Is A Rewritable Mag-Stripe The Answer To Cloned Cards?
Written by Evan SchumanThe security worlds of bankers and retailers (ATMs and POSes/card swipes) have as much in common as they have differences. But some security work the Bank of New Zealand is doing–its version is called Liquid Encryption Number (LEN)–may hold a clue for the best way to combat cloned payment cards.
The idea, which isn’t especially new in security circles, has LEN rewriting “the data on a valid mag-stripe whenever a customer completes a transaction,” thereby making cloned card attempts pointless, according to a recent report in The Nilson Report. The technique has been used on all of the bank’s cards since 2008 and claims a 50 percent fraud reduction from counterfeit cards.
Clearly, there are pragmatic problems with applying this approach in retail. It requires specialized hardware. Plus, the bank’s control of ATMs is much more powerful and direct than a chain’s control over various card swipe devices, which are rarely replaced until it’s necessary.
“The thing with LEN, as I understand it, is that the bank needs to partially re-encode the stripe (like the old plans for track 3). Therefore, retailers need more than just a mag-stripe reader,” opined StorefrontBacktalk PCI Columnist Walter Conway. “Banks can put these in their ATMs, because they own/control them. Also, there are fewer units than if they had to replace every POS terminal in New Zealand. Maybe the answer to a secure card is EMV with a re-writable mag-stripe–and a picture, a signature, embossing, a hologram and writing the first 4 digits on the card.”
Walt’s point is a good one. Today, the most popular idea for attacking the cloners is some version of a digital fingerprint of the card. But isn’t rewriting the mag-stripe a different way of achieving the same objective? You either take a picture of the card and match future card attempts to that picture, or you change the card each time to what you want it to be.
Either way, you’ve made cloning much more difficult and less profitable. “It may be limited, but so was just about every disruptive and new technology at the start,” Conway said.
-Marc
July 22nd, 2010 at 12:21 pm
On paper this works but this was tried in the early days of mag stripe credit cards and it failed miserably. The problem is, one bad writer, or more likely, some percentage of faulty writers can render the entire system useless. There is a good chance that hardware has significantly improved in the 20+ years since it was tried, but I think you’ll still have some percentage of faulty writers and the overall system must compensate for this factor to be successful.
July 27th, 2010 at 8:10 am
So … LEN has been sold to me as a cost-effective magstripe alternative to EMV, because EMV needs special card readers and processing systems. Just run that past me again, I must be missing something. EMV needs a certain infrastructure, but now that it’s pretty much implemented throughout the developed world, it’s not so much of an issue. Interesting that the cost effective magstripe alternative to EMV, the LEN solution, needs hardware upgrades to every POS and ATM in the world, in order to render the data on the stripe, clone resistant.
Chips are already clone resistant, and magstripe clones only really affect transactions in the undeveloped world. Why should the developed world worry?