The Credit Cards’ Worst Nightmare: Perfect Encryption

Written by Evan Schuman
March 28th, 2008

No one in retail would argue with the statement that there isn’t today—and never will be—perfect security. Given the cat-and-mouse game that retailers play with cyberthieves, coupled with the fact that the professional thieves take breaking into retail systems a lot more seriously than most retailers take protecting them, there’s little doubt why.

The argument that won’t die, though, is that security would be a lot better if responsibility shifted away from retailers and onto the banks. The CIO of the National Retail Federation, David Hogan, has been one of the first and most vocal advocates of that approach. The credit card brands won’t hear of it.

Then there are those who advocate a Chip and PIN approach—such as the one being deployed in the U.K. and about to be rolled out in Canada—as much more secure than our current system. Again, the card brands poo-poo the idea.

Remember the zero liability controversy? That’s the theory that an unintended consequence of zero liability programs is that they start the domino effect that has sharply crippled retail security efforts. (The short version of the theory is that by taking away the fraud pain from consumers, they continue to shop with retailers with weak security, which takes away any ROI justification for that chain’s CFO to spend more on security.)

This all came up earlier this week as I was talking with a reader, who happens to coordinate security activities at a Fortune 50 retailer. We were talking about Hannaford and some related security issues and I mentioned the unintended consequence theory. He paused and asked what made me think it was unintended.

Cynical I am, but not paranoid. Well, at least not that paranoid, I thought. Then again, is it coincidental that Visa, Mastercard and the others just about always end up on the other side of the security argument? Could it truly be that they have some kind of a long-term strategic incentive to keep security looking good, but not too good? I was skeptical.

The security exec then asked an annoyingly thought-provoking question: What do you think would happen if retailers were given perfect encryption? Answering his own question (because I certainly wasn’t able to do it), he painted a picture of retailers who would use their perfectly-protected data and would confidently let it ride atop the public Internet. At that point, paying for the private security tunnels of a Visa or MasterCard would no longer be essential.

The credit card brands would then turn into entirely marketing organizations. Yes, they’re close to that today, but the interchange fees pay for all of that. Without it, alternative payment players—with true value-add for retailers—would become powerful and the brands would be in a dramatically weaker position.

Remember how Microsoft initially feared the Web and how AOL should have feared it? Is that how Visa views perfect—or close to perfect—encryption? I’m not certain that I entirely buy into this theory, but the next time one of the card brands resists a security improvement initiative, I’m likely to briefly see it in a very different light.


2 Comments | Read The Credit Cards’ Worst Nightmare: Perfect Encryption

  1. Bruce Cundiff Says:

    Isn’t “Perfect Encryption” an oxymoron?

  2. Justa Guess Says:

    Keep in mind it is almost never Visa or MasterCard or the banks that pay for fraudulent transactions, it is the merchant who suffers the chargeback, plus a chargeback penalty fee, plus the merchant pays an Interchange fee for the original transaction, and another one for the refund transaction. So the card brands and banks actually make money on fraud, except when the merchant goes bankrupt. The only incentive for the card brands and banks to control fraud is to keep it below the “threshold of pain,” that is, below the level where merchants decide the costs of taking cards outweigh the benefits.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.