Over in the US, chip & PIN and contactless payments aren’t really a thing. Unlike much of Europe – and Australia as of August 1 – where chip & PIN credit card payments is a thing, the US continues to struggle on using the old swipe and sign method.
The swipe and sign method that uses information held on the card’s magnetic strip. The magnetic strip that is ridiculously easy to copy and clone.
“It’s totally unprotected and it’s static, so it’s the same data that’s read every single time. It’s just about the worst security that you can put into a payment system,” says Avivah Litan, a security analyst for Gartner, a firm retailers hire to assess their gaps in cyber-security.
Talking of chip & PIN, Litan said, “It’s standardised all over the world and used all over the world, except in the US and perhaps one country in Africa.”
In the US, there more than 1.5 billion credit cards in circulation. As of May 2013, Visa said it had issued at least 3.5 million chip cards in the US. That’s quite a few cardholders still using the magstripe method.
Anyone who has read the news over the past few months may have noticed some sizeable credit card hacks on US-based retailers. The hacks on Neiman Marcus and Target alone resulted in more than 70 million credit card holders being put at risk.
This US insistence on sticking to the magstripe method has been criticised by some, who say it has made the country a target for international hackers who know that magstripe cards are easy prey.
While chip & PIN cards are not infallible, the information they hold is at least encrypted on their chips, making the copying and cloning process that much more difficult.
Loop: A secure alternative?
Until the US banking system and retail industry decide to switch to safer payment methods (plans are in place to move to chip & PIN by 2015), entrepreneurs are putting up their own offerings to credit card holders who want a more secure way to pay.
Loop is the latest company to offer an alternative to paying with credit card, allowing users to pay using a fob or a case on their smartphone. While the premise behind Loop is to offer cardholders a way to pay without having to carry around a bulky wallet, it does have some security features that trump the average swipe and sign credit card.
Here in Australia, owners of Android phones can use NFC technology to pay with their phone, and most cardholders can choose to use PayPass or PayWave as an easy way to pay at the checkout. But without contactless payment terminals in place, the US doesn’t really allow for that.
Instead, Loop uses the technology already in place on most payment terminals that use the swipe and sign method. It turns the magnetic strip reader into a receiver for mobile payments, so a standard payment terminal can read the Loop fob or phone ChargeCase to receive a payment.
The user downloads the Loop app, and swipes his cards onto the app using the phone’s attachable card reader. When making a payment, the user swipes their fob or phone on the payment terminal to make a payment.
How is that more secure?
Loop says its system has the highest level of Payment Card Industry (PCI) security.
- LoopWallet user IDs are verified against cards, so you can only swipe your own cards into the app.
- The LoopWallet app is password-protected.
- When using the phone to make a payment, a PIN has to be entered.
- All data stored and transmitted by Loop is “encrypted and tokenised”.
- After a certain period of time away from the user’s phone, the fob will stop working.
- When making payments, Loop uses dynamic card data so that card clones cannot be made if the data is intercepted.
- When making payments, the user has to push a button to activate the Loop, so data is not just out there to ‘grab’.
Loop isn’t available as yet in Australia, but then it could be argued that US cardholders need this technology more than Australians anyway.
The post Loop: Another US-based credit card alternative appeared first on Quid.