Vulnerable magnetic stripe card technology makes Vietnam a tempting target for credit card fraudsters.
Investigators in Hanoi last month discovered a ring of hi-tech criminals from China using counterfeit credit cards to withdraw billions of Vietnam dong from major local banks. It was reported that the Chinese suspects set up four companies and used legal entities as a screen for their illegal activities. The four companies signed up for credit card payment services with local bank branches in Hanoi, including BIDV, Sacombank, VietinBank, Vietcombank, Eximbank and Oceanbank, to install POS (points of sale) machines. They then used counterfeit cards with stolen information to withdraw money.
With a significant young population, the emerging popularity of online shopping and advancements in e-banking services, Vietnam has been a land of opportunity for card issuers and, unfortunately, for credit card fraudsters as well. Figures released by the Vietnam Card Association at the end of last year showed that the total number of cards issued by 50 issuers reached more than 66.2 million, an increase of 20 per cent compared to 2012, of which debit cards, credit cards and prepaid cards accounted for 92.3 per cent, 3.67 per cent and 4.03 per cent, respectively. “From both a macro-economic and banking perspective, the local card market is considered very promising given the rising incomes among the country’s 90 million people, rapid economic growth, and improving legal system,” said Ms Nguyen Thu Ha, Chairwoman of the Vietnam Card Association under the Vietnam Banking Association.
However, it’s a fledging card market that, somehow, makes Vietnam a tempting target for credit card fraud. “There’s no doubt that Vietnam’s card market is still in its early stages and many commercial banks still use magnetic cards, which are not safe enough to protect card users’ information,” said Mr Nguyen Hai Ha, CEO of MK Smart. The second reason, he added, is that customers, when using cards, are yet to be vigilant in protecting their information.
Even though some local banks are starting to use credit cards with chip and personal identification number (PIN) technology, there are still banks that rely on magnetic stripe cards. Inevitably, international fraudsters migrate from places where security is high to places where it is low. It happened when neighbouring countries such as Malaysia and Indonesia introduced chip and PIN cards some years ago, causing credit card fraud to plummet there but to increase in Thailand and now in Vietnam. It also appears that the vast majority of credit card fraudsters in Vietnam are from China, as it’s geographically easier to transfer the machines required to make fraudulent cards.
Magnetic cards versus chip cards
Magnetic stripe technology allowed for the card issuer to be contacted electronically, and the fundamental flaw of the system was the weakness in the authentication of the transaction. Worse, the magnetic stripe itself was particularly vulnerable to information theft as the cards could be easily cloned. Analysts believe that credit card fraud will continue until the magnetic stripe, which can also access account information, is phased out.
Meanwhile, chip-based card systems refer to the computer chip embedded in a smart card, and the PIN number that the customer must use to authenticate transactions. This generic term applies to any smart card technology based on the security standard known as EMV (Europay/MasterCard/Visa); the companies that originally developed the standard, in 1994. The major difference between chip cards and magnetic cards is in terms of security. Switching to chip-based cards offers better security compared with magnetic strip cards since it is difficult to duplicate encrypted data. The PIN requirement adds another layer of security, even if users lose the card. The benefits offered by chip cards clearly explains why chip-based technology is fast becoming the global standard for ATM card security, with chip cards now being the dominant card type for transactions in Europe and, increasingly, in Asia.
The migration from magnetic stripe to chip cards, in theory, will involve various stakeholders in the process. Firstly, banks will need to upgrade their system, with changes or upgrades depending upon the final chip specifications or technology adopted. They will also need to issue new cards to customers. Merchants and retailers will have to upgrade their POS to support the new chip card and consumers will need change their existing cards to the new chip-based cards.
The rising number of card-related crimes being detected again highlights that risk still hangs over consumers. Over the years, efforts have been made to encourage the switch from magnetic cards to chip cards, but local banks have been reluctant to take part in the process. “While banks around the world have switched to cards with embedded chips, making it very difficult to counterfeit, local banks haven’t completely adopted the technology,” said MK Smart’s Mr Ha. “It hasn’t happened here mainly because banks don’t know how to start, how to upgrade the system at low cost, or even how to work with organisations like Visa or MasterCard.”
Credit card networks like Visa and MasterCard said that despite the large initial spending, banks using chip cards will be able to avoid compensation payouts for card information theft while making their card services more reliable. The good news for consumers is that some banks are indeed moving to embrace chip credit cards. In the last couple of years banks such as HSBC, Citibank, Eximbank, Vietcombank, VIB, VPBank, Maritime Bank and SCB have developed MasterCard payment chip cards.
However, resources are tight for the majority of local banks, who fear it takes a lot to convert a system to EMV from magnetic stripe. The cost of making a magnetic card is $1 less than the cost of making a chip card, so with more than 60 million cards currently on the market, it would cost banks over $60 million, not including production, delivery, and activation cost. Besides, a switch in card system should go hand-in-hand with an upgrade of old ATMs. “Around 10 per cent of ATMs in the banking system cannot read chip cards and it is costly to buy new machines,” said a representative from the ATM Service Department at Vietcombank. This is why there is not enough motivation for banks to take on the shift to chip card.
Still, Mr Ha suggested that the State Bank of Vietnam build their own set of standards for ATM domestic chip cards, as he doesn’t think that following the EMV standards is necessary. “By doing this, the cost for an ATM chip card would be significantly lower and this is what Myanmar has been building for their soon-to-be-released ATM card system for enhanced security,” he said.
The largest local banks do have the ability to invest in upgrading card technology, but for smaller banks the better option is outsourcing, with low upfront costs and faster implementation. With the current size of Vietnamese banks, outsourcing appears to be more suitable, as small banks can outsource production depending on actual demand, which would not only help banks meet the goal of developing card users but also help avoiding the risk of self-investment.
For self-invested banks, Mr Ha suggested they consider a situation where the demands of the cards can surpass the system’s capacity if it doesn’t receive sufficient investment. “A system with no room for development will hinder and damage the card business,” he said. He added that outsourcing would save banks from having to invest in facilities, equipment, and personnel. More importantly, initial investment cost is low, and the system is scalable. “Banks only have to provide data, and will receive products promptly and they can therefore shift their focus to marketing and managing risk more effectively,” Mr Ha said.