MAG Insights

The magnetic stripe has been around since the sixties – the same decade I was born as well as the birth of the cassette tape. Is it time for this major underperformer to retire?

Not me! I am talking about the retirement of the magnetic (mag) stripe. Although I won’t comment on my relevance in today’s environment, we all know how things turned out for the audio cassette.

Similarly, the relevance of mag stripe is dwindling. We know the mag stripe does have purpose today; however, that purpose has become less and less relevant in light of the evolution of payment security and the migration of consumer behavior over the course of time. In fact, the mag stripe has been a major problem for an unnecessarily significant number of years causing an absurd amount of fraud exposure to the industry.  

Isn’t it time to start discussions among a collaborative group of stakeholders in the industry regarding a roadmap for the retirement of mag stripe?  

Evolution of In-Person Payment Security 

Over the last several years, card issuers have spent hundreds of millions of dollars to distribute new chip enabled debit and credit cards to accountholders, while large retailers have spent billions of dollars to install new card readers capable of reading these chips. The EMV chip protects against one kind of fraud, in-person counterfeit fraud, and it is not the end all solution. EMV chip doesn’t solve for lost and stolen fraud, and it currently has no impact on reducing fraud for online transactions.

Banks and networks issued chip cards with a mag stripe included to ensure interoperability and acceptance of card payments across the globe because not all markets have fully deployed EMV chip at the point of sale. The mag stripe is a flawed feature that has enabled higher levels of fraud. The problem is that the data on the mag stripe is static, making it easier for fraudsters to lift information and clone it onto a new counterfeit card. Skimmers, which are accessible to anyone with a few bucks, can do this easily. Alternatively, a chip card produces a dynamic code each time it is used which helps the issuer validate that the card is authentic, and the chip is difficult to replicate.  However, skimmers can still copy data from the mag stripe available on the card to produce counterfeit cards used at non chip-enabled terminals and online.

Another flaw in the mag stripe is that its data is passed in the clear when used for payment at a point of sale. While that data can be protected through encryption technology, that comes at an incremental cost. Also, without some level of layered incremental security such as tokenization and encryption of the payment account number (PAN) there is still some incremental risk of unauthorized access to this sensitive data.   

Evolution of Consumer Purchase Behaviors

Consumers’ purchasing behaviors show a trend towards more online shopping or remote mobile application-based purchasing which do not take place in-stores or on-premise at retailer locations.

Note: Growth is calculated over the comparable prior-year period. Refer to Operational Performance Data footnote for further information on these metrics. 
Source: Visa Fiscal Second Quarter 2020 Financial Results April 30, 2020
As consumer behaviors shift to remote commerce including m-commerce and e-commerce transactions versus in-store, along with the implementation of chip at the point of sale, the migration of fraud has followed suit.  Chip will not solve for e-commerce fraud, and e-commerce is where many merchants are seeing exponential growth.

We also know in this environment of COVID-19 the behavior of consumers has incrementally shifted to payments that don’t require physical interaction of any kind – the touchless experience. This might include contactless (tap & go), PINless, and not requiring signature at the physical point of sale in-store. The transactions also involve innovative experiences such as remote purchases that don’t require payment interaction beyond a consumer’s personal device where goods are delivered to the buyer’s home or made available for curbside pickup.

The mag stripe is a technology that still requires a consumer to touch a physical card and interact physically with a point of sale terminal resulting in unnecessary exposure to the customer.

What’s Next?

Merchants shouldered the vast majority of the costs to move to EMV while the vast majority of the gains were credited to issuers who were able to reduce counterfeit fraud.  As fraud migrates to the “not present” channel, merchants continue to bear an increased level of fraud losses overall since liability losses for fraud within this channel still remain with the merchant due to current network rules.

While the focus of the payments industry must be on securing the remote commerce environment and addressing a more equitable balance of risk among all parties, as long as the magnetic stripe remains on the card, there is still tremendous potential for U.S. card fraud losses to remain the highest in the world. We urge the industry to start the discussion now for future timing on mag stripe retirement and what gaps must be solved for in advance of that future date (ie. Fallback, etc.).

While we are at it, we should also remove the signature panels on all payment cards and rely on more sophisticated means of confirming the authenticity of the cardholder. I would think the payment industry is now more sophisticated than audio cassette tape technology.