Credit and Debit Card Ratings

Risky New Bank Card Technology – Is Your Card At Risk?

Though it may be convenient to pay with a wave of your credit or debit card, Consumer Report’s Andrea Rock says so-called contactless cards make your personal information vulnerable.  Whether you know it or not, your credit or debit cards might contain a tiny computer chip and radio antennae to transmit account information from your card, even when you’re not shopping.

Thieves can steal your credit card information from only a few inches away using a card reader that sells for less than $100.  By simply transferring your account number, expiration date and security data to a computer and transferring it to blank cards, a counterfeit can be made of your card. Thieves can then make successful transactions using your “card” while it’s still in your wallet.

So how do you know if your cards use this technology? Chase cards calls their contactless cards “Blink”, MasterCards uses “Pay Pass” to identify its contactless cards, and others simply have a symbol consisting of four curved lines like the one shown below.

rfid

An industry newsletter, The Nilson Report, says 35 million contactless chip cards are in circulation in the United States alone. The cards are touted as being convenient, but are vulnerable to skimming without ever leaving your wallet.

The technology is active weather you know you have it or not. Shields of wallets marketed as RFID-blocking devices can make it more difficult for someone with an electromagnetic reader to read your cards, but they don’t entirely block transmission of card data. Another option is a protective sleeve made out of duct tape lined with aluminum foil. Tests show that it worked better than many of the ones you can buy, but even that didn’t block the signal completely. So while waiving your card is easy, making sure it’s secure is not. There’s not much you can do but ask your bank to replace the card with one that does not have this technology.

Chase spokesman Paul Hartwick says the security codes on its contactless cards are designed to change with every transaction, as they are with most RFID-enabled cards, so that even if a card is counterfeited, it would work for only one fraudulent transaction.

“If I put a reader next to a turnstile at Grand Central Terminal at rush hour, I could probably capture data from 5,000 cards that evening, and what you’re getting from each one is enough to initiate a transaction,” says Mark Rasch, a former Justice Department computer-crime prosecutor who serves as director of cybersecurity and privacy consulting at CSC, a business technology firm. “Moreover, repeatedly scanning a card that is lost, stolen or intercepted in the mail produces multiple security codes,” Paget says.

The Smart Card Alliance, an industry group, maintains that contactless card technology deployed by American Express, Discover, MasterCard, and Visa is secure and that there have been no reports of consumers been victimized. American Express says its contactless cards do not reveal the card account number, and demonstrations supported this.

According to Kevin Fu, a University of Massachusetts at Amherst assistant professor, the absence of a flood of fraud reports linked to the cards is not proof of their security. Because the contactless cards in circulation in the U.S. represent only 3.5 percent of the total debit and credit cards in use, they have not yet presented a big enough target to lure many crooks, especially when traditional magnetic stripe cards are so especially counterfeited.

For more information, visit:

http://www.consumerreports.org/cro/magazine-archive/2011/june/money/credit-card-fraud/rfid-credit-cards/index.htm

Tag: prepaid card

  • Risky New Bank Card Technology – Is Your Card At Risk?

    Risky New Bank Card Technology – Is Your Card At Risk?

    Though it may be convenient to pay with a wave of your credit or debit card, Consumer Report’s Andrea Rock says so-called contactless cards make your personal information vulnerable.  Whether you know it or not, your credit or debit cards might contain a tiny computer chip and radio antennae to transmit account information from your card, even when you’re not shopping.

    Thieves can steal your credit card information from only a few inches away using a card reader that sells for less than $100.  By simply transferring your account number, expiration date and security data to a computer and transferring it to blank cards, a counterfeit can be made of your card. Thieves can then make successful transactions using your “card” while it’s still in your wallet.

    So how do you know if your cards use this technology? Chase cards calls their contactless cards “Blink”, MasterCards uses “Pay Pass” to identify its contactless cards, and others simply have a symbol consisting of four curved lines like the one shown below.

    rfid

    An industry newsletter, The Nilson Report, says 35 million contactless chip cards are in circulation in the United States alone. The cards are touted as being convenient, but are vulnerable to skimming without ever leaving your wallet.

    The technology is active weather you know you have it or not. Shields of wallets marketed as RFID-blocking devices can make it more difficult for someone with an electromagnetic reader to read your cards, but they don’t entirely block transmission of card data. Another option is a protective sleeve made out of duct tape lined with aluminum foil. Tests show that it worked better than many of the ones you can buy, but even that didn’t block the signal completely. So while waiving your card is easy, making sure it’s secure is not. There’s not much you can do but ask your bank to replace the card with one that does not have this technology.

    Chase spokesman Paul Hartwick says the security codes on its contactless cards are designed to change with every transaction, as they are with most RFID-enabled cards, so that even if a card is counterfeited, it would work for only one fraudulent transaction.

    “If I put a reader next to a turnstile at Grand Central Terminal at rush hour, I could probably capture data from 5,000 cards that evening, and what you’re getting from each one is enough to initiate a transaction,” says Mark Rasch, a former Justice Department computer-crime prosecutor who serves as director of cybersecurity and privacy consulting at CSC, a business technology firm. “Moreover, repeatedly scanning a card that is lost, stolen or intercepted in the mail produces multiple security codes,” Paget says.

    The Smart Card Alliance, an industry group, maintains that contactless card technology deployed by American Express, Discover, MasterCard, and Visa is secure and that there have been no reports of consumers been victimized. American Express says its contactless cards do not reveal the card account number, and demonstrations supported this.

    According to Kevin Fu, a University of Massachusetts at Amherst assistant professor, the absence of a flood of fraud reports linked to the cards is not proof of their security. Because the contactless cards in circulation in the U.S. represent only 3.5 percent of the total debit and credit cards in use, they have not yet presented a big enough target to lure many crooks, especially when traditional magnetic stripe cards are so especially counterfeited.

    For more information, visit:

    http://www.consumerreports.org/cro/magazine-archive/2011/june/money/credit-card-fraud/rfid-credit-cards/index.htm

  • FDIC Insurance And Prepaid Debit Cards

    FDIC Insurance And Prepaid Debit Cards

    When you have a debit card tied to a traditional bank account and the bank goes out of business, the federal government guarantees you up to $250,000 of the money that you have in your account through mandatory FDIC insurance.

    “FDIC insurance is an important financial protection,” says Lauren Saunders, managing attorney of the National Consumer Law Center in Washington, D.C. “It ensures the safety of your money up to $250,000 if the bank fails.” So your bank could fail one day and a new bank could take over the next and the money in your bank account (up to $250,000) still would be available.

    “It’s completely seamless for the customer,” says Susan Weinstock, director of Pew’s Safe Checking in the Electronic Age Project. “The only difference for the customer is a different name on the door for the bank.”

    Unlike bank checking accounts, prepaid debit cards are not required to carry any mandatory deposit insurance, but the “vast majority” are offering voluntary FDIC insurance to customers, Weinstock says. Notable exceptions are some prepaid debit cards from American Express, including the American Express Target card, Weinstock says.

    So what happens if a company issuing a prepaid debit card without FDIC insurance goes out of business? How and when would customers get their money back? “It generally depends on state law. States have money transmitter laws and they vary a lot state to state,” Saunders says. “It’s not as robust and seamless as FDIC insurance, how much protection you have, and how that protection works varies.”

    A report from Pew Charitable Trusts titled “Imperfect Protection: Using Money Transmitter Laws to Insure Prepaid Cards” warns that “customers would be compensated with varying amounts of money, depending on the state in which they live, and some states’ residents may not be protected at all.”

    And prepaid debit card customers may have to wait months as creditors in the defunct company’s bankruptcy proceedings in order to receive any money back, according to Pew. “Without a streamlined process such as the one offered by the FDIC, a consumer would likely have to navigate the legal process in order to receive their funds. Cardholders would be unsecured creditors in a bankruptcy proceeding, and may have to wait several months for the case to be resolved before having access to the money on their cards, if they get access at all,” the Pew report states.

    That’s why it’s a good idea to check and see if your prepaid debit card provides voluntary FDIC insurance. And you may have to do some digging, according to Saunders. “Just because a card is issued by a FDIC member bank doesn’t necessarily mean the consumer has FDIC insurance,” Saunders says. “Just seeing the FDIC logo doesn’t guarantee it.”

    Saunders suggests looking for information on FDIC insurance in a cardholder agreement and on the prepaid debit card’s website. And Weinstock recommends registering a prepaid debit card because the name of the cardholder may be necessary to implement the FDIC insurance if needed. “If they don’t register the card, it may not necessarily be insured by the FDIC.”

Credit and Debit Card Ratings