Credit cards with radio tags speed purchases but track customers, too

A new microchip technology could soon replace the magnetic strips on the back of your credit cards and then replace the cards themselves.

Already, 20 million Americans have credit or debit cards that contain radio frequency identification technology chips, or RFID chips. These chips let a cardholder make a purchase by waving the card in front of a contactless card reader, instead of sliding the card through a magnetic reader or handing it to a sales clerk.

Now cellphone makers like Finland's Nokia Corp. are building the chips into their phones. That could transform the cellphone into a universal payment device that could supplant the credit card altogether.

``Some people will say, instead of having five credit cards, I'll have them all in one phone," said Gerhard Romen, Nokia's head of global market development.

The prospect appeals to many merchants, who hope that the new system will let them ring up sales more quickly and securely than with today's credit cards or with cash.

But not everyone is convinced. Bank of America Corp.'s MBNA subsidiary is issuing chip-based cards as part of its affinity program with National Football League teams like the New England Patriots.

``We are in test mode," said card payments technology executive David Turner. ``We have not decided to deploy it on all of our cards."

Turner worries that many merchants will stick with today's magnetic strip readers, rather than buy new RFID readers, which cost around $100 each.

In addition, some privacy advocates fear that criminals could steal someone's personal data simply by scanning the person with a chip reader.

``There's been quite a few demonstrations of vulnerabilities in RFID technology," said Mike Aiello, an information security specialist for a New York City investment bank. Aiello has launched a business called DIFRWear, which makes wallets that block RFID signals to prevent unauthorized viewing of credit card data.

Vendors of contactless credit cards say that the data on their RFID chips is encrypted. Even if it is intercepted, the thief would merely receive useless gibberish. Besides, credit card companies generally hold customers blameless when their cards are used fraudulently.

Still, privacy advocate Liz McIntyre, coauthor of the book ``Spychips," said she's worried about how merchants could use the contactless payment technology. ``You can be tracked through these devices," McIntyre said.

For example, she worries that merchants might set up RFID chip readers in the doorways of their stores, to alert them whenever a customer enters, even if he doesn't buy anything. The devices allow others to monitor an individual's purchases and behavior, ``and is that what we really want?" McIntyre said.

Since deployment began last year, about 150,000 such terminals have been installed nationwide, said Will Valentine, spokesman for credit card issuer Visa USA, the American branch of Visa International Service Association. ``This has been the fastest acceptance of new payment technology in the history of the industry," Valentine said.

Some of the nation's biggest merchants -- including McDonald's, 7-Eleven, KFC, and Walgreens -- have begun to accept contactless payment cards. One of New England's largest banks, Citizens Financial Group's Citizens Bank, began issuing the new cards to its customers in June.

The chip inside each card is activated by radio waves from a card reader. These readers use a very weak signal, so that the card must be about an inch away for the system to work.

Remy de Tonnac -- president of Inside Contactless, a French firm that makes RFID credit card chips -- said that his company's chips will only respond to signals from a legitimate reader operated by a retailer or bank. Any unauthorized attempt to read the data will be ignored, he said.

Users will also have to enter a code number, like the PIN used with today's debit cards, but only if the purchase is worth more than $25.

Contactless executive vice president Charles Walton said that the two biggest credit card networks, Visa and MasterCard, will let users of RFID cards make smaller purchases with just a wave of the card.

``They're basically saying the risk for small purchases" is worth it, Walton said.

Jane Cloninger, director of Edgar, Dunn & Co., a technology research firm in San Francisco, said that merchants could improve their profits and their security by replacing cash with contactless transactions.

By using a RFID chip to make payments, ``you're not fumbling around looking for your card or for change," Cloninger said.

That makes for faster service in the checkout line and could increase the total number of customers served per day.

In addition, retailers will have less cash on hand to tempt thieves. And they will eliminate the danger of dishonest employees copying a customer's credit card number, because store workers would never touch the card or see the data it contains.

Hiawatha Bray can be reached at bray@globe.com.