STEVE INSKEEP, HOST:
It's MORNING EDITION from NPR News. I'm Steve Inskeep.
RENEE MONTAGNE, HOST:
And I'm Renee Montagne. Good morning.
Major data breaches at Target and Neiman Marcus have compromised the personal information of at least 70 million Americans. Analysts say even more consumers are at risk because the card-swiping technology Americans use is not hard to hack.
And as NPR's Elise Hu explains, a more secure payment method is already up and running in other countries, forcing the U.S. to play-catch up.
ELISE HU, BYLINE: Sophisticated cyber-thieves got so much consumer data by injecting a virus into Target's card payment terminals. From there, the bad guys systematically captured the information found on every card swiped, from Thanksgiving through just before Christmas.
AVIVAH LITAN: We've seen hacks as big as this before - in fact bigger. But what we haven't seen is something this sophisticated and well organized.
HU: Avivah Litan is a security analyst for Gartner, which retailers hire to assess their cyber security gaps. She says the magnetic stripes on the backs of our cards, which carry our data, are way too easy to exploit.
LITAN: It's totally unprotected and it's static, so it's the same data that's read every single time. It's just about the worst security you can put into a payment system.
HU: And you don't have to travel into the future to find a more secure, harder-to-hack payment system. You just have to leave the United States.
(SOUNDBITE OF DIAL TONES)
HU: So I called up a friend that you and I know well who just moved across the Atlantic.
(SOUNDBITE OF RINGING PHONE)
HU: Ari Shapiro is NPR's new London correspondent. When he left D.C., he took with him his American-issued credit cards - the ones with those magnetic stripes.
ARI SHAPIRO, BYLINE: I can't use the self check-out line at the supermarket. I can't use the automated machines in the subway system or the post office. Some merchants charge me an extra charge just because of my American credit card.
HU: That's because, as Litan explains, magnetic stripes are so outdated that most other countries have moved beyond it. They use cards with tiny gold or silver chips embedded on them that payment terminals can read. In Europe and elsewhere, it's called the chip and PIN system.
LITAN: It's standardized all over the world and used all over the world, except in the U.S. and perhaps one country in Africa.
HU: Chip-enabled cards are more secure because the data on the chips is hidden behind encryption. So even if criminals intercept what's on it, they can't re-use it. Ari's new British pal, Ben Thompson, explains how he pays for purchases without swiping or signing.
BEN THOMPSON: I put the card in the machine. The retailer - the cashier will hand me a little key pad. I'll type in my number and that verifies the transaction. It means I don't have to sign, don't have to use a pen. I literally type in four little numbers.
HU: Visa aims to get the majority of U.S. consumers on chip-based cards by 2015. But changing over all those cards and card readers costs a lot of money, which is part of the reason why it hasn't happened sooner.
Again, Avivah Litan.
LITAN: You have to upgrade all the terminals that are out there that are used by the merchants. You have to upgrade all the ATM machines. You have to issue new cards to consumers. So it's a lengthy process.
HU: Interestingly, Target actually tried to collaborate with Visa 10 years ago to use chip-cards in 1,000 stores. But executives shelved the effort over worries that chip-based cards slowed down checkout speeds.
MALLORY DUNCAN: It's going to take time. And it's going to be extraordinarily expensive. But it's going to be something we must do.
HU: That's Mallory Duncan of the National Retail Federation. He says fallout from the big breach is creating consensus around making chip and PIN the American standard sooner.
DUNCAN: If you start bringing out the new PIN and chip cards, then retailers will begin to reconfigure their point of sale equipment to accept those cards. Eventually everyone's going to have to make this change.
HU: The change will take at least a few years. So until mag-stripes go away, watch your credit card statements closely. And if you're moving or even traveling overseas, you can do as Ari did.
SHAPIRO: Well, I opened a British bank account and so now I actually have a chip and PIN card.
HU: Much safer than a magnetic stripe, and they work most everywhere else in the world you want to be.
Elise Hu, NPR News, Washington.