Signature makes cards 'less secure'

SINGAPORE--Signature-based credit cards are increasingly deemed less secure and targeted to be phased out, with countries such as the United Kingdom and France opting for more secure alternatives. Visa Australia also recently announced a similar move.

According to Michael Araneta, senior manager of consulting and research at IDC's Financial Insights, signature-based cards have long been targeted to be phased out as they are not deemed to be secure. "Chip-based cards provide much better security features, or have more layers of security, than standard signature cards," Araneta said in an e-mail interview.

The U.K. and France have already adopted chip-based cards, alongside personal identification number (PIN), as the primary methods of authentication. According to a report by local news tabloid The New Paper, after switching to chip-based cards, the U.K. reported a 24 percent drop in counterfeit and fraud from lost and stolen cards in 2005.

Singapore will also move away from signature-based cards and utilize other technologies to secure credit card transactions.

The Monetary Authority of Singapore (MAS) said, after working with the payment card industry to review various security tools for combating cybercrime and card fraud, it has decided to phase in a program to enhance payment card security over the next two years.

"The key initiatives are the implementation of Dynamic Data Authentication (DDA) chip cards and dynamic authentication for card-not-present transactions, including transaction alert, customer activation of new or replacement cards and more rigorous detection and prevention of fraudulent card activities," a MAS spokesperson told ZDNet Asia in an e-mail.

These DDA chip cards will incorporate a latent PIN function, which can be activated when required, she said.

For now, financial institutions said they will comply with existing regulations stipulated by the MAS.

Loh Weiling, a spokesperson from American Express's Singapore office, said these regulations provide their cardholders with "appropriate security measures".

She added that the company operates in a "closed loop environment", with access to both merchant and customer data, and its fraud detection systems can react quicker to fraud trends,. This enables American Express to take preventive actions and keep the company's overall fraud rates low, compared to the industry average, she said in an e-mail interview.

Local financial institution OCBC Bank is also staying with MAS mandates. Andrew Wong, OCBC's head of information security, said the bank's measures are guided by the monetary authority's recommendations in "mitigating credit card frauds" such as skimming and online fraud.

"These recommendations include the implementation of EMV (Europay MasterCard and Visa) technology to replace magnetic strips, and One Time Password (OTP) for customer-not-present transactions," said Wong in an e-mail interview. He added that the bank will continue to review the latest technologies to ensure their customers' credit card transactions remain secure.

Australia taking lead
Visa Australia's decision to remove signatures and focus on chip and PIN systems by 2013 was part of a seven-point security initiative that also includes enhancing the security of online transactions, said Chris Clark, Visa's general manager for Australia and New Zealand.

"The time is right to take advantage of the new technologies available to work across the industry--with banks and merchants--to strengthen security across the board," he added.

Visa currently has no plans to deploy the system outside of Australia and into Asia, with the exception of perhaps New Zealand, said Judy Shaw, Visa's corporate relations manager for Australia, New Zealand and South Pacific.

"This plan addresses specific issues in the Australian marketplace…and [we] are consulting with the industry to develop a program for New Zealand," Shaw explained. "While there are commonalities, each marketplace addresses specific issues at different times…[and] others will do so when marketplace conditions require."

She added that Visa will roll out programs to educate the public before the full deployment, but noted that most Australians are already familiar with the PIN system. "Since June 2008, cardholders have had the option of signing or using a PIN on Visa credit or debit transactions, and there has been a very good uptake of PIN use," Shaw said.

IDC's Araneta welcomes Visa Australia's announcement of a timeline to migrate to chip and PIN systems, noting that it requires a "comprehensive and time-bound effort" to successfully complete the move. He said the country is again leading the way, "especially in the area of payments".

The analyst said, however, that the shift will entail significant costs to support areas such as the replacement of signature-based cards and issuing new chip-based ones, as well as changing existing payment infrastructure.