This is a bit of an odd question, and if it doesn't belong on this forum feel free to retract. I was asked by a group of 7th graders to share my thoughts on the problem of credit card data breaches. Honestly I don't think I'm qualified to respond, but would like to encourage their thinking about the problem. They are assuming technology that will be readily available in 20 years, ish. Here is the question in full:
We are writing to you because we have some questions on the topic Data Breaches. We know that Data Breaches can happen at anytime of the day or night, but we have some questions on what people can do to help stop data breaches. Having your data stolen can be a devastating event and can end up with a lot of your hard earned money stolen. Our solution to combat this is to update out current ways of credit card information. Instead of having a set in stone 16 digit number with an expiration date and a CCV, instead it’s just going to be one simple 8-12 string of letters and numbers that cycles either everyday or very frequently to prevent your information being compromised. This information will be stored in your credit card and online so you can make online transactions. This makes buying online and in real life a lot more easier and safer. Now, we don’t know how this cycling system can be implemented and can stay secure without any bugs or mishaps that could leave the system vulnerable. We would also have to completely change our systems and payment methods so that they could adapt to this new system of payment. We sincerely thank you for your time in assisting our idea for a future technology.
Thanks in advance; I appreciate the community's thoughts!
EDIT - thanks for your help! Here's my response; hopefully I haven't introduced too many inaccuracies :)
Congratulations - you've asked the $100 billion dollar question! :)
Obviously credit card theft is a very serious problem. Fortunately, the consequences for consumers aren't necessarily as dire as you might think. Credit cards are convenience tools that allow people to borrow money, as such when a stolen card is used it's the lender that is on the hook, and cc companies generally do not charge customers for fraudulent transactions. Since they are liable for payments CC companies are on the lookout for fraud; they detect it by analyzing their customers' spending habits and looking for unusual activity (buying things they don't usually buy, spending money in foreign countries, etc) and they will either proactively reject the transaction or flag it and alert customers if they detect such activity. CC companies also respond to customers who report stolen cards and do not usually charge for transactions customers report as being illicit.
Debit cards are a different matter. They are linked directly to consumers' bank accounts and it may be harder to convince a bank to reimburse customers for charges made on a stolen debit card. Think twice about using or even owning them.
Whether you use a credit or debit card, it is a good idea to pay attention to your billing statements and reporting any charges you don't recognize so you can report it quickly. Some other general advice that can reduce exposure:
- Use credit, not debit (e.g. your bank account), as you have less recourse for stolen money otherwise.
- Be extremely careful with who you give your number to online.
- If you were directed there from an email, make absolutely certain the site is who they claim to be (it could have been a phishing email).
- Only provide it to reputable processors and make sure the connection is done over TLS (encrypted internet connections; browsers usually have a shield or a lock in the address bar).
- Only use cards without a magnetic stripe to protect from "skimmers" which are placed around legitimate card readers and read information on the card from the stripe.
- If the card only has a chip, then it's much more difficult to intercept sensitive data.
- Don't give out your CC number to anyone on the phone if they called you. Call the company back at the number found on their official website (again, you're verifying who you're interacting with; caller Id's can be spoofed).
- Make sure you shred sensitive paperwork (bills and statements) before throwing it away.
- Keep your browser and operating system up to date to avoid malware.
One last option is to use virtual credit cards, and your solution actually bears a lot in common with them. Some credit card vendors will allow you to generate virtual card numbers. Being more ephemeral, they're less valuable to attackers and lower the risk of unauthorized charges. The major drawback of virtual credit cards is that the rotation scheme is not automatic; it's up to users to cycle their credit card numbers, and update them in all places they're being used. Automating the scheme might be done using something similar to a Two Factor Authenticator (2FA). 2FA is a system where synchronized time and paired pseudo-random seeds into an algorithm running on a computer, phone, or it's own little device (often referred to as a FOB) is compared to its twin at the security service. This technology is commonly used in many corporate VPN networks, and it is conceivable that this technology could be incorporated into credit cards. One problem with this approach is that the chips in credit cards are extremely low-power and do not have the ability to keep track of time, so they would need to trust the untrusted and potentially malicious chip reader that could lie to them about the current time to retrieve future numbers. Perhaps this problem will be solved as battery miniaturization progresses. A more challenging problem with this approach is that you generally only implement it on a one-to-one basis; you don't want the same authenticator sequence for multiple accounts - it would be like sharing passwords! So we would need to work through this challenge.
Thanks so much for your question. It's good to see you thinking about this problem. The landscape is constantly evolving and I'm encouraged to see young people taking an interest and proactively thinking of solutions!
Regarding point allocation I've upvoted all your answers as they were all extremely helpful. I accepted Forest's because I drew most of my response from it. Thanks again for the assistence!