New inexpensive system to thwart credit card fraud

Researchers have developed an inexpensive, secure method to prevent mass credit card fraud using existing magnetic card readers.
Existing magnetic card readers use plain text to store confidential information so they are vulnerable to an untrusted card reader or skimming device.
The new technique, called SafePay, works by transforming disposable credit card information to electrical current and driving a magnetic card chip to simulate the behaviour of a physical magnetic card.
"Because SafePay is backward compatible with existing magnetic card readers, it will greatly relieve the burden of merchants in replacing card readers and at the same time protect cardholders from mass data breaches," said Yinzhi Cao, of the Lehigh University in US, who led the study.

SafePay is related to Cyber-Physical Systems (CPS), which are systems consisting of computational elements that control physical entities.
The computational elements in SafePay consist of a mobile device and a server which distributes disposable credit card numbers.

The physical entity is the magnetic credit card chip controlled by a mobile application inside a customer's mobile device.
To use SafePay, the user downloads and executes the mobile banking application which communicates with the bank server.
During transactions, the mobile application acquires disposable credit card numbers from the bank server, generates a wave file, plays the file to generate electrical current, and then drives the magnetic card chip via an audio jack or Bluetooth.

The critical elements that make SafePay unique is that the disposable credit card information expires after a limited time or number of usages so, even if the information is leaked, it cannot be used for future transactions.
A magnetic credit card chip makes it completely compatible with existing readers. Researchers found that the cost of the magnetic card chip is about USD 0.5, and could be even lower if manufactured in large scale.
Researchers conducted real-world experiments with the SafePay technology performing transactions with a vending machine, a gas station, and a university coffee shop.
During the experiments, they used a bank application, cell phone application, and magnetic credit card chip.

The disposable credit card information was acquired from ShopSafe by registering several disposable credit card numbers with Bank of America.
In all three scenarios, the SafePay method worked and the transactions were successful.