Is card fraud really a barrier to cashlessness?

A while back, my old chum Ed Conway from Sky TV (better known for his excellent foreword to that noted tome Identity is the New Money, of course) ran a nice story about the British cash paradox. It turns out that since the #Brexit vote, the amount of cash “in circulation” has soared (it’s gone up by nearly two billion quid since B-day, as I call it). While the use of cash for transactions has continued to fall, the amount of cash just generally hanging around has continued to rise.

The growth rate of cash in circulation has more than doubled since January, when it was running at 4% a year, with a sudden acceleration in the weeks following the EU poll.

From More People Keeping Cash Outside Banks

Ed asks whether the cash has been hoarded, stashed or exported. I wrote about this following the Bank of England’s analysis of the situation last year, noting that 

The interesting question that the Quarterly Bulletin article by Tom Fish and Roy Whymark stimulates is straightforward: “if the majority of Bank of England notes are not being used for everyday transactions in the domestic economy, what are they being used for?”

From Where is the aggregate demand for cash coming from? | Consult Hyperion

Since the Bank of England’s own estimate is that about a quarter of the cash out there is used for “transactional purposes” and since the size of the black economy can be reasonably estimated, the answer seems to be that they are mainly used for tax evasion (primarily by SMEs), money laundering, drug dealing and corruption (Transparency International reckon that only 0.75% of global dodgy dealings are intercepted by the UK). We see the same phenomenon in America, where the amount of cash out there continues to rise but the use of that cash continues to fall.

The use of cash has fallen more than 50% in the last four years and is projected to continue to fall as consumers look for faster and secure means of paying options. With a high degree of smartphone penetration in the US market, mobile and digital payments are rapidly gaining a market share in digital payments.

From Americans Are Using Less Cash but Mobile Payments Are Not The Ones Replacing It | Let’s Talk Payments

So we can see that in the US, as in the UK and many other countries, the rise of contactless and mobile payments means that the use of cash for retail transactions is falling steadily. (Contactless transactions have now reached £2 billion per month in the UK.) It is interesting, however, that in the US there seems to be much more resistance to cashlessness than in Australia or Denmark. Or the Netherlands…

For example, paying rent or a telephone bill in cash only sparks scolding looks. But obstacles are present even when making smaller purchases such as groceries (where cash-only lines are the longest) or when paying for parking – impossible without a card.

From Consumers are bearing the cost of cash

Cash-only lines are the longest. Are you watching, Waitrose? But I digress. What accounts for the American cash gap? Well, first of all a lot of US dollars are under drug dealers mattresses in South America, not in the US at all, so that distorts the figures for cash “in circulation” but that doesn’t explain everything. In his new book “The Curse of Cash”, former IMF chief economist Kenneth Rogoff says (page 111) that in America “people pay by cash for small transactions to avoid credit card theft”. Is this true? I realise that in America they still use magnetic stripes (which is why America accounts for half of all the card fraud in the world although it is only a fifth of the volume) does that really encourage people to pay with cash? I always use cards in the US — since I don’t care if the card details get stolen as it the banks’ problem and not mine — and I get really annoyed when I go to a coffee shop or something and it doesn’t take cards.

 No Chip

But perhaps our American correspondents could enlighten us on this. Is card fraud really a barrier to cashlessness?

Breaking ATMs

The nice people at Breaking Banks invited me on to their radio show this week to comment on the impressive rise in card counterfeiting in the US, as reported in the Wall Street Journal.

Criminals are stealing card data from U.S. automated teller machines at the highest rate in two decades, preying on ATMs while merchants crack down on fraud at the checkout counter.

[From Theft of Debit-Card Data From ATMs Soars – WSJ]

The figures are astonishing: compromises at bank ATMs up a couple of hundred percent in the first quarter, comprises at non-bank ATMs up more than three hundred percent! What is being stolen is the data from the trivially-counterfeitable magnetic stripe on the back of the card (“skimming”). This data can only be used to make counterfeit magnetic stripes: you can’t use it make clones of the chips on the cards. Hence the data is only useful if you can find somewhere that will let you pay for something using a magnetic stripe copy of the trivially-counterfeitable magnetic stripe. Oh wait, I know somewhere..

Grand Central

Yep. The USA. Skimmed card data from around the world makes it way to America, which is why payment card fraud losses there are so a greater of world losses (double, in fact) than payment card volume is of world payment card volume.

Total global payment-card fraud losses were $11.3 billion in 2012, up nearly 15% from the prior year. The United States—the only country in which counterfeit-card fraud is consistently growing—accounted for 47% of that amount, according to the Nilson Report

[From Skimming off the top | The Economist]

Now, we all know that in the long run the way get round this is to get rid of trivially-counterfeitable magnetic stripes (and the use of card numbers online, but that’s a different story) and use chip and PIN instead (actually, in terms of fraud reduction it’s the PIN that’s doing the heavy lifting, the chip not so much). And, indeed, chips are making their way on to US cards at last, just in time to be rendered obsolete by Apple Pay, Android Pay, PayPal Venmo, Samsung Pay and the like.

However, most ATMs don’t yet accept the [chip] technology, though J.P. Morgan Chase & Co. and Bank of America Corp. have recently begun to install the more advanced machines

[From Theft of Debit-Card Data From ATMs Soars – WSJ]

Actually, this won’t stop the card data from being stolen. All of the ATMs in the UK read chip but you still have to put the card into a slot that can read stripes from the legacy cards carried by American tourists. Since you have to put the card into a slot, the fraudsters can still fit their devilish devices to the machines and read the stripe as you push the card through. Then they steal the PIN by shoulder-surfing or keypad cover plates or hidden cameras or whatever. This has been going on for ever. Here’s what I wrote about it eight years ago.

Fraud on UK cards overseas has increased because the stripes are counterfeited and the PINs are then used to withdraw cash at foreign (non-chip & PIN) ATMs.

[From Card fraud in the UK]

So where do we go? Well, one obvious way would be to simply decline all stripe transactions made using chip and PIN cards, but I have chip and PIN cards that I still use in card swipes when in the US so this might generate too many customer service calls. Another way would be to let me use my mobile app to turn my debit card on and off, and for someone like me who rarely uses a debit card (basically for ATM withdrawals only) this might work. But another idea might be to stop me from having to put my card into a slot.

Spain’s CaixaBank has commissioned Fujitsu to build 8,500 ATMs with contactless capabilities.

[From Spanish bank spends €500m on contactless ATMs]

My debit card has been contactless for years, yet I’ve never seen one of my bank’s ATMs with a contactless interface as CaixaBank has. But my bank has an excellent mobile app too, and surely there must be some way of using this instead of a card when I nip out for a late-night legal high just before the government ban comes into force.

With the new CommBank app and its Cardless Cash feature, you can withdraw cash from over 3,000 ATMs without your card.

[From Cardless Cash with the new CommBank app – CommBank]

Unfortunately my bank doesn’t yet have cardless withdrawals either, but it does have an excellent text message authentication and alert system that deals with the ATM problem, so if my card gets ripped off it’s harder to use and, to be fair, although I’ve used my card in some pretty dodgy-looking ATMs, to the best of my knowledge it’s not been skimmed.

ATM through the fence

Mobile is surely the way forward though, isn’t it? Perhaps my bank could put in some mini-ATMs at branches: no keypad, no screen, just a contactless reader and cash dispenser. I tell my bank app how much I want to withdraw and than tap the phone on the reader and the cash pops out. This way, the bank app can send a token instead of the real card details and the criminals will leave my account alone and move on to easier pickings.

Doing away with card and PIN entry is possible because the mobile phone provides for an effective alternative identification and strong authentication mechanism. There are other strong identification methods that could be used though, like the finger vein readers used in some countries. My favourite suggestion is…

You stand at the ATM but, instead of producing your card and PIN, you unbutton your trousers while a dachshund, trapped in the machine, sniffs around your intimate regions, identifying you by your unique scent.

[From ATM dog: Forgotten your pin? Please join the queue for the dachshund | Technology | The Guardian]

Using the dog’s nose as a biometric system to identify people is actually rather an old idea. In fact I wrote this about it eight years ago.

if I could integrate an odour detector and analyser with the power of a dog’s nose into a chip in my laptop, then my laptop would know who else was in a room with me, because dogs can easily discriminate between different people.

[From Going to the dogs]

I rather keen on smell as a biometric, but whether this particular implementation will overcome the embarrassment of being seen drawing out cash in a public place, I can’t say.


Subscribe to our newsletter

You have successfully subscribed to the newsletter

There was an error while trying to send your request. Please try again.

By accepting the Terms, you consent to Consult Hyperion communicating with you regarding our events, reports and services through our regular newsletter. You can unsubscribe anytime through our newsletters or by emailing us.
Verified by MonsterInsights