MasterCard, to stem counterfeiting, is encoding secret numbers on cards.

In a bid to thwart counterfeiters, MasterCard International is requiring that secret numbers be encoded on the magnetic strips of all its credit cards.

MasterCard said it has already used the security procedure to impede notorious counterfeiting rings in southeast Asia.

"Because of the success rate, we felt there would be some value in implementing it worldwide," said Joel S. Lisker, the association's senior vice president for security and risk management in New York.

Rise in Losses from Fake Cards

Counterfeiting is the second-costliest type of fraud for MasterCard issuers, after card theft. Worldwide losses totaled $37 million this year through June, up 54% from a year earlier. Stolen cards, by comparison, caused $41 million in losses in the first half, down 18%.

While fraud has long been a major expense for MasterCard, it is showing signs of flattening out. Losses last year amounted to $460 million, up 23% from 1991. But in the first half of this year, fraud cost $164 million, about the same as a year earlier.

Banks will be required to incorporate the security technology - called CVC, for "card validation code" - on all cards issued after January.

Banks will also be required to use a package of other design changes, called the "enhanced security card features," aimed at making it harder for counterfeiters to change account numbers and expiration dates embossed on genuine cards.

Changes Called Inexpensive

The cost of the changes is minimal, according to Mr. Lisker.

Use of the procedures has been optional since 1988. Late last year, MasterCard required their use in the Asia-Pacific region. That step contributed to a 14% drop in the region's counterfeiting losses last year, to $22 million, Mr. Lisker said.

The card validation code is being used in 68 million of the 188 million MasterCards in circulation worldwide.

CVC is essentially the same as a technology that Visa USA and Visa International have embraced, called CVV for "card verification value." Both technologies entail the encoding of a three-digit number on bank cards' magnetic stripes.

The numbers are not visible on the face of the cards, but are algorithmically derived from the numbers that are visible, including the account numbers and expiration dates.

Counterfeit Cards Flagged

When card transactions are sent electronically from point of sale terminals to bank computers for authorization, the computers check for the proper CVC or CVV number.

MasterCard's Mr. Lisker said that skirting the security procedures requires a degree of sophistication beyond most criminals. The algorithm used to derive the code is said to be too difficult to crack. Thus the only way to get the numbers would be to use special computer equipment to read them from magnetic stripes, or to tap the computer phone lines that carry the codes.

Jerome Svigals, an electronic banking consultant in Redwood City, Calif, warned that the CVC and CVV technologies do nothing to protect the large number of card transactions that aren't authorized against a card issuer's computer database' He added that the technologies also do little to protect banks from poorly trained or dishonest merchants.

For reprint and licensing requests for this article, click here.
MORE FROM AMERICAN BANKER