Singapore: Secure Chips for All ATM Cards by 2014

Robin Chan & Magdalen Ng – Straits Times Indonesia

Singapore. All ATM cards will have a smart chip installed by 2014, in a move that should significantly reduce the threat of fraud.

The new safeguard protects a customer’s account details far more robustly than the current magnetic stripes, and so should make ‘skimming’ far harder.

Secure chips are part of a range of additional security steps announced this week by the banking industry, in the wake of the huge ATM fraud that hit DBS Bank and POSB customers two weeks ago.

The measures give customers much more supervision of their accounts while also shoring up the security infrastructure at the banks.

The Monetary Authority of Singapore (MAS) urged the banks to implement the measures ahead of the deadline, and said that it holds banks directly responsible for the safety and soundness of the services and systems they provide to their customers.

Ong-Ang Ai Boon, the director of the Association of Banks in Singapore (ABS), told a briefing yesterday that the changes were not a ‘knee-jerk’ reaction to the fraud that hit DBS.

Boosting ATM and card security was already in the works, she said, but implementation was ‘fast-tracked’ after the scam.

The new measures are extensive.

They will block the use of ATM cards overseas by default unless the customer chooses to be exempt, and require banks to send SMS alerts to account holders if a withdrawal is made over a certain limit. Foreign and local banks must have these measures in place by June 30.

It was also announced yesterday that by the end of June, all newly issued credit and debit cards will have to be personally activated by the customer by contacting the bank.

By the end of the year, all banks will issue new online banking security tokens with enhanced features such as ‘transaction signing’ to give an added layer of authentication for high-risk and high-value transactions, said Ong-Ang.

But the most ambitious — and costly — step involves putting what is called an EMV chip in the ATM card, seen as the best defence against card skimming.

It is already used in credit cards and in ATM cards in places such as Malaysia, Taiwan and Britain, which previously had high rates of ATM card skimming.

Tom Wills, managing director at Secure Strategies, said: “EMV cards store the customer’s account data in encrypted form on the chip, making them a lot harder to break into than magnetic stripe cards. When this security upgrade is finished worldwide, card skimming will be a thing of the past.”

That stripe is a security Achilles’ heel, and was how the crime gang ‘skimmed’ the data of hundreds of DBS and POSB account holders and stole around $1 million.

Once Singapore moves to chip-based cards, the stripe will likely either be deactivated so ATMs only read data on the chip, or the ATM will be able to choose to read the more secure option of the two. The cards will likely keep the stripe as long as the United States continues to only accept magnetic stripe cards.

The transition to chip-based cards will cost a lot for banks to implement, analysts have said. It involves not only replacing all cards but also an overhaul of all ATMs, Nets payment platforms and point-of-sale machines so that they can read the data.

A typical magnetic stripe ATM card costs about 50 cents, said ABS, while a chip-based card costs at least $5 a card.

The process has begun, with banks saying that they are working towards meeting the deadline.

Maybank said it will have replaced all its ATM cards with chip ones and converted its 37 ATMs by 2013.

DBS said it began phasing out ATM cards in the middle of last year and only issues debit cards with a chip. ‘Today, the majority of new cards we issue are debit cards with EMV chip technology,’ a spokesman said.

While the measures will harden Singapore against card fraud, Ong-Ang noted that the country already has one of the lowest rates of fraud in the world.

They also put added onus on consumers, who will have to take a more active role in monitoring their account activity.

Ong-Ang said that this is the trade-off between customer convenience and keeping the fraudsters at bay.

“Over the last two years, we have been constantly looking to enhance all the security measures. We know out there the fraudsters are getting smarter and more sophisticated and know what we are doing, and we need to stay ahead of them.”

Security analyst Douglas Russell, director of the Britain-based DFR Risk Management, noted there is always more to be done: “Even once chip and PIN is widely established, the industry in Singapore will need to assess what the next type of attack will be, and plan and implement appropriate defensive measures.”

Customers welcomed the measures even as they weighed the possible inconvenience.

DBS customer Milly Tan, 25, a commercial scheduler for a media company, was a victim of the recent ATM skimming.

She said the security boost goes a long way to making her feel more secure, but added: “A lot of the details still need to be developed, so we will have to see how it goes.”

Reprinted courtesy of Straits Times Indonesia. To subscribe to Straits Times Indonesia and/or the Jakarta Globe call 021 2553 5055.