This is page 2 of:
Why Did Gonzales Hackers Like European Cards So Much Better?
That brings us back to Post reporter Andrea Peterson, who asked former U.S. Secret Service agent Levi Gundertabout the $50-to-$10 difference. Gundert’s answer: European merchants rely on chip-and-PIN cards, which are more secure and also harder to copy than the easily clonable U.S.-standard mag-stripe cards. But many European cards also still have a mag stripe, so in the U.S. they’re still easy to exploit.
But there’s another factor: Some European banks have a delay in processing transactions over weekends, Gundert said. That means the “cashers” in the U.S. who actually get money from ATMs or buy pricey merchandise to cash out the stolen card numbers can
wait until the weekend and then run as many transactions as possible, capitalizing on that delay. As soon as fraud analytics catches the cashing out, the accounts can be blocked—but by then, the cashers have their cash and merchandise.
That weekends-off approach to fraud prevention may sound crazy, but it wouldn’t be if chip-and-PIN-capable merchants weren’t so rare in the U.S. If U.S. merchants used chip-and-PIN, even side-by-side with mag-stripe, the lower-intensity European antifraud efforts wouldn’t matter. Who’d want to work so hard to steal card numbers that couldn’t be cashed out?
(And despite the fact that increasing numbers of PIN pads have chip-card
slots as standard equipment, U.S. chains aren’t using them. We’ve been making informal surveys of big-chain stores that regularly get cross-border Canadian shoppers. Most of the stores have slots for chip-and-PIN cards, but none of them we’ve seen yet have the capability turned on. “The first thing they always do is stick the card in the slot,” one associate told us. “Then we have to tell them to swipe it.”)
If chip-equipped cards didn’t have to be swiped, they’d be much harder for cashers to cash out. Rare or not, the value of stolen European cards would plummet. Instead, the no-chips-we’re-American policy means both that U.S. cards are less secure and so are European cards.
Yes, there are still practical and legal barriers to chip-and-PIN getting a U.S. foothold—including the Durbin requirement that multiple processing networks have to be available, which means a chip-only debit card would require two separate debit networks that both support chip transactions, along with potentially two debit networks that support legacy mag-stripe transactions. At that point it sounds like implementing chip-and-PIN in the U.S. will never be practical.
But it will, and the sooner the better. As long as the U.S. is a casher’s paradise, U.S. retailers will bear a sizable part of the financial hit from gangs like Gonzalez’s—no matter how many Hacker 1s and Hacker 2s the feds manage to find.