A new effort to make mag-stripe cards less fraud-prone is coming at a particularly appropriate time. Last week, NCR announced new technology for its ATMs that includes detection and electromagnetic jamming of card skimmers that thieves often attach to ATMs to capture mag-stripe data. NCR is also pitching a phone-home feature, so the machines can report any signs of fraud in real time. In theory, both these features could be applied to PINpads to reduce card fraud at the point of sale, too.
It's good technical solution—but it solves the wrong problem, at least for most retailers.
Virtually all PINpads have swipe slots—and the swipe slot is inherently the biggest security hole in the payment-card process. It has one advantage: It's cheap. The fact that it's also unreliable, hard to keep clean and highly prone to skimmer insertion should have sent it the way of the zip-zap machine long ago.
The problem isn't just that swipe slots won't read EMV-chip cards, a capability that Visa and MasterCard are mandating for most PINpads by 2015. The problem is, they don't even work well with mag-stripe cards. Doubt it? Watch customers at any grocery checkout swiping their cards over and over until they're finally successful—or they hand the card over for the cashier to swipe.
This is lousy technology. It's made worst by how easily thieves can add skimmers, but it starts out irredeemably bad—and goes downhill from there.
The sad thing is that PINpad makers shouldn't have to add an expensive, ATM-style motorized card reader to a PINpad to get rid of the swipe slot. Replacing the swipe slot with a passive insert-and-remove slot would make skimming harder and jamming more effective. That would also create a single slot for both mag-stripe and EMV chip cards.
With that October 2015 deadline marching closer, along with an inevitable wave of PINpad upgrades required to meet it, it really is time to get rid of the swipe slot. And while we're at it, adding some skimmer-jamming isn't a bad idea either.