Magnetic Stripe Transaction

A magnetic stripe transaction is a card payment in which the payment terminal obtains the card details by reading the magnetic stripe on the back of the card, normally when the cardholder or cashier swipes the card through a slot. The terminal sends the data read from the stripe to the acquirer in an authorisation request, and the issuer approves or declines it. Magnetic stripe, or "magstripe", transactions were the standard way to pay by card in shops from the 1970s until chip cards spread, and they remain possible on many cards and terminals today.

Magnetic stripe transactions are a type of card-present transaction. They are contrasted with a chip transaction, in which the terminal communicates with the card's microchip, and with a contactless transaction. The rules for when a magstripe transaction is allowed, and who carries the loss if it turns out to be fraudulent, are set by the card networks.

The stripe holds data on up to three tracks, defined by international standards. Payment cards use tracks 1 and 2, which contain the card number, the expiry date, the cardholder's name on track 1, a service code, and discretionary data that includes a verification value, often called CVV1 or CVC1. This value is different from the three-digit code printed on the card that is used for online purchases.

When the card is swiped, the terminal reads the tracks and sends them in full to the acquirer, which forwards them through the network to the issuer. The issuer checks that the card number is valid, that the verification value matches, and that the account has funds or credit. Cardholder verification is usually by signature, although PIN is used for many debit cards, and the signature requirement has been dropped by the main networks in many regions.

The service code tells the terminal how the card should be used. A code indicating that the card has a chip instructs a chip-capable terminal to ask for the chip to be inserted instead of accepting the swipe.

The data on a magnetic stripe is static: the same information is sent every time the card is used. A criminal who copies it can write it onto another card and use the counterfeit at any terminal that accepts swipes. Copying is easy using a card skimming device hidden in an ATM, a fuel pump or a handheld reader used by a dishonest employee. Track data is classed as sensitive authentication data under card industry security rules and must not be stored after authorisation.

Chip cards solve this problem by generating a unique cryptogram for every transaction, so copied data cannot be replayed. That is why the move from magnetic stripe to EMV chip cards cut counterfeit fraud sharply in each country that adopted it.

To encourage chip adoption, card networks introduced liability shifts. Under these rules, if a counterfeit chip card is swiped at a terminal that could have read the chip but did not, the party with the less secure technology bears the fraud loss. Europe and many other regions moved to chip and PIN in the 2000s, while the United States liability shift for most face-to-face transactions took effect in October 2015. After the shift, magstripe fraud migrated to markets and channels that still accepted swipes.

When a chip card's chip cannot be read, the terminal may allow the card to be swiped instead. This is called a fallback transaction. Fallback is flagged in the authorisation message so that the issuer can apply extra scrutiny, because fraudsters sometimes damage chips deliberately to force a swipe. Many issuers decline fallback transactions above certain amounts or in high-risk locations.

Magnetic stripe transactions now make up a small share of card payments in most developed markets, where chip and contactless dominate. Networks have begun to phase the stripe out altogether. Mastercard, for example, has announced that newly issued cards in most regions will gradually stop needing a stripe and that stripes will eventually disappear from its cards entirely in the 2030s. Some terminals, such as older unattended machines, still rely on swiping, so the phase-out depends on replacing that equipment. Until then, issuers and acquirers continue to monitor magstripe activity as a signal of possible card fraud.