From carbon copies to chips: how card payments were made safer, one fix at a time

Look closely at a payment card and you are looking at a history of fraud. The chip, the security code on the back, the hologram that some cards still carry, the text message asking you to confirm a payment: each was added because something earlier stopped being enough. Every security feature on a card is a scar from a fraud that worked well enough to be noticed.

This long read follows those layers in roughly the order they arrived. Dates in payment history are often approximate, and practices differed between countries, so treat the timeline as a sketch.

The imprint and the carbon slip

For decades, a card payment meant paper. The clerk placed the card in an imprinter, a small machine nicknamed the "knuckle buster", laid a multi-part slip over it and slid a roller across. The embossed numbers pressed through carbon paper onto each copy: one for the customer, one for the merchant, one for the bank.

The system was simple and worked without electricity. Its weaknesses were obvious once criminals looked: anyone with a stolen card could imprint slips, and the discarded carbon sheets themselves carried the full card number.

Floor limits and warning bulletins

To limit losses, card companies set floor limits: amounts below which a merchant could accept a card without checking. Above the limit, the merchant phoned for approval.

Below the limit, the main defense was a printed list of bad card numbers, distributed to merchants and updated regularly. A clerk could look up a card in the booklet before accepting it. The list was always out of date, and a criminal with a freshly stolen card had a window before it appeared.

Phone authorization

Calling for approval was the first form of real-time authorization. The merchant gave the card number and amount to an operator, who checked the account and read back an approval code. It was slow and expensive, so it was used only for larger purchases. But it introduced the idea that the issuer should decide each payment as it happened.

The magnetic stripe

The magnetic stripe, developed in the 1960s and standardized for cards over the following decade, put the card's data in a machine-readable form. Electronic terminals could read the stripe, dial out to the network, and receive an approval in seconds. Floor limits fell, and authorization became routine.

The stripe had a weakness that took years to become severe: its data was static. Anyone who could read it could copy it onto another card. Skimming devices hidden in terminals and cash machines turned this into a large-scale fraud.

The security code

As telephone and mail orders grew, and later online shopping, card numbers alone became valuable to criminals. The three- or four-digit security code printed on cards was introduced as an extra check for payments without the card present. Because merchants are not supposed to store it, a breach of stored card numbers should not expose it.

Online payments still rely on it today, alongside newer checks that came later.

The chip

The chip answered the stripe's weakness. A chip card contains a tiny computer that can generate a unique code for each transaction, so copying the data from one payment does not let you make another. Chip cards spread in some European countries in the 1990s, and an international chip standard, agreed among major card companies, was adopted widely in the following decades. Some countries adopted chips much later than others.

Where chips became standard, counterfeit card fraud at physical terminals fell sharply, and fraud shifted toward online payments, where the chip cannot help.

The PIN and the signature

Alongside chips came a change in how cardholders proved they were the owner. Signatures were easy to forge and rarely checked. Many countries moved to PINs, which a thief would not know. Others kept signatures longer or dropped verification for small amounts. Contactless payments now skip verification below a limit, trading a small risk for speed.

Contactless and tokens

Contactless cards and phone wallets use the same idea as chips, a unique code for each payment, over a short-range radio link. Phone wallets add tokens, replacing the card number itself with a stand-in that is useless anywhere else.

Online: codes and confirmation

For online payments, the newest layer is confirmation with the issuer itself. Protocols such as 3-D Secure let the issuer ask you to approve a payment in your banking app or with a one-time code. In some regions, laws now require this kind of strong authentication for many online payments.

The pattern repeats: the card number alone was not enough, so a second factor, something you have or something you are, was added.

What the layers teach

Looking back, a few lessons stand out:

• Static secrets get copied. Embossed numbers, stripes and printed codes were all eventually stolen at scale.
• Fraud moves to the weakest channel. When chips closed physical fraud, criminals moved online.
• Each fix adds friction. PINs, codes and confirmations all cost a little time.
• No layer is final. Every defense has eventually been tested.

The newest layers in our own corner

Our cards are virtual, so they skip the physical history entirely. Their protection is the online layer: details stored encrypted, shown only after a fresh code from the holder's authenticator app, for a short time, with each view logged. The account behind them requires a second sign-in step that cannot be switched off. The process page shows where those steps sit. It is the same lesson the charge plate era learned in the first charge plates: identification is the problem, and it never stays solved.

Holograms and signature panels

Not every layer was electronic. In the 1980s, many cards gained holograms, which were hard to reproduce with the equipment of the time and made counterfeit plastic easier to spot. Signature panels, special inks and fine background patterns served the same purpose, much like the security features on banknotes. As fraud moved from fake plastic to copied data, these visible features mattered less, and some newer card designs have dropped them.

Questions people ask

Why do some cards still have magnetic stripes?

For compatibility with older terminals in some places. Many issuers are phasing them out.

Is contactless less secure than chip and PIN?

It uses similar one-time codes, but skips the PIN for small amounts. Limits keep the risk small.

Why do I have to confirm some online payments in my bank app?

That is strong authentication, often through 3-D Secure, added to protect online payments where the card is not present.