Slashdot Mirror
French Banks Offer Credit Card Numbers That Change Every Hour (thememo.com)
Slashdot reader schwit1 quotes The Memo:
What if the numbers on your card changed every hour so that, even if a fraudster copied them, they'd quickly be out of date? That's exactly what two French banks are starting to do with their new high-tech ebank cards... The three digits on the back of this card will change, every hour, for three years. And after they change, the previous three digits are essentially worthless, and that's a huge blow for criminals... As most fraud happens a few hours or days after your card details are actually taken, this would leave criminals essentially with a bunch of useless numbers.
It's just like credit cards you have now -- other than the tiny digital screen that's embedded into the back of the card.
It's just like credit cards you have now -- other than the tiny digital screen that's embedded into the back of the card.
This seems like a misguided solution to the problem. If someone steals the card, then this feature won't help.
Bruce Schneier pointed out the real solution years ago. If your card has some processing power and a display (which this solution has), just add a keypad (similar to a calculator in credit-card size).
The keypad is for a pin. The owner keys in the pin, the card generates a one-time-use credit card number, and the waiter/salesman can take the card to the back and swipe it or whatever. When the card is lost, the thieves won't know the pin. If the number is copied, it can't be used beyond the first sale.
You can even use this on a computer peripheral. The software on the card is fixed and can't be hacked.
Multiple accounts can be stored on one card, so you only need one card instead of multiple credit cards in your wallet.
Of course, the thieves can kidnap the owner, but that's not the problem this addresses.
A smart card with pin on the card prevents all kinds of copying, skimming, lost cards, even online accounts.
Since we're switching to smart cards, I don't know why we simply haven't switched to the final solution.
I have no affiliation to privacy.com other than being a user.
I've been using privacy.com to generate randomized credit card numbers for a while now. It's the same type of thing we had in the 90s with certain credit card companies but better. I have static cards with monthly limits for recurring charges, static cards with max per transaction limits for online merchants I frequent and one time use burner cards for just about everything else. I can see all declined transactions per card, which lets me track it down to a merchant. It's the same thing I do for email (per account email addresses for spam tracking) but better because I don't have to manage it myself.
the changing numbers solve a different problem
using them online when no chip and pin transaction is possible