How Credit Cards Work

Have you ever stood behind someone in line at the store and watched him shuffle through a stack of what must be at least 10 credit cards? Consumers with this many cards are still in the minority, but experts say that the majority of U.S. citizens have at least one credit card -- and usually two or three. It's true that credit cards have become important sources of identification -- if you want to rent a car, for example, you really need a major credit card. And used wisely, a credit card can provide convenience and allow you to make purchases with nearly a month to pay for them before finance charges kick in.

That sounds good, in theory. But in reality, many consumers are unable to take advantage of these benefits because they carry a balance on their credit card from month to month, paying finance charges that can go up to a whopping 23 percent. Many find it hard to resist using the old "plastic" for impulse purchases or buying things they really can't afford. The numbers are striking: In 1999, American consumers charged about $1.2 trillion on their general-purpose credit cards.

Let's look at the credit card -- how it works both financially and technically, and we'll offer tips on how to shop for a credit card. (Experts say this should be a project on the scale of shopping for a car loan or mortgage!) We'll also describe the different credit-card plans available, talk about your credit history and how that might affect your card options, and discuss how to avoid credit-card fraud -- both online and in the real world.

Morgan Stanley Credit Card

A Bit of History

Let's start at the beginning. A credit card is a thin plastic card, usually 3-1/8 inches by 2-1/8 inches in size, that contains identification information such as a signature or picture, and authorizes the person named on it to charge purchases or services to his account -- charges for which he will be billed periodically. Today, the information on the card is read by automated teller machines (ATMs), store readers, and bank and Internet computers.

Timeline

According to the Encyclopedia Britannica, the use of credit cards originated in the United States during the 1920s, when individual companies, such as hotel chains and oil companies, began issuing them to customers for purchases made at those businesses. This use increased significantly after World War II.

The first universal credit card -- one that could be used at a variety of stores and businesses -- was introduced by Diners Club, Inc., in 1950. With this system, the credit-card company charged cardholders an annual fee and billed them on a monthly or yearly basis. Another major universal card -- "Don't leave home without it!" -- was established in 1958 by the American Express company.

Later came the bank credit-card system. Under this plan, the bank credits the account of the merchant as sales slips are received (this meant merchants were paid quickly -- something they loved!) and assembles charges to be billed to the cardholder at the end of the billing period. The cardholder, in turn, pays the bank either the entire balance or in monthly installments with interest (sometimes called carrying charges).

The first national bank plan was BankAmericard, which was started on a statewide basis in 1959 by the Bank of America in California. This system was licensed in other states starting in 1966, and was renamed Visa in 1976. Other major bank cards followed, including MasterCard, formerly Master Charge. In order to offer expanded services, such as meals and lodging, many smaller banks that earlier offered credit cards on a local or regional basis formed relationships with large national or international banks.

Now we know where credit cards began. Ever wonder what the numbers on your credit card mean? Let's find out!

The first digit in your credit-card number signifies the system:

• 3 - travel/entertainment cards (such as American Express and Diners Club)
• 4 - Visa
• 5 - MasterCard
• 6 - Discover Card

The structure of the card number varies by system. For example, American Express card numbers start with 37; Carte Blanche and Diners Club with 38.

• American Express
  Digits three and four are type and currency, digits five through 11 are the account number, digits 12 through 14 are the card number within the account and digit 15 is a check digit.
• Visa
  Digits two through six are the bank number, digits seven through 12 or seven through 15 are the account number and digit 13 or 16 is a check digit.
• MasterCard
  Digits two and three, two through four, two through five or two through six are the bank number (depending on whether digit two is a 1, 2, 3 or other). The digits after the bank number up through digit 15 are the account number, and digit 16 is a check digit.

The Stripe

The magstripe can be "written" because the tiny bar magnets can be magnetized in either a north or south pole direction. The magstripe on the back of the card is very similar to a piece of cassette tape (see How Cassette Tapes Work for details).

A magstripe reader (you may have seen one hooked to someone's PC at a bazaar or fair) can understand the information on the three-track stripe. If the ATM isn't accepting your card, your problem is probably either:

• A dirty or scratched magstripe
• An erased magstripe (The most common causes for erased magstripes are exposure to magnets, like the small ones used to hold notes and pictures on the refrigerator, and exposure to a store's electronic article surveillance (EAS) tag demagnetizer.)

Information on the Stripe

There are three tracks on the magstripe. Each track is about one-tenth of an inch wide. The ISO/IEC standard 7811, which is used by banks, specifies:

• Track one is 210 bits per inch (bpi), and holds 79 6-bit plus parity bit read-only characters.
• Track two is 75 bpi, and holds 40 4-bit plus parity bit characters.
• Track three is 210 bpi, and holds 107 4-bit plus parity bit characters.

Your credit card typically uses only tracks one and two. Track three is a read/write track (which includes an encrypted PIN, country code, currency units and amount authorized), but its usage is not standardized among banks. The information on track one is contained in two formats: A, which is reserved for proprietary use of the card issuer, and B, which includes the following:

• Start sentinel - one character
• Format code="B" - one character (alpha only)
• Primary account number - up to 19 characters
• Separator - one character
• Country code - three characters
• Name - two to 26 characters
• Separator - one character
• Expiration date or separator - four characters or one character
• Discretionary data - enough characters to fill out maximum record length (79 characters total)
• End sentinel - one character
• Longitudinal redundancy check (LRC) - one character
• LRC is a form of computed check character

The format for track two, developed by the banking industry, is as follows:

• Start sentinel - one character
• Primary account number - up to 19 characters
• Separator - one character
• Country code - three characters
• Expiration date or separator - four characters or one character
• Discretionary data - enough characters to fill out maximum record length (40 characters total)
• LRC - one character

Authentication

There are three basic methods for determining whether your credit card will pay for what you're charging:

• Merchants with few transactions each month do voice authentication using a touch-tone phone.
• Electronic data capture (EDC) magstripe-card swipe terminals are becoming more common -- so is swiping your own card at the checkout.
• Virtual terminals on the Internet

This is how it works: After you or the cashier swipes your credit card through a reader, the EDC software at the point-of-sale (POS) terminal dials a stored telephone number via a modem to call an acquirer. An acquirer is an organization that collects credit-authentication requests from merchants and provides the merchants with a payment guarantee.

When the acquirer company gets the credit-card authentication request, it checks the transaction for validity and the record on the magstripe for:

• Merchant ID
• Valid card number
• Expiration date
• Credit-card limit
• Card usage

Single dial-up transactions are processed at 1,200 to 2,400 bits per second (bps), while direct Internet attachment uses much higher speeds via this protocol. In this system, the cardholder enters a personal identification number (PIN) using a keypad.

The PIN is not on the card -- it is encrypted (hidden in code) in a database. (For example, before you get cash from an ATM, the ATM encrypts the PIN and sends it to the database to see if there is a match.) The PIN can be either in the bank's computers in an encrypted form (as a cipher) or encrypted on the card itself. The transformation used in this type of cryptography is called one-way. This means that it's easy to compute a cipher given the bank's key and the customer's PIN, but not computationally feasible to obtain the plain-text PIN from the cipher, even if the key is known. This feature was designed to protect the cardholder from being impersonated by someone who has access to the bank's computer files.

Likewise, the communications between the ATM and the bank's central computer are encrypted to prevent would-be thieves from tapping into the phone lines, recording the signals sent to the ATM to authorize the dispensing of cash and then feeding the same signals to the ATM to trick it into unauthorized dispensing of cash.

If this isn't enough protection to ease your mind, there are now cards that utilize even more security measures than your conventional credit card: Smart Cards.