But this is good news.
We don't have the chip.
You don't have the chip?
No.
[INAUDIBLE]
OK.
Can we keep trying to buy $1 worth of something from you?
Yeah.
We're going to keep trying to erase it
with bigger and bigger magnets.
So we want to then try to swipe it.
But we needed to find somebody that only use the swipe
and not the chip, which is nobody,
except the farmer's market.
So you're our guy.
So we're going to get our magnets and we'll be back.
My friends, Dan, Jabril, and I went
around San Diego with the goal of testing
what size magnet will erase the swipey part, the mag
stripe on a credit card by trying to pay someone $1
over and over, and then touching bigger and bigger magnets
to the credit card in between tests.
So we're going to do the little one first.
DAN: I think that's wise.
DIANA: You can't even see it.
It's so small.
DAN: First I'm going to go like that.
DIANA: Does it feel like it's pulling at all?
DAN: It sticks to my finger more than the card.
DIANA: Yeah.
Interesting.
CASHIER: I hit cash.
DIANA: No way!
CASHIER: Card not charged.
It went straight through.
DIANA: Look at this magnet.
Holy Jesus.
That's it.
Oh my god.
Just a little scratch.
That's what we erased the credit card with.
Oh my god that's amazing.
Hey, I'm Diana.
You're watching Physics Girl.
Just got back from a vacation in Hawaii visiting my parents.
Can you tell?
The relevant intro to this video is that everything in Hawaii
is like 10 years behind, all kinds
of things, like credit card technology--
every shop and vendor says no chip here yet.
Mahalo.
The chip thing got me thinking about mag stripes,
because, one, they're going away-- well everywhere
but Hawaii it seems-- which means that soon
they're going to become a fascinating relic of the past.
But it also means that there's probably
a security concern about that.
So we'll get into that.
Two, you can hack and mimic them,
which we're going to talk about with a friend of mine who's
a hacker.
And three, you can erase them.
I can't believe that tiny--
you didn't even-- you just couldn't like [HUMMING]..
The reason I was so shook is because I keep my credit cards
in a case that has magnets in it,
magnets that are much stronger than the tiny, little, itty,
bitty magnet that erased my credit card.
So why don't these erase my credit cards?
So our next test at the farmer's market
was to use this giant magnet.
Hold on.
Oh, no.
Our next test was to use this giant magnet
at different distances.
But before I show you what happened,
let's find out what we did to the credit card
with the little magnet and learn a little bit
about how to hack credit cards.
Ah, I just drove all the way up to LA to meet with my friend
Sammy Kamkar, well-known to the hacker community.
Well, yeah there was that whole Myspace thing.
But Sammy made something that is going
to be really interesting for us to unravel this whole mag
stripe mystery.
Sammy, I erased my credit cards today.
SAMMY: You erased them?
Yes.
SAMMY: Is that a good thing or a bad thing?
[INAUDIBLE] exciting.
It's crazy.
[LAUGHTER]
SAMMY: Yay!
We should look at the data on it.
DIANA: Yeah.
Oh, yeah!
SAMMY: All right so this is black iron oxide.
DIANA: Which is like rust.
So don't eat it.
DIANA: Was that a question?
I had to learn that the hard way.
I want to know what was actually on a mag stripe.
And the internet said it's magnetic.
And I thought, well what if I get really
small iron particles rather than big.
And that's what this is.
So using one of my credit cards this is what you get.
If you actually see those tiny, dark and thin lines,
we can convert those straight into the credit card number.
My name is on their, expiration date.
All of that data is in those bits.
Now these are the credit cards that you wiped earlier today.
So I don't really see anything on here.
DIANA: Ooh, yeah.
No, look.
There's the swirls with the lines in between.
Do you see--
[INTERPOSING VOICES]
SAMMY: You're right.
There are those tiny lines.
Actually, here--
DIANA: That's actually really cool.
SAMMY: So actually, those are bits of data.
And you missed a spot.
DIANA: I know.
[LAUGHTER]
This whole process inspired us to try erasing the credit card
while it has iron powder on it to see
what it looks like for a credit card to be erased.
How about this for visualizing some invisible physics?
SAMMY: What we can do now is, we can grab one of these cards.
And we can actually see what the computer says.
This is a mag stripe reader slash writer.
DIANA: Why do you have these things?
Research.
I can swipe my credit card here, and then we'll see data here.
That's my name.
It's my credit card number, the wild people.
But we can now use the magSpoof device.
Let me grab that.
DIANA: What is the max booth?
Can you just--
What is magSpoof?
I saw the lines and like-- oh, that's data.
And that's when I was like, I need
to understand how these work.
Can I make one?
Can I make a credit card?
So I made a device where you push a button,
and you're not even touching the reader,
and it sends your credit card number or someone else's credit
card number, depending on--
I don't condone that.
DIANA: No.
Of course not.
Sammy's magSpoof is different from contactless credit cards,
because it's emulating the mag stripe technology specifically,
which is important because there's other data unencrypted
and stored on your mag stripe, like your credit card
number, your name, whether you need
to use the chip rather than the mag strip,
whether this is a credit card versus a debit card.
And with magSpoof you can change this info.
So you could use a credit card where you're not
supposed to, like at an ATM.
So this is the second version.
I'll turn this on.
Dongle life.
DIANA: [LAUGHING]
Take magSpoof--
DIANA: This reader is only made to be used as a swipe.
Authorizing, processing--
DIANA: Yes!
Please sign here.
DIANA: Did you just pay yourself?
Approved!
Transaction complete!
I think I can keep like 97% of that.
When you're swiping there's just a read head
and a reader that's saying, 0, 1, 0, 0, 0, 1, 1.
Really it's like north, south, north, south, north, north,
south, south.
So I was just producing that same physical phenomena,
but through an electromagnet rather than permanent magnets.
DIANA: This is the original?
SAMMY: Yeah.
So that was the original, original.
So when the current goes through the coil
it produces the electromagnetic force.
And then if you reverse the current,
the reverse field is produced.
And then I went to Target and I bought something
with the max booth and was like, oh my god, this is amazing.
DIANA: Sammy has an excellent video on his channel
that goes into detail about the magSpoof
and how he made it, if you want to check that out.
I'll put a link in the description.
So the fact that Sammy is able to create magSpoof
and you could program anybody's credit card number on this,
and change the data so that you can use the credit
card in a way you're not supposed to,
makes me wonder how other credit card
technologies are different.
How are they more secure?
So we're going to talk to a scientist from the company,
Square, about that.
But first, we're going to go back to the farmer's market
with this.
Dan, this is brilliant.
So we're just going to put a stack of these,
throw the magnet over it.
And then-- I don't know.
Keep having it or something?
DAN: Yeah.
That seems fair.
DIANA: We decided to use small sheets of paper, like a ruler,
to keep track of how close the magnet was to the credit card.
And then we measured the thickness of the paper
is later.
DAN: 10 units of--
DIANA: 9, 10, 11--
I wonder if my credit card company is going to be like,
10 times by the same vendor?
[INTERPOSING VOICES]
That's roasted red peppers.
[INAUDIBLE] 9 in a row--
Oh, look at that.
Oh, man, that's crazy.
Look how close that is.
That's not that thick.
Six cards.
[INTERPOSING VOICES]
Nothing?
Not even a charge read.
Oh, man.
It must be done
[INTERPOSING VOICES]
It's not even getting the error [INAUDIBLE]..
Nothing.
OK.
Interesting.
[INTERPOSING VOICES]
That's awesome.
That's cool.
After this experiment, we measured the thickness
of the cards and found that the difference between six
and eight cards is the difference between 1.3
and 1.9 millimeters away from the credit card.
Super small difference.
And then we figured out how strong the magnetic field
was of this magnet at those distances,
thanks to a neat little tool on the K and J Magnetics website
where I got this magnet.
I figured out that the field was between 5,400 and 6,000 gauss.
To put that in perspective, that's around 10,000 times
stronger the Earth's magnetic field.
But other types of mag stripes on hotel key cards
are much weaker.
So they can be reprogrammed and reused.
In fact, I have to erased those with my wallet.
But what's important to note here
is that the thickness of even a piece of leather that's
three millimeters thick can make the difference of 3,000 gauss.
So you can prevent your credit card
from being erased by keeping the magnet just
a little bit further away, because the magnetic field
decays--
as we say-- very quickly with distance.
Luckily, most people nowadays are
using chips, which is the last thing
that I want to talk about.
Why did chips become a thing?
Is it because of the security or the eraseability of mag strips?
My name is Casey Wessel.
I work as a hardware engineer at Square.
So for mag stripe, the concern is
that someone could insert a skimmer into the payment
terminal itself.
Skimmers are really easy to make.
They're also very inexpensive.
And you probably heard stories of people inserting them
into gas stations and things like that.
That data is never changing.
So if an attacker is able to extract that data,
they can easily clone it onto a new card.
The chip has a microprocessor on the card,
and it's sending different data every time
it does a transaction.
The chip is constantly changing the information
it's sending between the chip and the point of sale.
So this makes it really hard for an attacker
to isolate that information.
So if an attacker were to insert something
into the terminal itself and they did intercept
that information, it's not useful
for them to replicate onto a new card
or to try to do another transaction.
They'd actually have to do surgery on the chip itself.
That can require a lot of expertise
and also cost a lot of money.
It costs more than a million for that sort of equipment.
We're constantly trying to encourage sellers to move over
to chip payments and contactless payments,
because they are more secure.
So there you have it.
Even tiny little magnets can erase credit cards.
But it all has to do with how close the magnet is.
But there's a lot of security concerns with mag stripes
anyway.
So subscribe if you want.
More explorations of everyday physics things
and thank you to Sammy and Dan and Casey and Jabril.
And thank you for checking out this video.
And happy physicsing.
[MUSIC PLAYING]