plastic money part 2

8/20/2019 Plastic Money Part 2

http://slidepdf.com/reader/full/plastic-money-part-2 1/41

PROCESS OF CREDIT CARDS

How Credit Cards Work? Credit cards are issued after an account has beenapproved by the credit provider, after which cardholders canuse it to make purchases at merchants accepting that card.

When a purchase is made, the credit card user agrees topay the card issuer.

The cardholder indicates consent to pay by signing areceipt with a record of the card details and indicating the

amount to be paid or by entering a personal identification



number (PI!. "lso, many merchants now accept verbal authori#ations viatelephone and electronic authori#ation using the Internet,known as a $Card%Cardholder ot Present$ (CP! transaction. &lectronic verification systems allow merchants to verifythat the card is valid and the credit card customer has sufficientcredit to cover the purchase in a few seconds, allowing theverification to happen at time of purchase.

The verification is performed using a credit card paymentterminal or Point of 'ale (P'! system with a communicationslink to the merchant$s ac)uiring bank. *ata from the card isobtained from a magnetic stripe or chip on the card+ the latter

system is in the nited -ingdom and Ireland commonly knownas Chip and PI, but is more technically an &/ card.

ther variations of verification systems are used byecommerce merchants to determine if the user$s account isvalid and able to accept the charge. These will typically involvethe cardholder providing additional information, such as thesecurity code printed on the back of the card, or the address ofthe cardholder.

&ach month, the credit card user is sent a statementindicating the purchases undertaken with the card, anyoutstanding fees, and the total amount owed. "fter receiving the statement, the cardholder may disputeany charges that he or she thinks are incorrect (see 0air Credit1illing "ct for details of the ' regulations!. therwise, the cardholder must pay a defined minimumproportion of the bill by a due date, or may choose to pay a

higher amount up to the entire amount owed.The credit issuer charges interest on the amount owed if

the balance is not paid in full (typically at a much higher ratethan most other forms of debt!.

'ome financial institutions can arrange for automaticpayments to be deducted from the user$s bank accounts, thusavoiding late payment altogether as long as the cardholder has

sufficient funds.



Transaction Steps-

• "uthori#ation The cardholder pays for the purchase and the merchantsubmits the transaction to the ac)uirer (ac)uiring bank!. Theac)uirer verifies the credit card number, the transaction typeand the amount with the issuer (Card2issuing bank! andreserves that amount of the cardholder$s credit limit for themerchant. "n authori#ation will generate an approval code, which themerchant stores with the transaction.• 1atching

"uthori#ed transactions are stored in 3batches3, which aresent to the ac)uirer. 1atches are typically submitted once perday at the end of the business day.

If a transaction is not submitted in the batch, theauthori#ation will stay valid for a period determined by theissuer+ after which the held amount will be returned back to thecardholder$s available credit. 'ome transactions may be submitted in the batch withoutprior authori#ations+ these are either transactions falling underthe merchant$s floor limit or ones where the authori#ation wasunsuccessful but the merchant still attempts to force thetransaction through.

('uch may be the case when the cardholder is not presentbut owes the merchant additional money, such as e4tending ahotel stay or car rental.!• Clearing "nd 'ettlement

The ac)uirer sends the batch transactions through the creditcard association, which debits the issuers for payment andcredits the ac)uirer. &ssentially, the issuer pays the ac)uirer for the transaction.• 0unding nce the ac)uirer has been paid, the ac)uirer pays themerchant.

The merchant receives the amount totaling the funds in the

batch minus the 3discount rate,3 which is the fee the merchantpays the ac)uirer for processing the transactions.



• Chargeback " chargeback is an event in which money in a merchantaccount is held due to a dispute relating to the transaction.Charge backs are typically initiated by the cardholder. In the event of a chargeback, the issuer returns thetransaction to the ac)uirer for resolution. The ac)uirer thenforwards the chargeback to the merchant, who must eitheraccept the chargeback or contest it.

TYPES OF CREDIT CARDS• 'ecured Credit Cards

" secured credit card is a type of credit card secured by adeposit account owned by the cardholder. Typically, thecardholder must deposit between 5667 and 8667 of the totalamount of credit desired.

Thus if the cardholder puts down 95666, they will be givencredit in the range of 9:66;95666.

In some cases, credit card issuers will offer incentives evenon their secured card portfolios.

In these cases, the deposit re)uired may be significantlyless than the re)uired credit limit, and can be as low as 567 ofthe desired credit limit. This deposit is held in a special savingsaccount. Credit card issuers offer this because they have noticed thatdelin)uencies were notably reduced when the customerperceives something to lose if the balance is not repaid.

The cardholder of a secured credit card is still e4pected to

make regular payments, as with a regular credit card, butshould they default on a payment, the card issuer has theoption of recovering the cost of the purchases paid to themerchants out of the deposit.

The advantage of the secured card for an individual withnegative or no credit history is that most companies reportregularly to the ma<or credit bureaus. This allows for building ofpositive credit history.•

Prepaid Credit Cards " prepaid credit card is not a credit card, since no credit is



offered by the card issuer= the card2holder spends money whichhas been 3stored3 via a prior deposit by the card2holder orsomeone else, such as a parent or employer. >owever, it carries a credit2card brand (/isa, asterCard,

"merican &4press or *iscover! and can be used in similarways <ust as though it were a regular credit card. "fterpurchasing the card, the cardholder loads the account with anyamount of money, up to the predetermined card limit and thenuses the card to make purchases the same way as a typicalcredit card.

Prepaid cards can be issued to minors (above 5?! sincethere is no credit line involved. The main advantage over

secured credit cards (see above section! is that you are notre)uired to come up with 9:66 or more to open an account. With prepaid credit cards you are not charged any interestbut you are often charged a purchasing fee plus monthly feesafter an arbitrary time period. any other fees also usually apply to a prepaid card.Prepaid credit cards are sometimes marketed to teenagers forshopping online without having their parents complete the

transaction. 1ecause of the many fees that apply to obtainingand using credit2card2branded prepaid cards, the 0inancialConsumer "gency of Canada describes them as 3an e4pensiveway to spend your own money3. The agency publishes a booklet, 3Pre2paid cards3, whiche4plains the advantages and disadvantages of this type ofprepaid card.

CH (6)-DEBIT CARDS

INTRODUCTIONThe debit card has emerged from the shadow of its older



sibling, the credit card. ver the past decade, debit card hasgrown from accounting for 8@A million transactions in 5BB6to.5: billion transactions in 8668, to challenge the credit cardas the preferred payment card.

"s it stands, the debit card industry is a multi2billion dollarengine that helps drive bank profits and point2of purchaseconsumer sales 2 but is also beginning to redefine traditionalpayment options in the business and government sectors, suchas food stamps, benefits, and payroll. " debit card (also known as a bank card or check card! is aplastic card which provides an alternative payment method tocash when making purchases.

0unctionally, it can be called an electronic check, as thefunds are withdrawn directly from either the bank account orfrom the remaining balance on the card. In some cases, thecards are designed e4clusively for use on the Internet, and sothere is no physical card.

The use of debit cards has become widespread in manycountries and has overtaken the check and in some instancescash transactions by volume.

Dike credit cards, debit cards are used widely for telephoneand Internet purchases, and unlike credit cards the funds aretransferred from the bearer$s bank account instead of havingthe bearer to pay back on a later date.

*ebit cards can also allow for instant withdrawal of cash,acting as the "T card for withdrawing cash and as a che)ueguarantee card. erchants can also offer 3cash back%cash out3facilities to customers, where a customer can withdraw cash

along with their purchase.

Debit Cards: IssuersThe banks issuing debit cards include=1ank of "mericaCitibank "merican &4press'tandard Chartered

>'1C



FUNCTIONS Two decades ago, the number of debit cards in circulationwas appro4imately 5B million. This figure is pro<ected to cross?A.A million by 865E. " debit card (also known as a bank card or check card! is aplastic card that provides an alternative payment method tocash when making purchases.

0unctionally, it can be called an electronic check, as thefunds are withdrawn directly from either the bank account orfrom the remaining balance on the card. In some cases, the cards are designed e4clusively for useon the Internet, and so there is no physical card.

In many countries the use of debit cards has become sowidespread that their volume of use has overtaken or entirelyreplaced the check and, in some instances, cash transactions. Dike credit cards, debit cards are used widely for telephoneand Internet purchases and, unlike credit cards, the funds aretransferred immediately from the bearer$s bank account insteadof having the bearer pay back the money at a later date. *ebit cards may also allow for instant withdrawal of cash,acting as the "T card for withdrawing cash and as a checkguarantee card.

erchants may also offer cash back facilities to customers,where a customer can withdraw cash along with their purchase. *ebit cards can also allow for instant withdrawal of cash,acting as the "T card for withdrawing cash and as a che)ueguarantee card.

erchants can also offer 3cash back3%3cash out3 facilities tocustomers, where a customer can withdraw cash along withtheir purchase.

HISTORY The history of debit card implies that the concept of debitcard is not new. >istory of debit card dates back around 86 years ago whichhighlighted the introduction of e2commerce and alternative



means of payment.

Parts f The *ebit Card "n e4ample of the front of a typical debit card=

5. Issuing bank logo8. &/ chip?. >ologramA. Card number :. Card brand logoE. &4piration date@. CardholderFs

Front



Back

"n e4ample of the reverse side of a typical debit card=

5. agnetic stripe8. 'ignature strip?. Card 'ecurity Code

TYPES OF DEBITCARDThere are currently three ways that debit card transactions

are processed= online debit (also known as PI debit!, offlinedebit (also known as signature debit! and the &lectronic Purse

Card 'ystem. It should be noted that one physical card caninclude the functions of an online debit card, an offline debitcard and an electronic purse card. "lthough many debit cardsare of the /isa or asterCard brand, there are many othertypes of debit card, each accepted only within a particularcountry or regionG nline *ebit 'ystem nline debit cards re)uire electronic authori#ation of every

transaction and the debits are reflected in the userFs accountimmediately. The transaction may be additionally secured withthe personal identification number (PI! authentication systemand some online cards re)uire such authentication for everytransaction, essentially becoming enhanced automatic tellermachine ("T! cards.

ne difficulty in using online debit cards is the necessity ofan electronic authori#ation device at the point of sale (P'!

and sometimes also a separate PI pad to enter the PI,although this is becoming commonplace for all card



transactions in many countries.verall, the online debit card is generally viewed as superior

to the offline debit card because of its more secureauthentication system and live status, which alleviatesproblems with processing lag on transactions that may havebeen forgotten or not authori#ed by the owner of the card.G ffline *ebit Card ffline debit cards have the logos of ma<or credit cards (e.g./isa or asterCard! or ma<or debit cards (e.g. aestro in thenited -ingdom and other countries, but not the nited 'tates!and are used at the point of sale like a credit card (with payerFssignature!.

This type of debit card may be sub<ect to a daily limit, and%or a ma4imum limit e)ual to the current%checking account balancefrom which it draws funds.

Transactions conducted with offline debit cards re)uire 8H?days to be reflected on usersF account balances. In somecountries and with some banks and merchant serviceorgani#ations, a 3credit3 or offline debit transaction is withoutcost to the purchaser beyond the face value of the transaction,

while a small fee may be charged for a 3debit3 or online debittransaction (although it is often absorbed by the retailer!.

ther differences are that online debit purchasers may optto withdraw cash in addition to the amount of the debitpurchase (if the merchant supports that functionality!+ also,from the merchant$s standpoint, the merchant pay slower feeson online debit transaction as compared to 3credit3 (offline!debit transactions.

G &lectronic Purse Card 'ystem 'mart2card2based electronic purse systems in which valueis stored on the card chip, not in an e4ternally recordedaccount, so that machines accepting the card need no networkconnectivity are in use throughout &urope since the mid25BB6s,most notably in ermany, "ustria, 1elgium, The ma<or boom insmart card use came in the 5BB6s, with the introduction of thesmart2card2based 'I used in ' mobile phone e)uipment

in &urope. With the ubi)uity of mobile phones in &urope, smart



cards have become very common.G Prepaid debit card Prepaid debit cards, also called reloadable debit cards orreloadable prepaid cards, are often used for recurringpayments. The payer loads funds to the cardholder$s cardaccount. Prepaid debit cards use either the offline debit systemor the online debit system to access these funds. Particularly for companies with a large number of paymentrecipients abroad, prepaid debit cards allow the delivery ofinternational payments without the delays and fees associatedwith international checks and bankG Working of *ebit Card

The user has to present the card to merchant who will swipeit through the electronic terminal and enter the amount ofpurchase. The customers need to sign the transaction slip.

"ccount will be automatically debited for the amount of thepurchase and the transaction can be verified by entering thePI. *ebit Card can be used to access the "ccount from over:,666'hops, *epartment 'tores, Petrol Pumps and

Jestaurants and over 8?: "Ts in India .It can also be used atover A million /isa &lectron merchant locations and e)uallystrong asterCard outlets. If *ebit Card ever gets lost or stolen, card companiesprotect from fraudulent usage at the loss.It is necessary to have a savings or current account with thedebit card issuer+ by filling an application form. The card company then couriers the card across around a

weekFs time. The *ebit card does have a daily limit which couldbe somewhere around Js. 5:,666 at "Ts, and Js. 56,666 atmerchant locations. This again is sub<ect to the balanceavailable in the account

ADVANTAGES AND DISADVANTAGES OFDEBIT CARDS

The widespread use of debit and check cards have revealednumerous advantages and disadvantages to the consumer and



retailer alike.

Advantages of debit cards *ebit and check cards, as they have become widespread,have revealed numerous advantages and disadvantages to theconsumer and retailer alike. "dvantages are as follows=G " consumer who is not credit worthy and may find it

difficult or impossible to obtain a credit card can more easilyobtain a debit card, allowing him%her to make plastictransactions. 0or e4ample, legislation often prevents minorsfrom taking out debt, which includes the use of a credit card,but not online debit card transactions.

G se of a debit card is limited to the e4isting funds in theaccount to which it is linked(e4cept cases of offlinepayments!, thereby preventing the consumer from racking updebt as a result of its use, or being charged interest, latefees, or fees e4clusive to credit cards.

G 0or most transactions, a check card can be used to avoidcheck writing altogether. Check cards debit funds from theuser$s account on the spot, thereby finali#ing the transactionat the time of purchase, and bypassing the re)uirement topay a credit card bill at a later date, or to write an insecurecheck containing the account holder$s personal information.

G Dike credit cards, debit cards are accepted by merchantswith less identification and scrutiny than personal checks,thereby making transactions )uicker and less intrusive.nlike personal checks, merchants generally do not believethat a payment via a debit card may be later dishonored.

G nlike a credit card, which charges higher fees and interest

rates when a cash advance is obtained, a debit card may beused to obtain cash from an "T or a PI2based transactionat no e4tra charge, other than a foreign "T fee.

• Debit Cards enefits They help people to be disciplined financially, since one

cannot splurge with the limited amount of funds deposited for

the card.

" person with poor credit can obtain a debit card too muchtrouble.



*ebit cards can be used to make online purchases and

payments. They provide freedom from carrying cash checks while

traveling, herby offering more safety.

Disadvantages of debit cardsThe *ebit card has many disadvantages as opposed to cash or credit=• se of a debit card is not usually limited to the e4isting

funds in the account to which it is linked, most banks allow acertain threshold over the available bank balance which can

cause overdraft fees if the users transaction does not reflectavailable balance.

G 'ome banks are now charging over2limit fees or non2sufficient funds fees based upon pre2authori#ations, andeven attempted but refused transactions by the merchant(some of which may not even be known by the client!.

G In the - and Ireland, among other countries, a consumer who purchases goods or services with a credit card can

pursue the credit card issuer if the goods or services are notdelivered or are unmerchantable.

While they must generally e4haust the process providedby the retailer first, this is not necessary if the retailer hasgone out of business. This protection is not provided bylegislation when using a debit card but may be offered to alimited e4tent as a benefit provided by the card network, e.g.

/isa debit cards.G When a transaction is made using a credit card, thebank$s money is being spent, and therefore, the bank has avested interest in claiming its money where there is fraud ora dispute.

The bank may fight to void the charges of a consumerwho is dissatisfied with a purchase, or who has otherwisebeen treated unfairly by the merchant.

1ut when a debit purchase is made, the consumer hasspent his%her own money, and the bank has little if any



motivation to collect the funds.G In some countries, and for certain types of purchases,

such as gasoline (via a pay at the pump system!, lodging, orcar rental, the bank may place a hold on funds much greaterthan the actual purchase for a fi4ed period of time. >owever,this isn$t the case in other countries, such as 'weden.

ntil the hold is released, any other transactions presentedto the account, including checks, may be dishonored, or maybe paid at the e4pense of an overdraft fee if the accountlacks any additional funds to pay those items.

G While debit cards bearing the logo of a ma<or credit cardare accepted for virtually all transactions where an e)uivalent

credit card is taken, a ma<or e4ception in some countries is atcar rental facilities. In some countries car rental agenciesre)uire an actual credit card to be used, or at the very least,will verify the creditworthiness of the renter using a debitcard. In these unspecified countries, these companies will denya rental to anyone who does not fit the re)uirements, andsuch a credit check may actually hurt one$s credit score, as

long as there is such a thing as a credit score in the countryof purchase and%or the country of residence of the customer.

G any banks are now charging over2limit fees or non2sufficient funds fees based upon pre2authori#ations, andeven attempted but refused transactions by the merchant(some of which may be unknown until later discovery byaccount holder!.

G any merchants mistakenly believe that amounts owed

can be 3taken3 from a customer$s account after a debit card(or number! has been presented, without agreement as todate, payee name, amount and currency, thus causingpenalty fees for overdrafts, over2the2limit, amounts notavailable causing further re<ections or overdrafts, andre<ected transactions by some banks.

G In some countries debit cards offer lower levels of securityprotection than credit cards. Theft of the users PI using

skimming devices can be accomplished much easier with a



PI input than with a signature2based credit transaction.>owever, theft of users$ PI codes using skimming

devices can be e)ually easily accomplished with a debittransaction PI input, as with a credit transaction PI input,and theft using a signature2based credit transaction ise)ually easy as theft using a signature2 based debittransaction.

G In many places, laws protect the consumer from fraudmuch less than with a credit card. While the holder of a creditcard is legally responsible for only a minimal amount of afraudulent transaction made with a credit card, which is oftenwaived by the bank, the consumer may be held liable for

hundreds of dollars, or even the entire value of fraudulentdebit transactions.

The consumer also has a shorter time (usually <ust twodays! to report such fraud to the bank in order to be eligiblefor such a waiver with a debit card, whereas with a creditcard, this time may be up to E6 days. " thief who obtains orclones a debit card along with its PI may be able to cleanout the consumer$s bank account, and the consumer will

have no recourse.

CH(7)-D!"t Car#$ %$& Cr#"tCar#$'

S""ar"t"$ The same financial institutions offer both debit cards andcredit cards. 1oth cards offer special rewards, such as pointsand cash back on purchases made through the card.

*ebit cards and credit cards can be used to make onlinepayments with the help of the pin number assigned to them.

They can be used to withdraw money from "TFs dependingon the cash limit available on these cards.

D"*rnc$ In the case of a credit card, the issuer offers credit andoverdraft facilities. This facility is not available with a debit card,



which will only debit payments from e4isting and availablefunds within the cardholders account.

" credit cardholder therefore has a monthly bill to pay inevery month that the card is used. If they donFt pay that bill,high interest charges are applied.

" debit card holder is free from the hassle of paying thosebills and from the risk of building up large debts to credit cardcompanies.

D!"t Car# Pro!$ can ! +or$ t,anCr#"t Car# Pro!$ When an improper charge appears on the credit card it

cannot automatically out the money and simply need to workwith the credit card issuer to have the charge removed from thebill.

When an improper charge occurs with a debit card,however, the funds are automatically taken from the accountand customer is burdened with attempting to get the moneyback.

eanwhile, he may e4perience cash flow problems and thelegitimate checks could bounce.

Tra%"n +"t, .o/r D!"t Car#$ The reverse side of the debit card will display the names orsymbols of the various "T systems that will accept the card.

*ebit card can be used at any "T in the world as long asthe "T displays one of the same system names or symbolsthat are on debit card.

When obtaining funds at an "T in a foreign country the

funds dispersed will be in the currency of the country going tovisit.



CH (0)-AT1 CARDS

INTRODUCTION "n "T card (also known as a bank card, client card, keycard or cash card! is an I'%I&C @56card issued by a bank,

credit union or building society. It can be used=• at an "T for deposits, withdrawals, account information,

and other types of transactions, often through interbanknetworks

• at a branch, as identification for in2person transactions

• at merchants, for &0TP' (point of sale! purchases nlike a debit card, in2store purchases or refunds with an

"T card can generally be made in person only, as theyre)uire authentication through a personal identification numberor PI. In other words, "T cards cannot be used at merchantsthat only accept credit cards.

>owever, other types of transactions through telephone oronline banking may be performed with an "T card without in2person authentication. This includes account balance in)uiries,electronic bill payments or in some cases, online purchases.

In some countries, the two functions of "T cards and debitcards are combined into a single card called a debit card or



also commonly called a bank card. These are able to performbanking tasks at "T$s and also make point2of2saletransactions, both functions using a PI.

&urope$s aestro is e4amples of networks that link bankaccounts with point2of2sale e)uipment. agnetic stripe cloningcan be detected by the implementation of magnetic card reader heads and firmware that can read a signature embedded in allmagnetic stripes during the card production process.

This signature known as a 3agnePrint3 orK1lueprints3 canbe used in con<unction with common two factor authenticationschemes utili#ed in "T, debit%retail point2of2sale and prepaidcard applications.

"T Cleaning Cards are the primary means of cleaning "Tmachines to ensure that the machine stays functioningproperly.

AT1 "n automated teller machine ("T! is a computeri#edtelecommunications device that provides the customers of afinancial institution with access to financial transactions inpublic space without the need for a human bank teller on mostmodern "Ts, the customer is identified by inserting plastic

"T card with a magnetic stripe or a plastic smartcard with athat contains a uni)ue card number and some securityinformation, such as an e4piration date or 'ecurity is providedby the customer entering a identification number3 personalidentification number (PI!. sing an "T, customers can access their bank in order tomake withdrawals (or credit card cash advances! and check

their account balances as well as purchasing mobile cell phoneprepaid credit. "Ts are known by various other names includingautomated transaction machine, automated banking machine,money machine, bank machine, cash machine, hole2in2the2wall,cash point etc.



HISTORY OF AT1 CARDS *on Wet#el has been credited with developing the firstmodern "T. The idea came to him in 5BE while waiting in lineat a *allas bank, after which he proposed a pro<ect to developan "T to his employer, *ocutel.88

" ma<or part of the development process involved adding amagnetic stripe to a plastic card and developing standards toencode and encrypt information on the stripe. " working version of the *ocutel "T was sold to ewLorkFs Chemical 1ank, which installed it in 5BEB at its JockvilleCenter (Dong Island, .L.!ffice "lthough the *ocutel "T diduse the modern magnetic stripe access card, the technologyremained primitive compared with todayFs.

The *ocutel "T only dispensed cash and was an offlinemachine. To enable payment processing, the machine printed atransaction record that was ICJ encoded. 1y the early 5B@6s,

"T technology advanced to the system we know today. "Ts were first accessed primarily with credit cards, but in

5B@8, City ational 1ank of Cleveland successfully introduceda card with an "T but not a credit function. 8A"Ts were developed that could take deposits, transfer

money from checking to savings or savings to checking,provide cash advances from a credit card, and take payments.



CH (2)-1ASTER CARDS

CH (2)-STANDARD CHARTERED



CH (34)-ADVANTAGES V5S

DISADVANTAGES



CH (33)-TECHNOOGY

INFRASTRUCTURE



CH (38)-FRAUDS

THE INCREASE OF FRAUDWith the overwhelming success of plastic money, fraud and

abuse have become a worry <ust as the counterfeit and theft of real money have always been. The facts are clear. "s the

number of cards in issue rises, so does the risk of fraud. "smore cards are issued to more people making more purchases,fraud is likely to continue to increase and new types of fraud willemerge.

0igures @ and 56 are showing the 5BBE - fraud profile

and the - bank losses from 5BB? to 5BB@ with losses due to

counterfeit shown separately.

9/r 7

application

card not received

skimming

counterfeit

lost and stolen



0igure 2

1993 1994 1995 1996 1997

0

20

40

60

80

100

120

140

160

total amount

Column1

0igure @ show that lost M stolen cards still represent @67 of the fraud problem. What the figure does not show is thatskimming (cloning of a card without the knowledge of theoriginal owner! and counterfeit are increasing whereas thecategory lost M stolen is remaining at the same level. This isespecially worrying as the Pre2status fraud (fraud that takesplace before the card is reported stolen or lost! is already veryhigh accounting for A:7 of all fraud. " considerable proportionof this A:7 are the si4 hours it takes to actively suspend a cardafter it has been reported stolen. It seems therefore a goodidea to introduce chip cards (they are more difficult toreproduce! the way 0rance did to fight the growing problem of counterfeit. 0rance had a similar situation at the beginning of the B6Fs with an all time high fraud rate of 6.5 percent of totalturnover and a total amount lost the fraud rate and the fraudamount dropped considerably to 6.6@B7 and 9@8mrespectively.



With reference to the acceptance of the program bycardholders and retailers, two surveys completed in *ecember 5BB5 and 5BB? pointed out a )uite good acceptance of thenewly introduced PI check procedure by both and a level of technical incidents on the chip cards comparable to the level onmagnetic cards. owadays the fraud rate is still falling whereasthe fraud amount is again rising due to the increasing volumesof plastic money transactions.

'ales director 'teve Callagham of Card Clear Plc, a

company that has speciali#ed itself in card fraud detection and

prevention, holds against that merchants in the - werereluctant to adopt a change towards chip cards and that they

were in general not worried about security issues. The - is at

the moment one of the only countries in &urope that has not

introduced smart cards in the banking and financial sector.

ther sectors on the other hand have adopted the standard

already years ago e.g. telephone cards.

CH (3:)-CASE STUDY



SCENARIO OF PASTIC 1ONEY IN

PA;ISTAN Plastic oney business is definitely going big time here in

Pakistan. In a country where two years back people havehardly heard the word plastic money or credit card, more than@666 merchants are accepting above 5A6,666 cards. It has been estimated that there are likely to be around halfmillion potential card users in the near future. This forecastingderives credibility from the fact that more and more local andinternational financial institutions are e4hibiting enthusiasm inthis direction.

This in turn reflects prospects in Pakistan market inaccommodating numerous credit card competitors operating onthe circuit, ensuring healthy and competitive card businessdeals.arket 'cenario "lthough credit card was introduced in Pakistan decadesago when >abib 1ank, the largest bank in Pakistan, launchedits gold card, but people had hardly know about this card

because of its very limited issuance. "ppro4imately four yearsback, "llied 1ank of Pakistan had launched its aster Card.Two years back Citibank had launched its /I'" Card and

that was the turning point in the history of Plastic oney inPakistan.

Citibank had done a tremendous <ob to educate people ofPakistan, as well as, financial industry about credit cards andits significance in today$s world. 1ecause of very aggressivemarketing and heavy investment in technology, Citibank is welldeserved to be called the industry leader of Pakistan$s creditcard business. "fter successful launch of Citibank card, uslimCommercial 1ank, 1ank of "merica, and ational 1ank ofPakistan had launched their credit cards.

/ery soon we are e4pecting more local and internationalbanks on the hori#on of Pakistan$s credit card business.NIn alphabetical order• Citibank is the industry leader in credit card business here.

In short span of time, Citibank had issued over 58:,666



/I'" cards and covers most of the potential marketsegment.

• uslim Commercial 1ank had launched its aster Cardand it is e4pected that by the end of 5BB@, C1card userswill be over 8:6,666 (that makes :7 of its total accountholders!.

• *iners Club and "&O are very selective in credit cardsbusiness and so far entertain a very limited marketsegment.

• 1ank of "merica is the transaction processing hub formost of the local banks, including uslim Commercial

1ank, "llied 1ank and ational 1ank of Pakistan. 'omedepartmental stores have also issued their own brandedcards+ however, these stores are operating in a veryrestrictive domain.

CH (3<)-1ETHODS TO

PREVENT THE INCREASING

ABUSE OF PASTIC CARDS



In order to discourage fraud and to decrease the lossessuffered due to fraud, the industry has adopted certainstandards that can be categori#ed. The following section of thereport will critically evaluate the following methods of fraudprevention= magnetic stripes, micro chip cards, biometricmethods, encryption and finally the verification with the help of hot card files.

1AGNETIC STRIPES " magnetic stripe is the most common method to store data

on a card. Its advantages are the low price and the simplicity

of customi#ation. n the other hand it is an ageingtechnology that has been stretched far beyond its originalcapacities. The ma<or problem about this method is that itoffers no security on the card itself because the card has nointelligence.

This indicates that the PI the user enters has to be verified

by the machine that reads the card since the card itself cannot compare the PI it has on the magnetic stripe with

the PI the user enters. This again is the reason why cardswith magnetic stripes tend to need an on2line verificationwhich is slower and more e4pensive than an off2lineverification.

The ne4t problem is the simplicity of the manipulation of datastored on the stripe. 'ince most cards in use have DCstripes they are easy to read and copy. >ardware to readmagnetic cards is widely available and any PC is therefore

relatively easy to convert into a universal magnetic cardreading and writing terminal. Complete card readers arealready available for 8:.

'o what about the PIQ The PI as such is not on the card

itself for reasons of security. 'o how does the card readingmachine know the PI that corresponds to the card it readsQ

The machine reads the data on the stripe and calculates the



PI with the help of a EA21it *&' (*ata encryptionstandard!.

The result is the four digits PI. The *&' is a highly

sophisticated encryption method and the key to its EA21itversion has to date not officially been figured out. 1ut therehave been repeated unconfirmed rumors about peoplehaving found the key.

The basis of this principle is that every magnetic stripe has auni)ue magnetic micro pattern comparable to a magneticfinger print.

1ICROCHIPSG The main advantage of a chip card is the fact that it is smart

as opposed to a magnetic stripe card.G Its microprocessor allows it to communicate with the outside

world. This is the basis for an off2line verification being faster

and cheaper than an on2line verification.G When the user enters his PI it will be tested against the PI

stored in the &&PJ.

G Therefore, only a simple system is needed to verify theaccordance of the entered PI with the PI on the card.

G The chip does the hard work of encrypting and decrypting

the data. 1ut this vital advantage is only applicable to the

verification process.G In the whole verification process data is never easily

accessible and manipulative as opposed to magnetic cards.

The security is therefore already in the card and not only in

the machine as.G The scarcity and high price of components, complete cards

and e)uipment certainly help to prevent fraud as well.G "nother strength of chips is its small si#e which makes it very

difficult to reproduce it or even to find weak points in it.G The chip industry has on top of that found many ways to

construct a chip to make it very difficult for attackers to crack

the chip. 1ut all that has not made the chip fraud proof.



ENCRYPTIONG riginally encryption has served to protect data from being

read by a third party which refers to a passive attack.>owever this situation has changed and data has nowadaysto be protected against active attacks as well.

G &ncryption can be subdivided into two main categories= thesymmetric algorithms and the asymmetric algorithms. Theoldest and the best known encryption method is thesymmetric one.

G 'ymmetric means that he sender and the receiver use thesame key to encrypt and decrypt the data transmission. Theadvantage of symmetric data encryption is the wideavailability of good algorithms and its speed. The ma<or disadvantage of it is the high effort needed for theadministration of the keys since the number of different keysre)uired for a growing number of network participantsincreases e4ponential after the formula= keys re)uired Rnumber of participantsN((number of participants 25!%8!!.

G " network consisting of 5,666 participants who all encrypttheir data and all want to make sure that only the receiver can decrypt the message re)uires therefore already nearlyhalf a million different keys.

G The earlier mentioned *&' is an e4ample for a symmetricalgorithm. "nother practical application of symmetricalgorithms is the "C (essage "uthentication Code!.

G In this case the message is once sent in its encrypted andonce in its readable form. The receiver then decrypts themessage and checks if the two messages match. If they do,

the receiver can be sure that the message has not beenaltered.

G If asymmetric algorithms are used every participant has oneprivate key and one public key.

G If " wants to send an encrypted message to 1, " has toencrypt the message with 1Fs public key. nce the messagehas arrived at 1 he decrypts it with his private key. f course,it is not possible to know 1Fs private key by knowing 1Fs

public key which makes the encryption asymmetric. This



avoids the need to keep the encrypting key secret since it isuseless to decrypt.

G 0urthermore are only two keys per participant needed,meaning that for a network consisting of 5,666 participantsonly 8,666 keys are re)uiredQ The disadvantage of thismethod is its time re)uirement and the lack of commerciallyavailable algorithms.

G " typical application of the asymmetric encryption is theelectronic signature. ne can think of it as an asymmetric"C. Whereas a transmission can only be checked for itsauthenticity with a "C, an electronic signature makes itimpossible for the receiver to fake it and the origin of the data

transmission is therefore detectable.G "pplying symmetric and asymmetric encryption methods to

the problems discussed in part &? of the report helps toeliminate a large part of all fraud of data.

BIO1ETRIC 1ETHODSG The days of the PI are now surely numbered. What was a

convenient+ easy to implement method of controlling access

has now reached the stage where it is also easy to defraud.G 1iometrics, where an individualFs identity is verified by a

uni)ue physical or behavioral characteristic, looks set tobecome imminent successor to the PI.

G 1y 5BBB the world market for biometrics for <ust physicalaccess control applications is estimated to be worth '9 566million.

G "s the movement of people around the world becomes

)uicker and easier, these travelers will e4pect to be able toaccess services from their home country, such as banking,with as much ease as they do whilst at home.

G The PI is the least secure of three levels of security. It isSsomething that you knowK+ although in many cases it issomething you have forgotten or written down to remember.

G The second stage is something that you have (e.g. a plasticcard! which is possibly linked to something that you know.

The third and ultimate tier is to use something which you are2



biometrics2 which can be linked to either something whichyou have, something you know or even both.

G The problem with the PI is that it is difficult to remember,especially if more than one needs to be remembered andthey are chosen for the user.

G Parado4ically, if the user chooses their own PI, they arevery likely to choose something easy to guess such as thepartnerFs birthday. When a password or PI is chosen for theuser, the problem of having to remember it is sometimesovercome by writing it down.

G This, of course, defeats the point of having something whichis something one person and only that person knows. ne in

three people write down their PI for their bank card,according to a - poll conducted by JI.

G "nother source estimates that nearly one in five people havebeen unable to get money out of an "T at some pointbecause they have been unable to remember their PI. Thisand other behavior patterns will be looked at in more detail inpart 0 of the report. 1iometrics, too, have one significantdrawback, however.

G nlike in the case of a PI or card, a computer cannot givean absolute yes or no answer to whether the user is the onehe pretends to be.

G " PI is either 58?A or not and the same is true with cardserial numbers etc. " dynamic signature, a voice, a face andmany other biometric characteristics, will vary every timethey are checked.

G In most cases it will not vary much but some leeway must be

build in to allow the authori#ed user to produce a BB7accurate signature and still be verified. " biometric system,therefore, cannot say with 5667 accuracy that the person in)uestion is the right one.

G To combat this, biometric systems are designed to allow for acertain variance. The si#e of the variance depends on thepurpose of the installation. In a financial installation it mightbe sufficient to re)uire only B:7 accuracy so that valued



customers would not be falsely re<ected but so that potentialcriminals would also be deterred.

G In a military establishment, an accuracy of BB.BBBB7 may beneeded to ensure that there is no possibility of an imposter being given access. This would, however, mean thatauthori#ed users may often be re<ected by the system.

G 1efore a person can be verified by a biometric verificationdevice, they must first be enrolled. This is the process duringwhich a new user must produce one or more samples of thecharacteristics to be used.

G These readings will then be compared and sorted to give oneaverage reading or all the readings will be kept to indicate in

what manner the userFs characteristics can vary. Thistemplate is then stored in memory either in the individualverification terminal, on a plastic card or in a host system.

G *ifferent biometric types are better at ensuring a low rate of re<ection of authori#ed users than are others. This alsomeans, however, that they are not so good at re<ectingunauthori#ed users. " trade off of one re)uirement againstthe other must be made.

G The inaccuracy of a biometric system in re<ecting authori#edusers is known as a Type 5 error and the correspondinginverse error is known as a Type 8 error. Whilst somesystems come very close to #ero on one of these, the other is usually correspondingly high.

G ther systems have a medium score on both. "nother important factor is the memory si#e of the template.

G ne biometric system re)uires only nine bytes of data which

could be easily stored on a magnetic stripe card.G thers re)uire the data storage capabilities of a smart card

or a host computer.G There are at the moment si4 different types of biometric

systems commercially available. 0ingerprint, hand geometry,retinal eye pattern, facial recognition+ voice comparison anddynamic signature verification are now available from a widerange of suppliers.



G The following are descriptions concerning the way the

devices work their reliability and their price range5:.

FINGERPRINT VERIFICATION 0ingerprint verification systems are heavily associated withlaw enforcement. n the side this is good, because it provesto the public that these systems work, but on the other side,the introduction of fingerprint verification may put somepeople off using it.

The way fingerprint systems operate is by identifying the

location of small marks, known as minutiae, which are found

in the fingerprint. The readability of the fingerprint depends on a variety of work and environmental factors. These include age, gender,occupation and race. " young, female, "sian mineworker isseen as the most difficult sub<ect. " system that works on thebasis of ultra2sound can overcome these limitations.

The system is user friendly and easy to use since the entire

user needs to do is to place his finger on a platen,

sometimes positioned correctly by finger guides. Thema<ority of fingerprint systems incorporate Slive and wellKdetectors to ensure that the finger being scanned isconnected to a live person.

Performance figures for one of the longest established

fingerprint verification devices are )uoted as having a falseacceptance rate of 6.6665 7 and a false re<ection rate of less than 57. Template si#e re)uirements differ between

each supplierF system, ranging from 8A bytes and upwards of 5,666 bytes. The costs for a single fingerprint verification unitrange from '9EB: to '9?,666.

HAND-BASED VERIFICATIONG >and geometry systems have the advantage of a very small

template= one system only re)uires nine bytes.



G Whilst many characteristics of the hand could be chosen for biometric verification, only two have so far beencommerciali#ed.

G ne approach uses the geometry of the hand whereas theother uses the geometry of two fingers.

G These systems are relatively easy to use with someincorporating guide posts to ensure that the hand is placedcorrectly. >and geometry has had no ma<or problems beingaccepted in most societies e4cept for apan.

G The geometry systems are not affected by environmentalfactors such as dirt and grease although large rings need tobe removed if not worn at the enrolment stage. 'ome

systems will allow the user to use either hand, while othersare easier with one hand but the other can be used on handgeometry systems if necessary.

G It is possible for the other hand to be placed upside insteadbecause the geometry of each hand is a mirror image of theother hand.

G >and and finger geometry systems tend to be seen as goodall rounderFs with one hand geometry system having a false

acceptance rate of under 6.57.G The cost for a single hand geometry unit is '98566 whilst

the components for a finger geometry system are '9B66.

THE EYEG f all biometrics commercially available, retinal scanning has

the lowest false acceptance rate at an effective 67. Jetinalscanning operates by taking a circular image of the back of

the eye using a very low intensity infrared camera.G sing a retinal scanning device re)uires some practice and

the use of an infrared beam have caused some publicacceptability worries in the past.

G Iris scanning systems have also very good performanceresults. 1ecause of its close links to the brain, the eye is oneof the first parts of the body to decay after death, making thesuccessful use of a dead or false eye unlikely.

G The templates for both eye scanning verifications arecomparatively small.



G The retinal scan template re)uires about a 566 bytes and theiris scan about 8:6 bytes. The systems cost around'9?,666 and '9E,666 respectively.

FACIA RECOGNITIONG People are already used to being recogni#ed by their face,

since this is the usual way of recogni#ing a person. Thisindicates high user friendliness. 'ystems currently availablere)uire the user to be standing straight on to the camera as if posing for a photo.

G *istance from the camera, background, facial e4pression,lighting, changes to hair styles and spectacles all effect some

systems. ltimately, facial recognition systems will be able toidentify a person as they walk naturally towards a door.

G "n error rate of 8.:7is being )uoted by one supplier for itsmug2shot type system.

G The si#e of the template stored by facial a recognitionsystem differs with each supplier but is relatively big. Itranges from five hundred bytes to 8,666 bytes. The cost for afacial recognition system is ranges from '98,666 upwards.

VOICE VERIFICATIONG /oice verification has the advantage that it is not intrusive

and that people are used to using the e)uipment re)uired.Two types of voice verification systems are available. "ccesscan be controlled using a standard telephone linked to avoice verifier on a host computer. 'tand2alone units are alsoavailable which perform verification internally.

G The verification performance can be affected by backgroundnoise. This can occur when the user is situated in a busylocation and also from electrical noise on the telephonenetwork. /oice verification systems analy#e thecharacteristics which produce speech and not its sound or pronunciation.

G This makes it safe from mimics but not from high )ualitydigital tape recordings. To overcome this, words or numbers

chosen at random can be spoken.



G ne telephone2based technology provider )uotes error ratesof 57 for its system. " stand alone provider is )uoting a falseacceptance rate of 6.B7 after the first attempt and a falsere<ection rate of A.?7 after three attempts.

G The templates si#es for voice verification systems variesbetween the different suppliers since some <ust re)uire theuser to say one word whilst others need whole sentences.The templates are usually upwards of 5,666 bytes.

G The cost of systems ranges between '95,666 and over '956,666.

DYNA1IC SIGNATURE VERIFICATIONG 'ignature verification has the advantage that people around

the world are used to verifying their identity in this matter.'ignature verification devices record the way in which asignature is written rather than its appearance.

G This is measured by a special pen, a sensitive tablet uponwhich the signature is written with an ordinary pen or with atablet and stylus purchased as a standard computer peripheral.

G nfortunately some systems are unable to cope with peoplewhose signature changes radically each time it is written.

G *ynamic signature verification devices are easy to useacceptable to the public and difficult to circumvent.

G ne product tested by 'andia ational Daboratories wasfound to have a false acceptance and false re<ection rate,after two attempts of 6:7 and 8.57 respectively.

G The template si#e is )uite small at around fifty bytes but to

reproduce the signature image, more information needs tobe stored.

G The cost of a single signature verification unit ranges from

'9?86 on upwards.



CH (3=)-TYPICA FRAUD

PATTERN

There are a number of typical fraud methods and

corresponding countermeasures used to prevent fraud from

happening.

G Taping of a line. The attacker has therefore accessed the

connection between chip card and terminal or chip card and

system. >e can read all data that goes through that line but

he cannot change or intercept the data. This is called a

passive attacker. The corresponding countermeasure is the

encryption of the data flow. The attacker can than still read

the data but it has been rendered useless for him.G Change of data during its transmission. In this case the

attacker is active. >e can change, manipulate, add or cut

pieces out of the data flow. &ncrypting the data makes it

more difficult for the attacker to recogni#e the relevant parts



to manipulate. 0urthermore there is a so called "C

(essage authentication code! that enables the receiver to

recogni#e changes in the message.

G nauthori#ed access on data in the chip during theproduction and%or customi#ation process. The attacker want

to access and manipulate now or later data on the chip. This

again is an active attack. To protect the chip form internal

attacks during its production and customi#ation, key

hierarchies are used and security concepts based on it.G anipulation of the dialogue partner. The attacker pretends

to be the dialogue partner. The best way to avoid that is to

use a dynamic authentication in which the user demands

verification of his dialogue partner. This does not work with a

chip card since it does not have the re)uired processing

capacities.

G Jeproduction of smart cards. It is assumed that the attacker already has the relevant data and a chip card to load it on.

This is made impossible by establishing a write protection onthe chip with the help of a producerFs key. 1efore thecustomi#ation the key has to be entered like a PI.

G 'imulation of the card. If the data e4changed was always thesame it would be sufficient to tap the line once and thenreplay the recorded data in order to simulate the card. 1ygiving the security relevant data an accidental character thisbecomes impossible.



CH (3=)-SURVEY



CONCUSION

BIBIOGRAPHY

plastic money part 2

Documents