News 13 Investigates: Is chip card technology more secure?
ASHEVILLE, N.C. (WLOS) —
'Tis the season to shop and you should have an extra sense of security this year after many people switched to new chip cards. But is that new technology working the way credit card companies promised it would?
News 13's investigative team spoke to a cyber security expert who says the answer to that question is "no." News 13 also found one victim who lost thousands of dollars using the chip technology, information credit card companies don't want you to know.
Deborah Coule is the owner of Chevron Trading Post in Asheville. Her businesses' chip enabled credit card was compromised just a few months ago, resulting in a bill in excess of $58,000 for pages of purchases at Tokyo Disney.
"Most of these were like room charges, so you're probably not going to suspect that someone's getting some rooms," Coule said.
Prior to becoming a victim of fraud, Coule added a chip reader for her own business last year to avoid any added liability. But now she questions the value of the chip technology after her own experience.
"I'm at the point that I don't know if I trust any card or any online sales," she said. "You kind of get gun shy after a while to even reveal any information."
Coule hasn't experienced any card fraud in her business that she knows of, but security experts say the chip reading machines are no guarantee that it won't happen.
John Bumgarner is a cyber security expert with years of training by the U.S. government.
"The chip and pin only gives you a false sense of security. Anywhere within the transaction it can be stolen," Bumgarner said. Coule listened intently saying, "I kind of thought that. I'm not seeing where I'm any more secure at all."
The former Army special operations member has since co-founded several cyber security businesses, including Actionoble, headquartered in Asheville.
"Chip cards are no more secure than what we had before," Bumgarner said. He claims chip cards won't prevent fraud and hackers can still penetrate the chip reading devices in a variety of ways.
"It's a cat and mouse game. Hackers are always ahead of you," Bumgarner added.
Chip cards give added security because the information is encrypted when used in a chip reader. But the cards also have a magnetic strip with all your information. If you swipe that card at a business that doesn't use a chip reader, like gas stations, which aren't required to make the transition until 2020, your information, even on a chip card, can easily be stolen.
Many businesses have missed last year's October chip reader deadline and still haven't made the transition despite the risk of increased fraud liability. News 13 visited several local Asheville businesses, some using chip readers and some that aren't.
Home Depot, the site of a huge data breach in 2014, does use them. World Market does not. Target does, and so does Whole Foods, but Ingles doesn't.
Ingles Chief Financial Officer Ron Freeman said the following when asked why they haven't switched to chip readers:
"We have the software ready to fully utilize chip reader technology but did not want to risk disruption during the busy holiday season. We fully anticipate having it in all our stores after the first of the year."
The National Federation of Independent Businesses said there are two primary reasons many businesses still haven't made the switch.
"For the most part, it's an education hurdle -- what they need to, what's required of them to alleviate some of the fraud risk, and then also the cost factor," Holly Wade, the Director of Research and Policy Analysis, said.
Another big reason is the uncertainty of what's ahead as several lawsuits have now been filed against the credit card companies. The litigation complains about the added cost of upgrading to the technology and the increased fees for using it. They also claim the credit card companies colluded to force businesses into buying the expensive equipment experts say is no guarantee against fraud.
Gas stations have been given more time because of the cost of transition, an estimated $4 billion. But pumps are also the most notorious for skimmers.
RELATED | Consumer Reports: ATM Skimmer Scams
"If there's some hacker or some type of malware that's been installed in that POS system, then your card can be stolen in seconds," Bumgarner said.
He points out that even if every business was using a chip reader, that still wouldn't stop hackers. "Just because you have that chip on that card doesn't make that card any more secure because hackers can still steal that information somewhere along the way," Bumgarner said.
While chip readers won't protect against all fraud, you can take steps to prevent it:
- Only use debit cards as credit when no chip reader is available.
- Have a credit card with a low balance to use at point of sales systems without chip capability
- Never use your bank card as a debit at gas stations without chip readers
- Sign up for balance alerts with your financial institutions
- Review your online statements weekly. Experts say it's added protections for holiday shoppers searching for answers and technology to stop the growing fraud.