Magnetic stripe begins its farewell tour
Once-innovative technology now scorned for fraud vulnerability
By Sienna Kossman | Published: December 2, 2015
Statistics enthusiast focused on data-driven content.
Like paper maps and clamshell phones, the familiar magnetic stripes on the back of credit cards have begun their slide into obsolescence. The only question is: how soon will they disappear?
After decades of swiping magnetic stripe cards at checkout, U.S. consumers are now adjusting to dipping chip-equipped EMV credit cards. Their cards still contain mag stripes -- for now -- but only as a backup system. At the moment, the magnetic stripe remains the most popular type of payment card in the U.S. That, experts say, is sure to change. The number of cards bearing once-innovative magnetic stripes will dwindle as chip cards penetrate the market and digital technologies such as mobile wallets develop further.
"Most people in this business would say mag stripe's days are numbered," said Mark Horwedel, CEO of Merchants Advisory Group. "After all, we've spent all this time and money equipping stores with EMV equipment. Just having the mag stripe on a card is a risk."
Mag stripe's rise
When introduced in the 1970s, magnetic stripes were cutting-edge technology and changed the way payment cards would be processed for decades.
"It was the first step in digitizing payment information," said Thad Peterson, senior analyst with Aite Group.
|DIFFERENCE BETWEEN STRIPES & CHIPS
The magnetic stripes on traditional credit and debit cards contain unchanging data, making them prime targets for counterfeiters who can convert the stripe's sensitive information into cash or other fraudulent transactions repeatedly.
Unlike magnetic-stripes, every time an EMV card is used for payment, the card chip creates a unique transaction code that cannot be used again. If a fraudster steals chip information from one particular point of sale, typical counterfeit card duplication wouldn't work because the transaction code cannot be used more than once.
Before their arrival, merchants used bulky zip-zap machines to manually transfer embossed card numbers onto carbon copy paper receipts that would be sent off for payment authorization. Processing the transaction slips took two or three days, creating a vulnerable window for fraud -- as did telltale carbon copies of credit card numbers absently tossed in the trash.
The magic of the magnetic stripe came from combining two existing technologies -- the telephone and the magnetized tape used in reel-to-reel tape recorders. By affixing a small strip of magnetic tape to the back of a card, and programming a unique number into the tape, it could be read with a swipe and sent over the telephone for near-instant verification. "That was a tremendous leap from the standpoint of the technology," said Doug Johnson, senior vice president and adviser of risk management policy with the American Bankers Association.
"At the time it actually put us ahead of other countries like Europe significantly because they didn't have the speed in their phone systems like we had for decades."
Magnetic stripes were cheap, too. Once MasterCard and Visa adopted the technology, each striped card cost less than 5 cents to produce.
"It was a fairly inexpensive technology because a mag stripe is basically a piece of magnetic tape like a tape recorder," Peterson said. "It had a limited amount of data it could carry, but it did what it needed to do and quickly became the standard."
... and demise
Despite the mag stripe's advances, it became clear that their data could easily be stolen and used to create counterfeit cards. As a result, EMV payment technology standards were introduced in Europe shortly after the turn of the 21st century specifically to protect payment card information.
The U.S. clung to its standard magnetic stripe standard despite the high costs of counterfeit card fraud. To illustrate, counterfeit fraud cost card-issuing banks $3.4 billion and merchants another $1.9 billion in 2012 alone, according to The Nilson Report.
While the nationwide migration to EMV payment technology has been slow, it is gaining speed following the card network-imposed Oct. 1, 2015, EMV liability shift date. As of Oct. 30, 48 percent of all MasterCard branded credit cards were chip-equipped -- up 12 percent from September. Overall, approximately 60 percent of all U.S. credit cards are expected to be issued with chips by the end of 2015.
While nearly all U.S. chip cards are still being issued with mag stripes to ensure continued usability while merchants slowly migrate to EMV technology, the faster chip card acceptance spreads, the faster mag stripes may disappear.
"Different payment associations around the world have been considering this for a number of years and as the U.S. migrates to chip cards, the mag stripe becomes less and less relevant," said William Tran, spokesman for digital security software provider Gemalto North America.
It is data-breach poster child and retailer Target that is leading the way toward the ban of mag stripes.
As part of its transition to EMV payment technology, Target is making all three of its retail cards chip-and-PIN and removing the mag stripe from its debit and store-only credit cards.
By doing this, Target is eliminating counterfeit fraud risks for two of its three cards and securing its cards with PINs instead of signatures, unlike most chip cards issued in the U.S. thus far.
"We believe in offering our consumers chip-and-PIN cards, the most secure form of payment currently available in the marketplace," said Target spokeswoman Molly Snyder. "The rollout of mag stripeless cards will be complete in the spring of 2016."
For a retailer bouncing back from a large-scale data breach that left a lasting negative impression on many, Target's decision to remove mag stripes from its closed-loop cards is a smart one, according to Aite Group's Peterson. "This is a way to eliminate fraud risks for their customers and position them as an innovative leader in the payment space," he said.
Other retailers that issue closed-loop store cards like Target can -- and should -- make the payment card change sooner rather than later, according to industry experts. "I don't know why retailers wouldn't follow suit," said Horwedel, of the Merchants Advisory Group. "Especially in a closed-loop environment, why would you keep mag strips on your cards?"
Because Target's debit and store-only REDcards can be used only in Target stores, cardholders do not need to worry that their stripeless cards won't be accepted anywhere else. The challenge of ditching mag stripes is with open loop cards that may be used at retailers that don't yet have the technology to accept chip cards.
At the very least, the nation's migration to EMV payment technology and Target's mag stripe decision will spark a broader conversation about ditching mag stripes altogether -- even for general purpose cards.
"In Europe we are already starting to see cards being issued without stripes," said Carolyn Balfany, MasterCard's senior vice president of U.S. product delivery. "Now, those are typically for primarily domestic and nontraveling transactors so there aren't as many concerns about nonacceptance, but I think you will see a more aggressive removal of the mag stripes in closed-loop circuits here in the U.S. to start with."
As EMV payment technology becomes more widely adopted, there will be a strong desire in the payment industry to get rid of the mag stripe in favor of more secure options, such as chip-only cards. However, with the lag in EMV-compliant retailer card terminals, consumers and merchants still need to have payment method options.
"There are still vending machines and parking garages that may take a long time to upgrade to chip. At least for the foreseeable future, mag stripe is going to be around because there are so many locations where mag stripes will be accepted and chips might not be," said Stephanie Ericksen, vice president of global risk products at Visa.
"I think mag stripes are still going to be on cards for a long time," the ABA's Johnson said. "Potentially they could go away once all terminals are EMV-enabled, but that's going to take a while. Less than half the merchants in the country will have EMV-ready equipment in their stores and turned on by the end of this year."
Even after chip cards become the norm, innovations to further secure and simplify payments will not -- and cannot -- stop.
"Whether it's encryption or tokenization or something else entirely, all of those technologies will need to keep being invested in and improved in order to keep pace with what fraudsters are doing," MasterCard's Balfany said.
As new, more secure payment technologies become the standard, consumers should expect credit card issuers will abandon mag stripes entirely one day.
After all, "Why would we tolerate long-term fraud risks?" Horwedel said.
|MAGNETIC STRIPE TRIVIA
- Abolish the password? Card issuers are working on that – Credit card issuers and banks aim to phase out passwords over the next few years with the help of biometric authentication ...
- Startups use tech to put cardholders in charge of security – With data beaches on the rise, startup companies are developing new options that help consumers minimize their exposure to a possible hack ...
- Which banks let you personalize your credit card? – If you've ever wanted to take you favorite pet with you in the in the grocery store or to a fancy restaurant, consider plastering their likeness on a credit card ...