Target (TGT) may be in hot seat because of the recent data breach of more than 100 million of its customers, but it has plenty of company when it comes to using outdated technology that weakens security—especially among retailers in the U.S.
Six years ago, a similar type breach happened to 90 million NA customers, and 130 million card numbers were stolen—the largest in history—from Heartland Payment Systems in 2009.
The common denominator among all of the above breaches is the continued use of credit and debit cards with magnetic strips. Europe and 80 other countries worldwide upgraded to 21st-century EMV chip cards years ago.
However, stubborn retailers in the US opt to stick with old school magnetic-stripe technology—do, at least in part, to the costs of switching. But it could cost you and me a lot more.
The benefits of EMV cards
Here are the differences: Magnetic strips allow hackers to extract credit card numbers and expiration dates and make counterfeit cards. EMV cards, on the other hand, make it much more difficult because information is embedded inside a chip.
Plus, unlike the cards we’re using now that use the same unencrypted PIN numbers for each transaction, EMV cards generate a unique security code each time they’re used. So, a hacker can steal it, but won’t be able to use it. Another difference is that you swipe a card with a magnetic strip, but EMV cards enter a terminal, at which point you enter a PIN or sign your name.
At least there is some motivation to adopting the new practice. If retailers don’t employ the EMV technology by October 2015, the responsibility for fraudulent transactions will shift to the least-security party—the stores themselves. In the meantime, hackers have plenty of opportunity to become repeat offenders.
This latest exploitation against Target, however, has a lot of consumers and banks—who often end up footing the bill—riled up. I’d expect for some government agency to come along and light a fire under the retail industry.
The technology is out there, available and needed more than ever. Here are three companies more than willing to help.
Chipmaker NXP Semiconductors (NXPI) makes specialized chips for credit cards. According to analyst Vijay Rakesh, “With around 80% share of contact-less EMV cards worldwide, NXP should be a beneficiary of a potential 2014-15 EMV wave in the U.S.”
NXP also has an 11% share of the Chinese market for semiconductors, according to Financial Times; and a partnership with China Unicom Pay, the only domestic bankcard organization in China operating under approval of the People’s Bank of China, for EMV cards. Smart chips are the basis of the technical standard behind more than 1.24 billion payment cards and 15.4 million POS terminals. Shares of the $11 billion company rose 78% in 2013.
While NXPI makes the actual chips for EMV cards, VeriFone (PAY) designs point-of-sale electronic payment devices, security and encryption software. According to Value Line Research, the company works with 70% of the top 1,000 retailers in America and 83% of the top 200.
Verifone reported better-than-expected results for its fiscal fourth quarter, although it represented a 12% decline from a year ago. Its payments as a service unit accounted for 40% of VeriFone’s total revenue in that quarter. It also partnered with American Express (AXP) to launch a new service earlier this year that allows New York City taxi passengers to pay cab fares using their mobile devices, which process more than 200,000 payments in NYC alone. Although the stock was beaten down earlier in the year, it finished 2013 up 54%.
Infineon Technologies AG (IFNNY) is a Germany-based company developing semiconductors and system solutions for automotive and industrial electronics and chip cards, as well as security applications. The company supplies security chips for the world’s first electronic passports, using the Supplemental Access Control (SAC) protocol, an enhancement against unauthorized access and possible abuse of personal data. The passports, issued by the Republic of Kosovo, contain Infineon security chips.
Electronic passports will become mandatory within the EU as of December 2014. As the first European country to comply with the new requirement, the Republic of Kosovo will issue 800,000 electronic passports. According to current estimates from market research firm IHS, roughly 192 million electronic passports are in circulation in Europe. The $11 billion company is currently trading around $11 per share and gained 28% in 2013.