Herald on Sunday editorial: No credit for card security

Photo / Richard Robinson

Card fraud is now big business. The victim may be in New Zealand; an offender may well be in Russia, Germany or Taiwan."Cash, they told us, was old hat. Paper money was an anachronism from another era, an idea whose time had passed.

New Zealand led the world in electronic banking: From 1979, banks began equipping us all with small, robust pieces of plastic that we believed would allow us to travel lighter, purchase whatever we wanted from afar, and laugh in the faces of thieves.

Yet, as it has turned out, these polyvinyl chloride acetate cards have proved as difficult to protect as their name is to pronounce.

Credit and debit card fraud is now big business.

It is hard to know the full extent of credit card fraud, because the banks are loath to disclose numbers lest it undermine public confidence in their security processes. The number of convictions has diminished over the past few years, but experts say that is simply because the fraudsters are getting smarter at covering their tracks, and are sometimes further removed from their crime. The victim may be in New Zealand; an offender may well be in Russia, Germany or Taiwan.

What is clear, though, is that there is much more we can do in New Zealand to protect ourselves.

Despite the ongoing problems with credit and debit card fraud, New Zealand banks and retailers have actually taken a step or two backwards in card security.

We reveal today (p12-13) that banks including New Zealand's biggest, ANZ, are still mailing or couriering out pre-activated credit cards - an irresistible temptation to light-fingered mailbox surfers. This is despite an assurance from ANZ, after a spate of mailbox thefts five years ago, that it would stop sending out pre-activated cards.

The bank indicated at the time that it was a toss-up between customer convenience ("avoiding the need to visit a branch to activate the card") and security. Customer research, ANZ said, had shown customers wanted the security - so why the subsequent u-turn?

ANZ won't say: "Our security team has asked that we not discuss our activation processes and we have to respect that," a spokesman said yesterday. "The person who committed this fraud is the bad guy. We're all victims here."

Adding to the trouble, banks and retailers have worked together to allow shoppers to make small card purchases without the "inconvenience" of having to enter their PIN or scrawl a signature. If, for instance, you buy a meal from one of the McDonald's restaurants, all you have to do is swipe your card and pick up your tray of burgers and fries. No PIN, no signature, no hassle - and no safeguards.

When signatures are required, anecdotal evidence suggests retail assistants and supermarket checkout operators take only the most cursory glance at the authorised signature on the back of the card, to check that the shopper is indeed the cardholder. It's almost seen as rude to check the signature, as if it might call the integrity of the customer into question.

The primary responsibility, though, must still fall on individuals to protect themselves from being ripped off. Obviously, keep your card safe; keep your PIN safe; take care using Eftpos terminals and ATMs; and take special care to make online purchases only through trusted secure payment providers.

ANZ is perfectly correct that the faceless fraudster is the bad guy. But the onus is on all of us - banks, retailers and card-holders - to take due care and not expose ourselves to added risk.