Our fingerprints are quickly replacing PINs and passwords as our primary means of unlocking our phones, doors and safes. They’re convenient, unique, and ultimately more secure than easily guessed or forged passwords and signatures. So it makes sense that fingerprint sensors are coming to protect our credit and debit cards. MasterCard is testing out new fingerprint sensor-enabled payment cards that, combined with the onboard chips, offer a new, convenient way to authorize your in-person transactions. Instead of signing a paper receipt or entering your PIN while struggling to cover up the number pad, you simply place your thumb on your card to prove your identity. The new cards are currently being tested in South Africa, and MasterCard hopes to roll them out to the rest of the world by the end of 2017. Even if that happens, though, you’ll still have to wait for your bank or financial institution to get on board. Once the technology is ready for the public, here’s how it should work. Your bank will inform you that the biometric card is available, and if you’re interested, you’ll have to go to an enrollment center (most likely a bank) to get your fingers scanned. An encrypted digital template of your fingerprint is stored on the card’s EMV chip . You can save up to two prints, but they would both have to be yours — you can’t authorize someone else to use your card with their fingers. After your templates are saved, your card is ready to be used at compatible terminals worldwide — merchants don’t have to get new equipment to accept your fingerprint-enabled plastic. The card itself is surprisingly no thicker than a regular credit card. The fingerprint sensor is a small, thumbnail-sized rectangle that sits at the top right corner, and is easily accessible when you stick the card into a payment terminal. During a recent demo, I tried to use a MasterCard rep’s biometric card with my finger, and received a “Transaction denied” message from the test payment terminal. When she carried out the faux-purchase, the payment went through, and the machine began printing a receipt. What really surprised me was the speed at which it happened. When the terminal asks you to insert the card, it’s communicating to the bank information like your identity and the amount of the transaction. Then, it verifies your identity by asking for your fingerprint. The sensor reads your finger, and sends the information to the card’s chip, which determines if you’re the owner. If you are, it sends a “Yes” or “Authorized” message to the bank, which then allows the payment to pass. At my demo, the authorization process happened almost instantly, which is reasonable given it’s all happening on the card instead of going through the bank. When it was me using the card, however, it took a slight pause to register that I wasn’t certified. I didn’t have trouble learning the new process at all, either — it’s intuitive and straightforward to simply leave your finger on the card as you slide it into a payment dock. Of course, this method is only compatible with chip-and-pin cards, so it won’t work with stores that only accept the older magnetic stripe models. But embedded chip technology has become increasingly popular in the US, thanks largely to regulations making financial institutions and merchants liable for breaches resulting from a lack of support for chip-and-pin cards. Getting a new biometric card is troublesome, since it would require a trip to the bank and a potentially long wait. But the convenience and the joy you’ll get from waving that fancy new plastic in your friends’ faces may make that agony worthwhile.
View the original here:
MasterCard adds fingerprint sensors to payment cards
Naoki Hiroshima had a rare and valuable Twitter handle, @N . It was extorted from him , he claims, by a scammer who figured out that PayPal reveals part of one’s credit card number during security verification—and that GoDaddy accepts the same part of the number during security verification. I asked the attacker how my GoDaddy account was compromised and received this response: From: SOCIAL MEDIA KING To: Naoki Hiroshima Date: Mon, 20 Jan 2014 19:53:52 -0800 Subject: RE: …hello – I called paypal and used some very simple engineering tactics to obtain the last four of your card (avoid this by calling paypal and asking the agent to add a note to your account to not release any details via phone) – I called godaddy and told them I had lost the card but I remembered the last four, the agent then allowed me to try a range of numbers (00-09 in your case) I have not found a way to heighten godaddy account security, however if you’d like me to recommend a more secure registrar i recommend: NameCheap or eNom (not network solutions but enom.com) GoDaddy outright refused to help him at first, too. It’s shocking how weak account security is there, and at PayPal: “Don’t let companies such as PayPal and GoDaddy store your credit card information,” Hiroshima writes.