This is page 2 of:
Why Did Gonzales Hackers Like European Cards So Much Better?
That brings us back to Post reporter Andrea Peterson, who asked former U.S. Secret Service agent Levi Gundertabout the $50-to-$10 difference. Gundert’s answer: European merchants rely on chip-and-PIN cards, which are more secure and also harder to copy than the easily clonable U.S.-standard mag-stripe cards. But many European cards also still have a mag stripe, so in the U.S. they’re still easy to exploit.
But there’s another factor: Some European banks have a delay in processing transactions over weekends, Gundert said. That means the “cashers” in the U.S. who actually get money from ATMs or buy pricey merchandise to cash out the stolen card numbers can
wait until the weekend and then run as many transactions as possible, capitalizing on that delay. As soon as fraud analytics catches the cashing out, the accounts can be blocked—but by then, the cashers have their cash and merchandise.
That weekends-off approach to fraud prevention may sound crazy, but it wouldn’t be if chip-and-PIN-capable merchants weren’t so rare in the U.S. If U.S. merchants used chip-and-PIN, even side-by-side with mag-stripe, the lower-intensity European antifraud efforts wouldn’t matter. Who’d want to work so hard to steal card numbers that couldn’t be cashed out?
(And despite the fact that increasing numbers of PIN pads have chip-card
slots as standard equipment, U.S. chains aren’t using them. We’ve been making informal surveys of big-chain stores that regularly get cross-border Canadian shoppers. Most of the stores have slots for chip-and-PIN cards, but none of them we’ve seen yet have the capability turned on. “The first thing they always do is stick the card in the slot,” one associate told us. “Then we have to tell them to swipe it.”)
If chip-equipped cards didn’t have to be swiped, they’d be much harder for cashers to cash out. Rare or not, the value of stolen European cards would plummet. Instead, the no-chips-we’re-American policy means both that U.S. cards are less secure and so are European cards.
Yes, there are still practical and legal barriers to chip-and-PIN getting a U.S. foothold—including the Durbin requirement that multiple processing networks have to be available, which means a chip-only debit card would require two separate debit networks that both support chip transactions, along with potentially two debit networks that support legacy mag-stripe transactions. At that point it sounds like implementing chip-and-PIN in the U.S. will never be practical.
But it will, and the sooner the better. As long as the U.S. is a casher’s paradise, U.S. retailers will bear a sizable part of the financial hit from gangs like Gonzalez’s—no matter how many Hacker 1s and Hacker 2s the feds manage to find.
-Marc
August 1st, 2013 at 5:59 am
I am still unclear about the core point here– why higher value of European cards.
Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently.
Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented–the US–and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them?
Can anyone clarify?
August 1st, 2013 at 12:26 pm
Two possible reasons that I can think of and have seen in the past – 1) Cards issued by European banks when used online cross border don’t usually support AVS checks. So, when a European card is used with a billing address that’s in the US, an ecom merchant wouldn’t necessarily know that the shipping zip code doesn’t match the billing code.
2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven’t developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved.
August 1st, 2013 at 10:25 pm
A smart card slot in terminals doesn’t mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don’t have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don’t get your card(t) before the terminal (horse).
August 3rd, 2013 at 2:57 pm
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts.
August 8th, 2013 at 12:17 pm
@David True,
The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer.
If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States.
If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24×7.