Smart Cards

Emerging Technology Scan

By Joe Yates

BUS 656P Electronic Commerce, Prof. Benn Konsynski

Goizetta Business School, Emory University

31 March 1997

Why should I care about "Smart Cards"?

Take a quick look in your wallet or purse. If you're like most Americans, you'll see something like this:

CashDriver's License Credit Card
ATM CardVideo Rental Card Library Card
Frequent Flier CardCalling Card Insurance Card

If you're like me, you probably have ALL of the above plus a few more! Seems a little ridiculous, doesn't it? Well, you guessed it, Smart Cards promise to solve our over-stuffed wallet problems -- and make our lives easier to manage and more secure along the way.


What is a "Smart Card"?

A Smart Card looks like a regular credit card, but instead of having the familiar black magnetic stripe, it's got a computer chip on it. As you might image, Smart Cards can do a whole lot more than simple credit cards. Unlike a traditional credit card that holds only your name and account number, a Smart Card can store, retrieve, and manipulate a whole pile of data on-board the card. It's the ability to manipulate data locally on the card without having to dial into some giant computer database in the sky that makes Smart Cards interesting.


History of the Credit Card

To really appreciate the full potential of Smart Cards, you first have to understand a little bit about credit card technology. Let's take quick look at the history of the old familiar credit card:

Time FrameTechnology
Up to mid 1970'sEmbossed card with signature panel. Manual imprinting on sales slip. No authorization at time of sale. Manual clearing of account.
Mid 1970'sVisa and Mastercard introduce electronic networks linking banks for authorization, clearing, and settlement. Many banks introduce their own automated teller (ATM) networks for cash dispensing with cards using magnetic stripes.
1980'sVisa and Mastercard put magnetic stripes on their cards so that electronic cash registers can read the cards to further automate the transactions.


Anatomy of the Old Familiar Credit Card

The "state of the art" today in magnetic stripe credit cards has the following characteristics:

SideItem ReasonDrawback
FrontName, account number, and expiration date embossed in raised letters Visual card holder name and account number information. Also needed for old fashioned sales slip imprinting device. Not readable by machine.
FrontPhotographSecurity Requires visual examination and comparison by sales clerk. Also requires card holder to arrange for photo session.
FrontHologramSecurity Expensive
BackMagnetic stripeHolds account identification information in machine readable format. Usually read-only. Limited read/write capability. Stores only a few hundred characters of data. Exposed and easily damaged.
BackSignature panelSecurity Requires visual examination and comparison by sales clerk

Why do we find this hodgepodge of items on a credit card? Two-reasons:

  1. The need to maintain "off-line" usability. That is, you can pay by credit card even when the phone lines used for authorization are down (or when there is no phone line).
  2. Security against someone using a stolen or counterfeit card.

Smart Card Advantages

Smart Cards promise to fill the need currently satisfied by magnetic stripe cards, plus offer some unique additional advantages. Let's compare Smart Card's to magnetic stripe cards:

NeedMagnetic Stripe Card Smart Card
Data storageMagnetic stripe holds a few hundred characters and are usually "read-only" (that is, you usually do not change or update the information stored on the card). Memory chip holds several thousand characters (currently 1k to 16k bytes) in read-only or read/write format.
Data securityNoneOn-board data encryption and/or password/PIN controlled access to data on card.
Off-line usagePossible, but risky since account balance cannot be verified. Read/write memory means that "electronic cash" could be stored on-board the card
Card holder identificationVisual comparison by sales clerk. PIN access requires on-line transaction. PIN access could be handled off-line by microprocessor on-board card.
CostExtremely cheap (a few pennies) Moderately expensive in the past, but costs are decreasing rapidly. $1 for memory-only cards, $3 to $5+ for microprocessor-based cards.

As you can see from the table above, Smart Cards offer significant advantages over the traditional magnetic stripe card. Consequently, there have been some big moves recently around the world by businesses and government agencies implementing Smart Card technology. In the US, Visa, Citibank, Chemical Bank, Bank of America, Wells Fargo, First Union, Nations Bank, US West, the New Jersey Legislature, and the Atlanta and New York metro transit authorities are all implementing Smart Card technology in some fashion.

What's the driving force behind Smart Cards?

What are the influencing factors?

Why now?

Smart Card utility for the consumer:

Smart Card utility for the retailer:

We can break down the Smart Card movement into three main areas:

  1. Cash Smart Cards
  2. Bank Smart Cards (Credit and ATM)
  3. Personal Information Smart Cards

Smart Cards as Cash Cards

On Star Trek, did you ever see anyone pull out pocket change or dollar bills for a Holodeck session? Off course not -- We all expect that pocket change will become obsolete at some point in the future. Today in the US, cash or checks exchange hands during 88% of all transactions. Let's take look at cash for a moment:

Cash from the consumer's viewpoint:

Cash from the retailer's viewpoint:

Cost of Cash (from UK retail industry data):

Protection equipment
21,000,000
Collection
83,000,000
Protection staff
33,000,000
Robbery
12,000,000
Lost
16,000,000
Counterfeit
2,000,000
Total
167,000,000

In other words, cash costs UK banks and retailers around 167 million pounds per year (other studies show that the cost may actually be 4.5 billion pounds or more!).

More cash facts:

In an attempt to lower the operating costs associated with small cash purchases, retailers and banks have linked up to create what is known as a "Cash Card". A Cash Card is simply a Smart Card that loaded with "electronic cash" that can be used in place of physical cash. The retail industry finds Cash Cards attractive because accepting payment via Cash Card is actually cheaper than accepting hard currency.

A consumer buys a Cash Card for a pre-defined amount (usually $10, $20 or $50) and then uses it to pay for items -- just as s/he would use regular cash. During each transaction, the purchase price is deducted from the cash balanced stored on-board the card. When the card is used up, you throw it away (however, some services do offer reloadable cards). Obtaining the card is similar to getting cash out of an ATM, and the card balance is shown during each transaction. The card balance can also be checked at a Cash Card vending machines. If the consumer wishes to buy something that exceeds the amount of cash in the card, s/he can either pay the balance with physical cash or with another Cash Card. No more fumbling for change while five people wait impatiently behind you in line!

Smart Cards save retailers money in two areas:

  1. Reduced handling costs: Cash Cards reduce the volume of coins and bills a retailer has to count, store, transport, deposit, withdraw, and protect.
  2. Reduced telecommunications costs: Since Cash Card transactions take place "off-line", the retailer does not have to call a bank card network during each individual transaction. This saves both time and money.

Big events in Cash Card applications:

Why Cash Cards are "catching on":

Cash Cards and pre-paid phone cards have really caught on in Europe and are now starting to make a significant beach-head in the US. You may wonder why the US seems to be lagging the EU in the implementation of Smart Card technology. The main reason has to do with telecommunications costs. In the US, it's relatively cheap to make a phone call (even a US long-distance call is a bargain by European standards), so most retailers in the US don't mind if you use a credit or debt card for a $10 purchase -- since it doesn't cost them much to do the on-line authorization via phone. In Europe, however, the cost for a credit card transaction is much higher, so the move to "off-line" (no phone call) Cash Cards occurred much more quickly than in the US. Lately however, the costs associated with Cash Cards and their related equipment has fallen dramatically, so Cash Cards are starting to make economic since in America. The biggest Smart Card success thus far in the US has been with pre-paid phone cards. This was due in part to fraud concerns over traditional phone cards and vandalism of coin operated phone booths. Another big success is in the area of reloadable public transit cards to replace tokens.


Smart Cards as Bank Cards

There are two types of bank cards:

  1. Credit cards ("Pay later" cards)
  2. Bank cards ("Pay now" - debt or ATM cards)

Smart Cards used as bank cards function similar to magnetic stripe cards: They give the retail establishment your account information so that they can transfer money from your bank to their bank automatically. However, where Smart Cards offer significant advantages over traditional cards are in the areas of fraud control and security. With a typical credit card transaction, the bulk of the security is left up to the sales clerk. S/he has to visually check your signature or the photo on the card (if there is one) and/or your ID. Debt cards offer a little additional security by using a personal identification number (PIN), but that requires an on-line (over the phone) transaction for PIN verification. Unfortunately, even with these redundant measures, millions of dollars are lost each year in fraudulent credit card charges. The situation gets worse if the transaction takes place over the phone or via the Internet. In these cases, usually the only way card holder identity is verified is through the use of a "pass word" (like your mother's maiden name) or your social security number. But even these precautions are usually used only when you change personal account information (like your address) and not during a normal sales transaction. Unfortunately, the risk associated with over-the- phone credit card transactions are restricting the growth of the emerging "shop via phone" and "shop via Internet" markets. With on-board data processing capabilities, Smart Cards offer advantages in the area of fraud prevention versus traditional magnetic stripe cards.


Smart Cards and Fraud Prevention

Unlike regular credit cards, Smart Cards can store a PIN (Personal Identificaton Number) directly on the card and use data encryption techniques to insure security. Reduction in retail store credit card fraud costs along with phone/Internet payment security are the leading factors driving Smart Cards as the replacement for traditional magnetic stripe credit cards.

Smart Cards also provide new avenues for fraud prevention that are simply not available with traditional credit cards. For example, Checkmate is marking an automatic signature verification system built directly into their Smart Card reader device. During the transaction, the card holder signs a signature capture device. The digitized signature is then compared to a template stored on-board the Smart Card. Checkmate claims a 97.9% authentic acceptance rate coupled with a 99.4% impostor rejection rate. On a signature match failure, the store clerk can ask to see the card holder's ID. On a signature match, the signature template is updated and stored on card to compensate for slight variations in the signature over time. Since the template is stored on the card, small value transactions of this type can take place "off line" and still significantly reduce the chances of credit card fraud.

Credit Card Fraud Trends:

Today
  • Lost or stolen card fraud is currently in a down turn (primarily due to identity checking on newly issued cards and at time of purchase)
  • Mail order / telephone order / Internet fraud is on the rise because neither the cardholder or the card is physically present for the transaction
Future
  • Account takeover: Criminal gets enough information about you to change your account address and phone number and subsequently issue himself a new card with a new PIN.


Personal Information Smart Cards

The big driver for using Smart Cards as ID cards is their increased information data storage capacity over traditional magnetic stripe cards. Health care companies and entitlement programs are very attracted to this new capability. Smart Cards allow storage of personal information on-board a card that can be kept by the individual.


For the health care industry, this means that issues regarding the privacy and transfer of medical information can be solved by simply letting individuals hold their own data stored on their own card. The card holder has the choice of who gets his/her personal data by deciding when and where to present the card. Data from multiple medical companies can be stored together on one card using selective encryption schemes -- so that one company can't read an other's data. Instead of having to go through the hassle of requesting transfer of medical information, doctors, hospitals and pharmacists can instantly access blood type, allergy, medication, medical history data directly from the patient's card. Using Smart Cards in this manner promises to greatly reduce the cost of handling, storing, and transferring medical information, as well as reducing certain legal liability costs.

For entitlement programs, Smart Cards mean that food stamps and other welfare related disbursements can be organized onto one card, allowing significant reductions in the costs associated with allocation, disbursement, management, and tracking.

Some interest in Smart Cards is also being generated by state governments seeking ways to provide a multi-agency identification card for state issued licenses. Driver's license, as well as hunting, fishing, and gun permit information could all be stored on one card, along with other personal information such as driving record, digitized fingerprint info, etc. New Jersey is leading the way with a plan to issue Smart Card IDs to all state residents.


Summary

What customers want Smart Cards to do:

control financescharge purchases get cash from my account
pay billsdebit accounts pay for cash purchases
prove my identityget lines of credit get financial advice

The future looks bright for Smart Cards. The following trends have been identified:

Typical Smart Card applications of the near future:

ApplicationMovement
Payment Vehicles
  • Credit Cards: Increased fraud protection
  • Electronic Purse: Cash loaded and then decremented for each transaction. 88% of all transactions are cash or check. 83% are for amounts under $10.
Access Keys
  • Internet and publicly access networks need encryption and authorization for financial transaction security
  • Home banking
  • Pay per view
  • Payment via Internet
Info Managers
  • Current storage 1k to 16k bytes of data (multiple services put info on one card)
  • Bank acct. info
  • Ticketing
  • Frequent Flier points
  • Universal credit card
  • Expense tracking
Marketing programs
  • Card face can be used for advertisement because same card presented for use many times.
Loyalty programs
  • Frequent Flier programs
  • Gift certificates
  • Electronic Coupons
Customized Delivery Systems
  • Personal info and accounts
  • Tailoring services to each customer


References and Smart Card Related Links