School Request: What can be done protect people's financial information?

Question

This is a bit of an odd question, and if it doesn't belong on this forum feel free to retract. I was asked by a group of 7th graders to share my thoughts on the problem of credit card data breaches. Honestly I don't think I'm qualified to respond, but would like to encourage their thinking about the problem. They are assuming technology that will be readily available in 20 years, ish. Here is the question in full:

We are writing to you because we have some questions on the topic Data Breaches. We know that Data Breaches can happen at anytime of the day or night, but we have some questions on what people can do to help stop data breaches. Having your data stolen can be a devastating event and can end up with a lot of your hard earned money stolen. Our solution to combat this is to update out current ways of credit card information. Instead of having a set in stone 16 digit number with an expiration date and a CCV, instead it’s just going to be one simple 8-12 string of letters and numbers that cycles either everyday or very frequently to prevent your information being compromised. This information will be stored in your credit card and online so you can make online transactions. This makes buying online and in real life a lot more easier and safer. Now, we don’t know how this cycling system can be implemented and can stay secure without any bugs or mishaps that could leave the system vulnerable. We would also have to completely change our systems and payment methods so that they could adapt to this new system of payment. We sincerely thank you for your time in assisting our idea for a future technology.

Thanks in advance; I appreciate the community's thoughts!

EDIT - thanks for your help! Here's my response; hopefully I haven't introduced too many inaccuracies :)

Congratulations - you've asked the $100 billion dollar question! :)

Obviously credit card theft is a very serious problem. Fortunately, the consequences for consumers aren't necessarily as dire as you might think. Credit cards are convenience tools that allow people to borrow money, as such when a stolen card is used it's the lender that is on the hook, and cc companies generally do not charge customers for fraudulent transactions. Since they are liable for payments CC companies are on the lookout for fraud; they detect it by analyzing their customers' spending habits and looking for unusual activity (buying things they don't usually buy, spending money in foreign countries, etc) and they will either proactively reject the transaction or flag it and alert customers if they detect such activity. CC companies also respond to customers who report stolen cards and do not usually charge for transactions customers report as being illicit.

Debit cards are a different matter. They are linked directly to consumers' bank accounts and it may be harder to convince a bank to reimburse customers for charges made on a stolen debit card. Think twice about using or even owning them.

Whether you use a credit or debit card, it is a good idea to pay attention to your billing statements and reporting any charges you don't recognize so you can report it quickly. Some other general advice that can reduce exposure:

• Use credit, not debit (e.g. your bank account), as you have less recourse for stolen money otherwise.
• Be extremely careful with who you give your number to online.
  • If you were directed there from an email, make absolutely certain the site is who they claim to be (it could have been a phishing email).
  • Only provide it to reputable processors and make sure the connection is done over TLS (encrypted internet connections; browsers usually have a shield or a lock in the address bar).
• Only use cards without a magnetic stripe to protect from "skimmers" which are placed around legitimate card readers and read information on the card from the stripe.
  • If the card only has a chip, then it's much more difficult to intercept sensitive data.
• Don't give out your CC number to anyone on the phone if they called you. Call the company back at the number found on their official website (again, you're verifying who you're interacting with; caller Id's can be spoofed).
• Make sure you shred sensitive paperwork (bills and statements) before throwing it away.
• Keep your browser and operating system up to date to avoid malware.

One last option is to use virtual credit cards, and your solution actually bears a lot in common with them. Some credit card vendors will allow you to generate virtual card numbers. Being more ephemeral, they're less valuable to attackers and lower the risk of unauthorized charges. The major drawback of virtual credit cards is that the rotation scheme is not automatic; it's up to users to cycle their credit card numbers, and update them in all places they're being used. Automating the scheme might be done using something similar to a Two Factor Authenticator (2FA). 2FA is a system where synchronized time and paired pseudo-random seeds into an algorithm running on a computer, phone, or it's own little device (often referred to as a FOB) is compared to its twin at the security service. This technology is commonly used in many corporate VPN networks, and it is conceivable that this technology could be incorporated into credit cards. One problem with this approach is that the chips in credit cards are extremely low-power and do not have the ability to keep track of time, so they would need to trust the untrusted and potentially malicious chip reader that could lie to them about the current time to retrieve future numbers. Perhaps this problem will be solved as battery miniaturization progresses. A more challenging problem with this approach is that you generally only implement it on a one-to-one basis; you don't want the same authenticator sequence for multiple accounts - it would be like sharing passwords! So we would need to work through this challenge.

Thanks so much for your question. It's good to see you thinking about this problem. The landscape is constantly evolving and I'm encouraged to see young people taking an interest and proactively thinking of solutions!

Regarding point allocation I've upvoted all your answers as they were all extremely helpful. I accepted Forest's because I drew most of my response from it. Thanks again for the assistence!

Answer 1

The best ways to protect from CC theft primarily involve changing your habits. Using a card without a magnetic stripe protects from "skimmers" which are placed around legitimate card readers and read information on the card from the stripe. If the card only has a chip, then it's much more difficult to intercept sensitive data. The technology is already there. We don't need to wait 20 years.

Additionally, being careful with who you give your number to online is particularly important. Don't give it to just any site that claims to be secure, especially if it came from an email (this could be a phishing email). Only provide it to reputable processors and make sure the connection is done over TLS.

Some other general advice that can reduce exposure:

• Make sure you shred sensitive paperwork before throwing it away.

• Keep your browser and operating system up to date to avoid malware.

• Don't give out your CC number to anyone on the phone if they called you.

• Use credit, not debit, as you have less recourse for stolen money otherwise.

---

To critique the specific proposal:

Having your data stolen can be a devastating event and can end up with a lot of your hard earned money stolen.

Usually, the money will be reimbursed by the credit card company. It's not like theft can result in someone's bank account being drained. Usually what happens is the company detects the fraud with heuristic analysis and alerts you, or you contest payments yourself. It's the credit card company that suffers the most direct loss. However, if your debit card is stolen, you can lose a lot more if you don't notice and contest the fraudulent transactions very quickly.

instead it’s just going to be one simple 8-12 string of letters and numbers that cycles either everyday or very frequently to prevent your information being compromised. This information will be stored in your credit card and online so you can make online transactions.

This is more difficult than it seems. The chips in credit cards are extremely low-power and do not have the ability to keep track of time, so they would need to trust the untrusted and potentially malicious chip reader that could lie to them about the current time to retrieve future numbers.

Now, we don’t know how this cycling system can be implemented and can stay secure without any bugs or mishaps that could leave the system vulnerable.

That's the $100 billion dollar question.

Answer 2

Such a cycling system is already in use: Virtual Credit Cards.

Some credit card vendors will allow you to generate virtual card numbers. Being more ephemeral, they're less valuable to attackers and lower the risk of unauthorized charges.

While most virtual credit cards are perks attached to normal credit card, there's one major virtual card supplier that's not: Privacy.com. Using your bank account as the back-end, it allows you to generate cards with spending limits and timing limits, e.g. you can have a virtual card for your Netflix subscription that's limited to $15/month. Or you can have single-use cards. It's very flexible.

One limitation to these schemes is that they're - well, virtual. They can't be applied wherever a physical card is being charged; they're for CNP (Card Not Present) charges like those over the Internet or via phone.

Answer 3

Something like this is already implemented as a time based Two Factor Authenticator where synchronized time and paired pseudo-random seeds into an algorithm running on a computer, phone, or it's own little device often referred to as a FOB is compared to its twin at the security service. Generally for 2FA, you only implement this approach on a one-to-one basis because you don't want the same authenticator sequence for multiple accounts, it would be like sharing passwords.

Credit cards used to be simply a printed number, then they were added to a magnetic stripe for convenience, then a CCV was added as an indicator of physical possession (not a very good one).

Now credit cards incorporate an encryption chip. This is where things get complicated.

Businesses want the use of credit cards to be easy to encourage their use. They recognize that some amount of fraud will take place but choose to accept a certain level as worth the price of convenience.

As fraud levels grew, there was a push to switch to encryption chipped cards. Often referred to as Chip & Pin, but they really are not in the U.S., they are Chip & Signature, where the signature is a pin but they work differently from the true Chip & Pin common throughout Europe.

In the current phase of the switch to chipped cards in the U.S., fraud protection continues with the credit card issuer if the physical encryption chip is used. However if the card's magnetic stripe is used at the point of sale, the business is responsible for any fraud because they failed to upgrade to the more secure encryption chip devices.

Purchases done remotely via phone or internet are grandfathered in and still protected by the credit card company even though it's insecure because the market advantage justifies the fraud cost.

Europe implements the full Chip & Pin as compared to the U.S. If you look at the chip pads, the full version has more contacts. For the most part, the difference is that in the U.S. the pin verification requires an always connected communication back to a service. No internet service, no credit card acceptance. In Europe, standalone kiosks (common at train stations) will validate the pin directly against the credit card chip encryption and will work without an always on internet connection.

So meandering back to the original question, what can be done?

Relatively new services are Virtual Credit Cards and Single Use Cards. With a Virtual Credit Card, you sign on to a service to obtain a special use card and number. You can define custom limits for the virtual card such as, monetary limits, time to exist, number of uses allowed, places it can be used. After the defined limits expire, the virtual card number is no longer valid.