MONTREAL — Shopping and swiping your credit card could leave you at risk for fraud. So can dining and paying for your meal with a swipe of your credit card.
Even though Canadians are increasingly using credit cards with chip and personal identification number (PIN) technology, there are still some businesses that rely instead on the swipe of a card’s magnetic stripe to process transactions electronically.
“There is a misconception among consumers that if you have a chip and pin number, that credit card fraud isn’t going to exist,” McAfee online security expert Robert Siciliano said.
Credit card fraud will continue until the magnetic stripe, which can also access account information, is phased out and taken off the card, Siciliano said.
Thieves know they can still win big with the card’s magnetic stripe and consumers need to pay close attention to their monthly statements for unusual charges, he said.
“These organized criminals are actually packing up, they’re leaving their home country and flying into countries where those cards exist,” Siciliano said from Boston.
They set up shop, swap point-of-sale terminals at stores and restaurants and install skimming devices on automated teller machines because they know the “clock is ticking” on credit card swiping, he said.
Siciliano said the United States, where chip and PIN technology isn’t wide spread yet, is the main target — but Canada isn’t immune.
“They know that the countries that have that technology still in existence will eventually go to chip and PIN. There’s a tremendous amount of money to be made right now and all studies point toward a rise in these crimes.”
In Montreal, RCMP recently dismantled an international criminal ring alleged to have been involved in a $100 million debit-and- credit-card scam.
RCMP have said the criminal ring’s most popular scam involved stealing point-of-sale terminals — in which consumers insert their credit cards and enter a PIN number — from businesses and modifying them to steal credit card information.
RCMP said the terminals were rigged using short-range wireless technology to relay information to fraudsters remotely.
Visa Canada’s Michael D’Sa said data on a credit card’s magnetic stripe isn’t encrypted.
But banks already do a higher level of scrutiny before approving a transaction with only a credit card’s magnetic stripe, which helps detect fraud, he said.
If the magnetic stripe was copied and used fraudulently at a chip and PIN terminal, the bank would be “suspicious” as to why the chip wasn’t read to process the sale, said D’Sa, head of payment system security at Visa Canada.
So far, the encryption on the card’s chip has not been cracked by thieves, D’Sa said from Toronto.
“As cards expire, the banks have to issue the chip card with even greater encryption. Basically it’s like having a bigger lock on your front door.”
McAfee’s Siciliano said the chip and PIN technology has been “cracked” in a controlled environment in a laboratory, but to his knowledge there are no known cases of thieves doing so. It’s a much more secure technology, he added.
“If and when that day ever happens, there will be serious consequences to that.”
Visa Canada said it’s not able to disclose a timeline to phase out the magnetic stripe on its credit cards, and there would have to be complete migration to chip and PIN technology before it could be considered.
Visa Canada said fraud involving Canadian credit cards was $436 million in 2011, up slightly from 2010.