Chip & PIN technology makes it harder for criminals to clone payment cards. Each payment card contains a chip that authenticates the card as the original and incorporates special single-use data to prevent replay of old transactions. The cardholder inputs a personal identification number (PIN) to confirm he/she is the authorized user.
While Chip & PIN has proven to be reasonably effective in detecting fraudulent cards, it does not protect sensitive data after it is swiped or during transmission to the processor’s network. This provides the opportunity for the data to be accessed and compromised before the transaction is complete. This data, in turn, can be used to create magnetic stripe only cards or for transaction activity that does not require a card to be present to complete the transaction.
To implement Chip & PIN, card issuers must issue new cards manufactured with the integrated chip. Merchants must update their terminals and point-of-sale systems, and consumers have the added step of keying in their PIN at the point of sale. The need to encrypt the data retrieved at the point-of-sale system and in transmission still exists with Chip & PIN deployment.