'EMV cards are more secure than magnetic strip cards'

Following a surge in credit card frauds in the country on account of cards being lost/stolen, data being compromised and cards skimmed/counterfeited, the Reserve Bank of India has issued a directive to Indian banks to move to the EMV standard by June 30 of this year.

In an interview with CIOL, Gemalto Regional Sales Director Hon Kuan Lee spoke to CIOL on how the company is helping banks to implement the EMV standard.

Excerpts :

1.What do you think are the security loopholes in the present generation of debit/credit cards?

Hon Kuan Lee: Banks across the world are facing challenges to keep credit, debit and ATM card away from fraud. As per data released by the Reserve Bank of India (RBI) for October to December 2012, the number of credit card fraud has grown to 1,590 from 1,327 in the preceding three months.1 At the same time, the value of fraud has almost doubled from INR 49.3 million to INR 94.9 million2.

Credit/ debit card skimming is financial industry's one of the major concerns and often results in forms of identity theft, credit card fraud or bank fraud. The magnetic stripe credit and debit cards store user's financial data in static format. This data is vulnerable to be copied during offline transactions by skimming devices, which can be used to create a clone card and make unauthorized offline transactions.

Gemalto, from its many migration projects worldwide, has learned that these fraudulent activities are steadily migrating towards those regions of the world which have not yet migrated to EMV chip technology. Hence, magnetic strip cards are becoming a target for hackers and card skimmers worldwide.

2.What are the security features that EMV (Europay, MasterCard, VISA) standard can bring for debit/credit cards?

Hon Kuan Lee: EMV is a global standard for credit and debit payment cards based on smart card based technology which is significantly more secure than traditional magstripe cards. This technology has been tremendously successful in preventing fraud worldwide and makes it much harder for criminals to clone cards.

The success of the migration exercise is exemplified by the case of Malaysia, which fully converted to EMV chip ATM cards by end-2005. Card fraud was reduced by 85 per cent from US$5.9 million in 2003 to US$0.3m in that year alone.

EMV uses dynamic data which makes it an important aspect from a fraud-prevention

standpoint. Each transaction carries a unique ‘stamp' which prevents the transaction data from being fraudulently reused, even if it is stolen from a merchant's or processor's database.

This technology is based on strong cryptography and an elaborate key management that ensures transaction integrity. PIN verification can be added as an added security layer to increase the level of security and offer two-factor authentication by EMV cards. First factor is something you know, the PIN, and the second factor is something you have, the chip card.

The EMV card can also be used to make the card-not-present (online/ phone) transactions safer. The EMV infrastructure can provide strong, dynamic cardholder authentication using one-time passwords (OTP). A hand-held device can be used to communicate with EMV card and generate OTP for online transactions.

3.Is your company helping banks in introduction of EMV standard? How many of your customers are implementing the same in India?

Hon Kuan Lee: With projects in more than 30 countries, Gemalto is the world's leading provider for chip-payment cards - involved in most of the chip based ATM card programs in Asia and worldwide. Our network of over 80 partners and 20 banking card personalization centres worldwide provide the responsive local service for rapid roll-out in new and developing markets.

In early 2011, Gemalto became the MasterCard's preferred emergency card replacement vendor worldwide. This service enables premium cardholders to receive their new cards within 24 hours, almost anywhere in the world. Our issuance solutions are strategically designed for card distribution to end-users with full functionality, easy to use interfaces, and leading security features. In India, Gemalto is supplying EMV cards to the well-known private banks.

4.Do bank customers need to change/upgrade their Debit/Credit cards?

Hon Kuan Lee: Migration to EMV provides world class security. Hence, in order benefit from the EMV technology and avoid skimming and fraud, the debit/credit cards need to be upgraded to an EMV chip card from the regular magnetic strip cards. At present, majority of banks in India have already started issuing EMV chip cards to their customers.

5.Can you give a brief on the up-gradation that needs to be done by banks and retailers for the new EMV standard?

Hon Kuan Lee: RBI has been working towards putting in place a system to make both credit card and debit card transactions safer. With its latest directive for banks and financial institutions to migrate to the EMV technology by June 30, 2013, RBI is pushing banks nationwide to implement safety measures to eliminate cases of fraud and ensure secure transactions.

The migration from magnetic strip cards to EMV requires investment in upgrading the banking infrastructure, ATM, point-of-sales terminals and associated processes. An issuer migrating to EMV chip card issuance needs to consider at least two main areas of implementation activity:

a)Deploy EMV compliant terminals

b)Upgrade network and host systems to process chip transactions

However, considering the benefits and security level that can be achieved using EMV card, the cost for up-gradation is completely justified. This also helps to strengthen customer's trust in their serving banks. At the same time, banks can avoid complications and hassles due to card fraud.