In 2007, in one of the largest recorded credit card frauds in history, the TJX group (which includes T.K. Maxx in the UK) discovered that the details of almost 46 million customers had been stolen from their servers in both the US and UK, made possible by issues in network security, then used to create dummy cards. Albert Gonzalez, the man behind these thefts was jailed in 2010 for 20 years for this and multiple other credit card frauds. Since the inception of the payment card countering fraud has been a driving force behind technological innovation in the area.
In the early 1900's, the most valued customers of US businesses were issued paper ID cards that they could present in place of immediate payment, enabling goods to be bought on a credit arrangement. Security went as far as recognising the person holding the paper. Fast forward to 1950 and cards from companies such as American Express were introduced, with features such as embossed printing added, all aimed at making the card harder to reproduce and hence more secure. Early patents for these innovations were very reliant on printing techniques, and to this day some of the largest related IP holders are linked to card printing. The growth in filing of credit card related patents since 1990 can be seen in figure 1, both in number of applications and as a fraction of all patent filings per year. These lines are on an overall upward trend, with a surge in filings in the early 2000s that is common to many technologies linked to communications and computing. After a brief dip, the level of filing has now risen even higher.
Inventions related to card security, such as holograms, Chip & PIN, network infrastructure, and cryptography methods don't necessarily originate from financially focused companies, other examples are electronics or printing businesses. Figure 2 shows a selection of such companies and the number of related patent families held. It can be seen that the two largest holders are both printing related companies responsible for printing credit cards. The largest patent holder, Dainippon Printing, were themselves victims of a massive security breach when in 2007 a former contractor stole 8.6 million records containing the personal data required to print the cards of customers of 43 of the company's clients. What is starting to emerge is a trend not for stealing the cards themselves, but fraud relying on stealing the data behind the cards.
So while printing companies dominate the number of related patents held, printing and on-card features form just one aspect of the system needed to enable payment function and fraud protection. Current technology that goes into providing card security can be split into the following categories:
- Card features – a combination of features such as embossed printing, card materials and holograms;
- Magnetic Strip – technologies that reference use of the strip on a card in order to hold necessary data;
- Network – electronic transmission and processing of related data;
- Chip – use of integrated chips for systems such as 'Chip & PIN';
- Authentication/Cryptography – patents describing a range of cryptographic processes specific to cards.
How these features have changed in importance over the last 25 years can be seen in figure 3 by looking at the proportion of filings per year that relate to one of the above categories.
Filings linked to card features and the magnetic strip have declined over the last 30 years, initially very drastically in the case of card features shortly before the emergence of Chip/PIN. Filings on network technologies and authentication have, by contrast risen. Chip patents and card features are maintaining a consistent proportional rate of filings, suggesting that while they are not as key as the network factors, they will still form an important part of the process for some time to come. The consistent decline of the magnetic strip looks set to continue and is unlikely to provide any new security advantages, kept purely for legacy compatibility reasons.
A key measure of a patent's influence is the number of citations it has received. The most highly cited patent within the field of credit card payments is Microsoft's "Electronic online commerce card with transaction proxy number for online transactions" from 1997, which reads not just on cards, but on electronic payments as a whole. Other highly cited patents include those describing on-card chips, biometric security, and online authentication, this shows that the IP behind the electronic infrastructure and transmission of transactions across a network underpins the most important technology aspects of today's credit card system. Figure 4 shows how some of the most cited patents (highlighted in red) compared against other patents from their application year.
The patents that are most highly cited come from technology areas that are important not just for credit cards, but also for most aspects of electronic payments, so seeing this level of influence is not unexpected. But if theft of data still occurs, as it almost certainly will on some scale, there needs to be other in-card security features in place to deal with it. So even though they do not appear among the most cited patents, this explains the continued filing of other categories, as seen in figure 3.
While the number of families held, as seen in figure 2, is an important indicator of a company's IP position, an alternative and potentially more revealing approach is to examine the number of citations for those patents. This identifies the level of technological influence that the patents hold. Figure 5 shows this data by plotting the total number of citations per year for those patents filed pre 2000 (x-axis), from 2000 to 2006 (y-axis) and 2007 onwards (bubble size). The colour of the bubbles in the figure gives an indication of how many related families are held by that company.
Here it can be seen that American Express, while only holding just over 100 related families have gone from a low-mid level of citation in pre 2000 citations, up to the highest for both 2000-6 and 2007+, this marks them out as a key influencer in credit card IP. The printing companies, both here seen with red bubbles, may have a large number of related families, but their influence is much less substantial than those numbers would otherwise suggest. First Data, a payment processing provider, stand out with well cited recent IP, and companies such as Microsoft and IBM dominate for older patents but are less influential for more recent filings.
Clearly some companies have strong influence within one area of security, e.g. Microsoft have a large number of patents within the networking area which gives them the influencial position seen from this citation analysis, but how do other companies with IP across multiple areas of card security compare? Figures 6 and 7 show how portfolio citations compare across some key technology areas, as well as the growth of related portfolio size over the last ten years.
As well as in the overall citation graph, American Express are strong across multiple categories despite lower filing numbers than Visa, who had a large jump in number of filings during the mid 2000s but have yet to establish as influential a citation position. The interesting category to note here is cryptography, where no stand-out leader in citation influence appears to exist. Given that this is perhaps the most important area of all for future development, cryptographic systems and authentication methods will likely form a key battleground in IP dominance within the credit card industry along with network technologies and contactless payments.
Filings relating to payments through contactless and mobile methods now cover 30% of credit card related patents, up from just 10% a decade ago. This is more than any other category, with that level of growth and coverage a sign it will form a large part of the next dominant payment system. However transition periods between technologies are often long and fraught with technical problems, and there will be large numbers of people who will likely never switch from their payment cards. Protecting these transactions remains key. Advances offering on-card authentication, biometric identification, multifactor authentication or even social media integration that provide enhanced security for the crossover between current cards and a contactless payment ecosystem will have real value for the foreseeable future.
Suggested Links
1 http://www.informationweek.com/shared/printableArticle.jhtml?articleID=198701100
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.