate encasing it, it is rendered useless; if the chip is cut out or damaged, it no longer works." This does not appear to jibe with Kanady's having been able to swap EMV chips on two cards and successfully run a transaction at a retailer.

In any event, Jason Oxman, Chief Executive Officer of the Electronic Transactions Association, told ABC News that broken cards are a rarity and can be quickly replaced by issuing banks. "Chip cards are the most secure physical cards in the 40-year history of the plastic credit card," Oxman stated. He also pointed out that consumers have no liability for fraud, even in a rare case when a plastic card and chip are separated.

Editor's Note:

The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.

Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.