How The Chip In Your Credit Card Actually Works
Chances are good your credit card has a computer chip embedded in it. This little rectangle is an EMV chip, which stands for Europay, Mastercard, and Visa (the three companies behind the global standard), and was created (in 1994) to enhance security and reduce the risk of counterfeit fraud. The reason why EMV chips are so effective at countering counterfeit fraud is because of tokenization, which replaces sensitive data with a token. In this case, the token replaces a credit card's primary account number.
Here's how it works for credit cards: When inserted into a chip-enabled terminal, the EMV chip creates a one-time code to process the transaction; once payment is processed, the token is no longer usable. So, even if it was stolen, the tokenized data would be of no use to a hacker, as it isn't the actual card number, meaning there's nothing for the thief to counterfeit.
This said, in order for this to work, consumers need to be able to use their chip cards. While credit cards equipped with EMV chips started to appear in the United States in 2011, 2015 was the year in which businesses really started to make the shift to EMV chip technology. And according to Visa's 2019 statistics, it didn't take long to see the impact of that change. Just four years after the switch, Visa reported a 62% decline in counterfeit fraud dollars for all U.S. merchants.
Chip vs. magnetic stripe vulnerability
Chip cards do still come with a magnetic stripe, but this now only serves as a fallback in case a chip reader returns an error. It's the vulnerability of the magstripe that prompted the creation of EMV chip technology in the first place. As noted, an EMV chip generates a unique code for every transaction, and this makes it much more difficult for a hacker to compromise the card. What thieves need is the card number, and because of tokenization, the card number remains unknown during the transaction.
This isn't the case with magstripes on credit and debit cards (and gift cards), however. A magnetic stripe stores the card's data; it comes with three tracks, the first two of which contain information like the cardholder's name, the primary account number, the card's expiration date, and the all-important security code, which verifies the user's access. With this magstripe data, counterfeiting is much more possible as a thief can use the data to create fake cards or carry out fraudulent card-not-present (CNP) transactions. You may have heard about the rise of card skimmers (here's how to spot them), which scammers use to read these magnetic stripes surreptitiously.
In its overview on card skimming and ways to be on the lookout for these devices, the FBI advises consumers to "use debit and credit cards with chip technology." The reason? There are fewer devices known to be capable of stealing chip data; in fact, even though shimmers now exist, compromised data from chips remains a challenge for thieves to use.
Can chip cards still be compromised?
On October 1, 2015, liability for counterfeit credit card fraud shifted from consumers to merchants, provided the fraudulent transaction was the result of a consumer being unable to use their chip card at the point of sale due to an outdated machine. Because of this, 2015 was the year chip cards in the U.S. started to really take off, given the new incentive merchants then had to update their readers.
This said, the switch to chip-enabled machines also meant thieves needed to adapt, and though it's still not as prevalent a scam as skimmers, card shimmers do exist today. Card shimmers are basically chip readers, and thieves hide them inside of legitimate card readers, so when your card is inserted, it reads the chip and captures the data, just like a card skimmer. It's not possible to clone a chip card; however, thieves can transfer the information onto a magstripe. Shimming is more difficult to pull off, and as the FBI said, it's a lot less common.
On that note, many new credit cards today are also contactless, meaning you can simply hold your card up to a POS terminal and the card's RFID technology will then complete the transaction. Using this kind of "tap" payment can help you avoid skimmers and the rarer shimmer altogether. Not all chip cards are contactless, though, but you could still make your card contactless by adding it to a digital wallet. (See Money Digest's guide to money scams to watch out for in 2024).