The payments system is a paragon of standardisation.
No other industry has such a strong history of driving and adopting uniform technologies, infrastructure and business processes. No matter where you keep a bank account, you can use a globally branded credit card to go shopping in almost every corner of the world. This seamless convenience is underpinned by the universal Four Party settlement model, and a long-standing card standard that works the same with ATMs and merchant terminals everywhere.
So with this determination to facilitate trustworthy and supremely convenient spending in every corner of the earth, it’s astonishing that the industry is still yet to standardise Internet payments.
The latest bi-annual card fraud statistics released by the Australian Payments Clearing Association are startling. Card Not Present (CNP) fraud now represents three quarters of all card fraud and is growing unchecked at over 50 percent per annum.
APCA’s only comment on the CNP crime wave is to associate it with the popularity of e-commerce. That’s a bit like the automotive industry putting up with a high road toll because people love driving.
Frankly, it’s a mystery why the payments industry seems so bamboozled by CNP fraud, because technically it’s a very simple problem. And it’s one we’ve already solved elsewhere.
Card Not Present fraud is simply online carding.
In carding, criminals replicate stolen customer data on blank cards; with CNP fraud they replay stolen data on merchant servers.
A magstripe card stores the customer’s details as a string of ones and zeroes, and presents them to a POS terminal or ATM in the clear. It’s child’s play for criminals to scan the bits and copy them to a blank card.
The industry responded to skimming and carding with EMV (aka Chip-and-PIN). EMV replaces the magnetic storage with an integrated circuit, but more importantly, secures the data transmission from card to terminal. EMV works by first digitally signing those ones and zeros in the chip, and then verifying the signature at the terminal. The signing uses a Private Key unique to the cardholder and held safely inside the chip where it cannot be tampered with by an attacker.
Card Not Present
Conventional Card Not Present transactions are vulnerable to replay attack because, like the old magstripe cards, they rest on cleartext cardholder data. On its own, a merchant server cannot tell the difference between the original card data and a copy, just as a terminal cannot tell an original magstripe card from a criminal's copy.
Despite the simplicity of the root problem, the past decade has seen a bewildering patchwork of flimsy and expensive online payments fixes. Various One Time Passwords have come and gone, from scratchy cards to electronic key fobs. Temporary SMS codes have been popular but were recently declared unsafe by the telecommunications industry.
Meanwhile, extraordinary resources have been squandered on the novel “3D Secure” scheme (MasterCard SecureCode and Verified by Visa). 3D Secure take-up is piecemeal; it is widely derided by merchants and customers alike. It upsets the underlying Four Party settlements architecture, slowing transactions to a crawl and introducing untold legal complexities.
So why doesn’t the industry go back to its roots, preserve its global architecture and standards, and tackle the real issue? We could stop most online fraud by using the same chip technologies we deployed to kill off skimming.
It is technically simple to reproduce the familiar card-present user experience in a standard computer. It would just take the will of the financial services industry to make payments by smartcard standard.
There are plenty of smartcard reader solutions on the market and indeed, many notebooks feature built-in readers. Demand for readers has grown steadily over the years, driven by the increasing normal use of smartcards for e-health and online voting in Eastern Europe and Asia.
And with dual interface and contactless smartcards, the interface options open right up. NFC devices like most tablets and smartphones can switch into Card Reader Emulation mode, to act as a smartcard terminal. Alternatively, the SIM or Secure Element of most mobile devices could be used to digitally sign card transactions directly.
All serious payments systems use hardware security. The classic examples include SIM cards, EMV, the Hardware Security Modules mandated by regulators in all ATMs, and the Secure Elements of NFC devices.
With well designed hardware security, we gain a lasting upper hand in the cybercrime arms race. So let's stop struggling with stopgap measures, and let's stop pretending that PCI-DSS audits will stop organised crime stealing card numbers by the million.
Instead, let's kill two birds with one stone, and use chips to secure both card present and CNP transactions.
Stephen Wilson is the principal of Lockstep Consulting.
Disclaimer: Lockstep Technologies (related company) was the recipient of an R&D grant to research commercially-available products for securing CNP transactions.