Slashdot Mirror
French Banks Offer Credit Card Numbers That Change Every Hour (thememo.com)
Slashdot reader schwit1 quotes The Memo:
What if the numbers on your card changed every hour so that, even if a fraudster copied them, they'd quickly be out of date? That's exactly what two French banks are starting to do with their new high-tech ebank cards... The three digits on the back of this card will change, every hour, for three years. And after they change, the previous three digits are essentially worthless, and that's a huge blow for criminals... As most fraud happens a few hours or days after your card details are actually taken, this would leave criminals essentially with a bunch of useless numbers.
It's just like credit cards you have now -- other than the tiny digital screen that's embedded into the back of the card.
It's just like credit cards you have now -- other than the tiny digital screen that's embedded into the back of the card.
Note that it's a French bank. In Europe (at least the UK where I live and the other parts of Europe that I've travelled to), we use chip cards, which means that that is already a solved problem here; cloning the magnetic strip doesn't get you the PIN number, and you can't do anything without that. So you don't need any fancy changing card number to solve that problem, you north-Americans just need to get with the program. As long as you can make transactions with just something as easily cloneable as the magnetic strip, you're going to have that problem.
Oh no... it's the future.
the changing numbers solve a different problem
using them online when no chip and pin transaction is possible
Regarding this number changing method, how are the new number generated? How does the bank know that numbers are valid ?
I presume it works just like a SecurID or other access control dongle. Your card is seeded with a value known to the bank. The card plugs that seed and the current time into an algorithm that generates the number. When you go to make a purchase, the bank runs the same calculation and looks to see if the numbers match.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
Will this break regularly scheduled withdrawals for automated billing?
No. First, in Europe, these are _not_ done via credit-card, but via interbank-transfer. Not everybody is stuck in the banking dark-ages like the US. Second, for credit-card based schemes, you authenticate once and then the bank knows these are legit and it works without further authentication.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Also, chip+pin does nothing to help with online sales, or any sales where they simply choose not to use a chip+pin transaction. Someone can copy down your card number and expiration date and make transactions.
If you RTFS* you'd see that the card number isn't what changes, it's the CVV2 code on the back of the card. For a long time you've needed these three digits for any "customer not present" transactions (phone or online orders), so just writing down the card number isn't nearly as big a risk as it was in the past.
What this new card does makes it very difficult to do are CNP transactions without having the card physically present; scammers could copy the details but they'd only be good for an hour at most, and most merchants would be wary of dispatching goods to somewhere other than the billing address at least for the first time they're provided with that card's details.
*Easily forgiven when the headline gets it wrong too.
If God forks the Universe every time you roll a die, he'd better have a damned good memory.
What's up with this "freedom" propaganda in the US?
In most of the freedom indices, the US is unremarkable compared to other western countries. It is not bad, but among these countries, only the US seem to brag about it so much. I suppose it is some kind of political strategy to justify anything.