Evan Schuman's StorefrontBacktalk

This is all about risk limitation. But associates don’t typically inspect the payment cards. All they do is see the consumer swipe a card and then note that a verification code is displayed. What if we took Jumio’s Webcam and reversed its application? What if the consumer has a card swipe in his home and the Webcam enables someone from, let’s say, Amazon to witness the consumer swiping something? How is that any different from the consumer seeing the card swipe in the store?

The answer might involve the integrity of the card swipe. But when that integrity is violated today—consider Michaels Stores’ recent card-swipe-swap headache—card present is not violated. Problems certainly happen. But in the context of card present, if the card swipe is not the issue, what is?

A lot of vendors are experimenting with non-traditional ways for retailers—and their associates—to interact with card data. Jumio wouldn’t detail its approach, but 403 Labs QSA Randy Will speculated that the magic sauce involves the differences between a flat photograph and video. This is all about trying to determine if the card is really there—as opposed to being a simple photograph. Given how easy it is to create a bogus card if the thief has the correct card data, I’m not so sure what the point would be.

Still, Will has a theory as to how they are trying. “Based on the subtle movements when you hold a card up to a Webcam, shadows will change on the edges of the card and embossed characters. On a photocopy, all edges will remain constant,” he said. “Also, holograms and metallic ink will have very different properties than a photocopy that can only be made out in video.”

That raises the question of whether frequent E-Commerce shoppers would want to keep holding the card up in the air. Wouldn’t they be more likely to angle the camera downward and shoot the card while it’s lying flat on the desk or tabletop? “One thing I would be interested in trying is having a camera mounted in a steady tripod already pointed at a stationary card, which would basically reduce the video stream to a still image” and thereby negate almost all the security benefits.

What about EMV efforts? If the data on the chip can be transmitted, what is the anti-fraud benefit of in-person?

The brands and processors need to work out their own definitions, but this is yet another aspect of payment that may be virtually unrecognizable in a couple of years.