Magnetic Stripe

A magnetic stripe (also called a magstripe or swipe stripe) is the dark band on the back of a payment card that holds account data in magnetic form. Swiping the card through a reader passes the card number, expiry date and other data on for authorization. For decades it was the main way to read a card at a shop till or an automated teller machine (ATM).

The stripe stores static data: the same information is read every time, which makes it easy to copy. For that reason the industry has replaced it with the EMV chip and contactless payments, which produce a fresh code for each transaction. The layout of the stripe is set by ISO/IEC standards (notably ISO/IEC 7811 for recording and ISO/IEC 7813 for financial cards), while the card networks decide whether stripes must still be issued.

A magnetic stripe works much like an old cassette tape. Information is written as a pattern of tiny magnetised spots, and a reading head turns that pattern back into numbers when the stripe slides past it.

Because it is like a recording, anyone with the right equipment can copy it onto another blank card, just as a tape can be copied. That is the stripe's big weakness, and the reason why newer cards carry a chip that answers each payment with a fresh, one-off code instead of the same recording every time.

A payment card stripe has up to three tracks laid side by side:

• Track 1. Up to 79 alphanumeric characters, originally defined for the airline industry. It holds the primary account number (PAN), the cardholder's name, the expiry date, a three-digit service code and discretionary data.
• Track 2. Up to 40 numeric characters, originally defined by the American Bankers Association. It carries the PAN, expiry date, service code and discretionary data, and is the track most payment systems read.
• Track 3. Defined for read-write use, but rarely used on payment cards.

The discretionary data includes a verification value (often called CVV1 or CVC1) calculated by the card issuer from the card details and a secret key. It is different from the printed card verification value (CVV) used online, which is never stored on the stripe. The PIN is not stored on the stripe either. The service code tells the terminal, among other things, whether the card also has a chip, so a chip-capable terminal can refuse a swipe and ask for the chip instead.

Magnetic stripe cards were developed at IBM in the 1960s, and the technology was standardised for bank cards in the following decade. Swipe readers in each payment terminal, combined with online authorization over phone lines, made fast card acceptance possible and replaced the manual "imprinter" that pressed the card's embossed numbers onto carbon paper. Through the 1980s and 1990s the stripe became universal on credit cards, debit cards and ATM cards.

Europe moved to chip-and-PIN smart card technology from the late 1990s and 2000s (the UK completed its national rollout in 2006). The US moved later; the main liability shift for in-store card fraud took effect in October 2015, with a later date of April 2021 for automated fuel dispensers.

Because the stripe carries the same data at every swipe, it can be copied with a cheap reader and written onto a blank card. Criminals capture stripe data through card skimming devices hidden in ATMs, fuel pumps and tampered terminals, often combined with a hidden camera to record the PIN, and then use the copied cards where swiping is still accepted. This kind of counterfeiting was the main driver of the move to chip cards.

When a chip card is swiped at a chip-capable terminal, the terminal is normally told to use the chip. If the chip read fails and the terminal accepts a swipe instead ("fallback"), issuers treat the transaction as higher risk, and under card-network liability rules the party that did not support chip technology generally bears the cost of counterfeit fraud, usually through a chargeback. Issuers' fraud detection systems therefore watch fallback transactions closely.

In August 2021 Mastercard announced a timetable to retire the stripe from its credit and debit cards:

• From 2024, banks in most regions (including Europe, where chip use is near universal) no longer need to issue new cards with a stripe.
• From 2027, US chip cards no longer need a stripe.
• From 2029, no new Mastercard credit or debit cards are to carry a stripe, with an exception for some prepaid cards in the US and Canada.
• By 2033, no Mastercard credit or debit cards in circulation are expected to have one.

The schedule removes a requirement rather than banning stripes outright, and other networks set their own policies. Stripes remain common on hotel keys, loyalty and gift cards, and in markets where some ATMs and terminals still lack chip readers. Issuers planning stripe-free cards also need to check that their card's whole life, from card personalization to replacement under card lifecycle management, no longer depends on stripe data.

• EMVCo