We live in an age when so many members of Congress believe “government knows best.” That arrogance is on display in the United States Senate, where Illinois Senator Dick Durbin (D) is attempting to force consumers to use a four-digit PIN number when they use their credit cards.
Durbin has no experience in security. He is not a credit card expert. He does, however, have a deep political relationship with lobbyists from the big box stores who have been burned by cyber-criminals. They have filled his campaign coffers for decades. The corporations have had hundreds of millions of credit card numbers stolen off their servers.
Durbin is pushing his scheme, known as “Chip and PIN” despite vast evidence that in Europe, where a PIN number is often required, that fraud is growing as criminals have learned to exploit holes in the system. Ross Anderson, a professor of security engineering in the Computer Laboratory at the University of Cambridge, has determined that forcing consumers to use a PIN number has had little or no impact on criminals, who just devised new and innovative ways to steal credit card numbers.
You don’t have to be a computer scientist at Cambridge to figure out that a rudimentary computer program can figure out a four-digit PIN code in a few seconds. There are only 10,000 possible combinations!
So why would Durbin be pushing this scheme? The retailers, of course. Target was forced to pay its customers millions when their system was hacked following lawsuits and state probes by attorney generals from South Dakota to Massachusetts. Chip and PIN is their way of washing their hands of the problem.
It goes without saying, government is always a step behind the marketplace. Credit card companies have invested hundreds of millions of dollars in finding innovative and effective ways to protect their customers. Chip and PIN might be one solution, but it shouldn’t be the only one.
As we have seen from the adoption of ApplePay, tokenization, and other technologies, the experts are on the case. Government mandating one solution will create a roadmap for criminals and will push money away from other methods of security innovation.
