Protecting against Credit Card Forgery with Existing Magnetic Card Readers

Existing magnetic cards adopt plain text to store confidential information, thus being vulnerable to an untrusted credit card reader or a skimming device. To tackle the problem, researchers have proposed many solutions such as integrated circuit card (IC card) and mobile wallets applications [6, 9, 12, 20, 21]; however, none of them can support existing magnetic card readers thereby facing significant backward compatibility issue. In this paper, to combat such credit card information leakages and remain backward compatible, we propose a system adopting disposable credit card information that expires after one-time usage, as well as a magnetic card chip simulating the behavior of a physical magnetic card. The overall system consists of a bank server, a mobile application, and the magnetic card chip. The bank server distributes the disposable credit card information to the mobile application, which generates electrical current to the magnetic card chip via a microphone audio jack or Bluetooth. We have implemented a prototype system and evaluated it. In the evaluation, we show that the current cost for one clientside device is about $0.5 (not including the phone), which can be even lowered if manufactured in large scale. We also evaluated the correctness, scalability and robustness of the prototype.