Is A Rewritable Mag-Stripe The Answer To Cloned Cards?

The security worlds of bankers and retailers (ATMs and POSes/card swipes) have as much in common as they have differences. But some security work the Bank of New Zealand is doing--its version is called Liquid Encryption Number (LEN)--may hold a clue for the best way to combat cloned payment cards.

The idea, which isn't especially new in security circles, has LEN rewriting "the data on a valid mag-stripe whenever a customer completes a transaction," thereby making cloned card attempts pointless, according to a recent report in The Nilson Report. The technique has been used on all of the bank's cards since 2008 and claims a 50 percent fraud reduction from counterfeit cards.

Clearly, there are pragmatic problems with applying this approach in retail. It requires specialized hardware. Plus, the bank's control of ATMs is much more powerful and direct than a chain's control over various card swipe devices, which are rarely replaced until it's necessary.

"The thing with LEN, as I understand it, is that the bank needs to partially re-encode the stripe (like the old plans for track 3). Therefore, retailers need more than just a mag-stripe reader," opined StorefrontBacktalk PCI Columnist Walter Conway. "Banks can put these in their ATMs, because they own/control them. Also, there are fewer units than if they had to replace every POS terminal in New Zealand. Maybe the answer to a secure card is EMV with a re-writable mag-stripe--and a picture, a signature, embossing, a hologram and writing the first 4 digits on the card."

Walt's point is a good one. Today, the most popular idea for attacking the cloners is some version of a digital fingerprint of the card. But isn't rewriting the mag-stripe a different way of achieving the same objective? You either take a picture of the card and match future card attempts to that picture, or you change the card each time to what you want it to be.

Either way, you've made cloning much more difficult and less profitable. "It may be limited, but so was just about every disruptive and new technology at the start," Conway said.