ARI SHAPIRO, HOST:
All those years you spent perfecting that flick of the wrist swiping your credit card at the cash register, well, that era is almost over. Millions of Americans have recently gotten new credit or debit cards with a chip on the front. So instead of swiping, you'll insert the card chip-first into the card reader. By this Thursday, stores are supposed have the equipment in place to handle the new cards. Otherwise, they could be liable for fraudulent transactions. We wanted to catch up with Brian Krebs before this deadline. He's author of the blog Krebs on Security.
BRIAN KREBS: The chip is a long-overdue piece of technology that most of the rest of the world has already adopted. But it's basically designed to keep fraudsters from easily and cheaply being able to counterfeit your card in the event that they're somehow able to steal that information.
SHAPIRO: Now, these chip cards are often called chip-and-PIN cards because they come with a PIN code just like an ATM card has a PIN code.
SHAPIRO: Should retailers be asking you to punch in that four-digit PIN every time you use a chip card?
KREBS: Well, it depends on who you ask. The main benefit of having a PIN code is that it protects against lost and stolen fraud. But according to the banks, this is the smallest portion of all the types of different card fraud. It's not really worth it, the aggravation for them, but more importantly to consumers who, you know, have a tendency to forget their PIN or they have to reset it and all these kinds of things. Their perspective - it doesn't really add that much more security.
SHAPIRO: Interesting. So you're saying that if I drop my credit card on the sidewalk, the PIN code would prevent somebody picking up the card from using it. But that kind of fraud is actually much more rare than someone just hacking into a computer system and stealing all of the info. And the PIN won't help with that.
SHAPIRO: You know, I just moved to the U.S. a couple of weeks ago from London, and I'm not sure that Americans appreciate what a huge difference there is in the way people use their credit cards in Europe compared to the way people use their credit cards in the U.S. In Europe, it is just standard. You stick your chip card in the machine. You punch in four digits, and you never sign a thing. If you try to swipe your card, people look at you like you're living in the 19th century.
KREBS: (Laughter). Yeah, you know, it's interesting. I mean, if you talk to the card associations with Visa and MasterCard, they'll tell you privately that, look; none of the banks want to be the hardest card to use in the wallet, right? So the average consumer has two or three credit cards in their wallet, and one of them always requires them to put their PIN in. Well, they just won't use that. And so the banks have just kind of fallen back and said, by and large, we're going to continue to allow people to use these chip cards without actually entering a PIN.
SHAPIRO: Is this shift clearly an improvement?
KREBS: It is an improvement. Although, you know, it's not something that's going to fix the situation overnight. I mean, if you listen to Visa and MasterCard and you listen to the proponents of chip card technology, you might think that all of this fraud is going to evaporate overnight. It's not.
When you make it harder for fraudsters to commit a certain type of crime, they don't just go away, you know? They go somewhere else. In every country that's moved to chip cards, what we've seen is an explosion in what they call card-not-present fraud. It's basically e-commerce fraud.
SHAPIRO: Online retailers instead of big box stores - yeah?
KREBS: That's correct. And I think we're also going to see an increase in account takeovers and new account fraud, where people use your personal information to open new accounts in your name. And that's a form of identity theft that's quite a bit more costly for consumers.
SHAPIRO: Brian Krebs is an investigative journalist and author of the blog krebsonsecurity.com. Thanks a lot for joining us.
KREBS: Thanks, Ari.
NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.