question: Why do you have to *quickly* insert and remove a credit card from a card reader?
comment: Magnetic stripe readers work best when there is a strong, changing magnetic field passing over the read head. Removing the card fast helps ensure the speed of the card being removed is fairly consistent and generates a stronger magnetic field over the read head.
passages: 1-to-1 and 1-to-many are the two possible modes of operation of a biometric reader:
   Section::::Other reactions.:Function creep and unintended outcomes.
   Section::::Access control card reader.:Magnetic stripe.
   Section::::Access control card reader.:Wiegand card.
   BULLET::::- In the 1-to-1 mode a user must first either present an ID card or enter a PIN. The reader then looks up the template of the corresponding user in the database and compares it with the live scan. The 1-to-1 method is considered more secure and is generally faster as the reader needs to perform only one comparison. Most 1-to-1 biometric readers are "dual-technology" readers: they either have a built-in proximity, smart card or keypad reader, or they have an input for connecting an external card reader.
   The difference between the two types of smart cards is the manner with which the microprocessor on the card communicates with the outside world. A contact smart card has eight contact points, which must physically touch the contacts on the reader to convey information between them. Since contact cards must be inserted into readers carefully in the proper orientation, the speed and convenience of such a transaction is not acceptable for most access control applications. The use of contact smart cards as physical access control is limited mostly to parking applications when payment data is stored in card memory, and when the speed of transactions is not as important.
   Access cards themselves have proven vulnerable to sophisticated attacks. Enterprising hackers have built portable readers that capture the card number from a user's proximity card. The hacker simply walks by the user, reads the card, and then presents the number to a reader securing the door. This is possible because card numbers are sent in the clear, no encryption being used. To counter this, dual authentication methods, such as a card plus a PIN should always be used.
   Proximity card readers are still referred to as "Wiegand output readers", but no longer use the Wiegand effect. Proximity technology retains the Wiegand upstream data so that the new readers are compatible with old systems.
  
  Section::::Access control card reader.:Proximity card.
   Smart cards have also been the targets of security attacks. These attacks range from physical invasion of the card's electronics, to non-invasive attacks that exploit weaknesses in the card's software or hardware. The usual goal is to expose private encryption keys and then read and manipulate secure data such as funds. Once an attacker develops a non-invasive attack for a particular smart card model, he or she is typically able to perform the attack on other cards of that model in seconds, often using equipment that can be disguised as a normal smart card reader. While manufacturers may develop new card models with additional information security, it may be costly or inconvenient for users to upgrade vulnerable systems. Tamper-evident and audit features in a smart card system help manage the risks of compromised cards.
   Internet fraud may be by claiming a chargeback which is not justified ("friendly fraud"), or carried out by the use of credit card information which can be stolen in many ways, the simplest being copying information from retailers, either online or offline. Despite efforts to improve security for remote purchases using credit cards, security breaches are usually the result of poor practice by merchants. For example, a website that safely uses TLS to encrypt card data from a client may then email the data, unencrypted, from the webserver to the merchant; or the merchant may store unencrypted details in a way that allows them to be accessed over the Internet or by a rogue employee; unencrypted card details are always a security risk. Even encrypted data may be cracked.
   BULLET::::- Semi-intelligent readers: have all inputs and outputs necessary to control door hardware (lock, door contact, exit button), but do not make any access decisions. When a user presents a card or enters a PIN, the reader sends information to the main controller, and waits for its response. If the connection to the main controller is interrupted, such readers stop working, or function in a degraded mode. Usually semi-intelligent readers are connected to a control panel via an RS-485 bus. Examples of such readers are InfoProx Lite IPL200 by CEM Systems, and AP-510 by Apollo.
   BULLET::::- Protection of ATMs and banking assets against unauthorized usage
  
  BULLET::::- The protected area can also be monitored by the bank's CCTV system
  
  BULLET::::- Possibility to use CHIP identification (ex PASSCHIP ) to decrease the possibility of card skimming using the magnetic card identification
  
  By Governmental and Regulatory Bodies:
  
  BULLET::::- Enacting consumer protection laws related to card fraud
  
  BULLET::::- Performing regular examinations and risk assessments of credit card issuers
  
  BULLET::::- Publishing standards, guidance, and guidelines for protecting cardholder information and monitoring for fraudulent activity
   BULLET::::- Known WLAN AP outside the CDE: The organization has deployed WLAN APs outside the CDE. These WLAN APs are segmented from the CDE by a firewall. There are no known WLAN APs inside the CDE. In this scenario, three minimum scanning requirements (Sections 11.1, 11.4 and 12.9) of the PCI DSS apply.
   BULLET::::- Skimming (online attack that consists in reading the RFID chip without physical access to the document and without the holder's approval). Prior to reading the chip, the inspection system needs to know some data that is printed on the document (e.g. the MRZ) or a key that is known only to the holder (personal identification number (PIN)), which means he has willingly handed the document for inspection. While BAC works only with the MRZ, PACE allows using card access numbers (short keys printed on the document) and PINs.
   Before the computerization of credit card systems in America, using a credit card to pay at a merchant was significantly more complicated than it is today. Each time a consumer wanted to use a credit card, the merchant would have to call their bank, who in turn had to call the credit card company, which then had to have an employee manually look up the customer's name and credit balance. This system was computerized in 1973 under the leadership of Dee Hock, the first CEO of Visa, allowing transaction time to decrease substantially to less than one minute. However, until always-connected payment terminals became ubiquitous at the beginning of the 21st century, it was common for a merchant to accept a charge, especially below a threshold value or from a known and trusted customer, without verifying it by phone. Books with lists of stolen card numbers were distributed to merchants who were supposed in any case to check cards against the list before accepting them, as well as verifying the signature on the charge slip against that on the card. Merchants who failed to take the time to follow the proper verification procedures were liable for fraudulent charges, but because of the cumbersome nature of the procedures, merchants would often simply skip some or all of them and assume the risk for smaller transactions.
   BULLET::::- In the 1-to-many mode a user presents biometric data such as a fingerprint or retina scan and the reader then compares the live scan to all the templates stored in the memory. This method is preferred by most end-users, because it eliminates the need to carry ID cards or use PINs. On the other hand, this method is slower, because the reader may have to perform thousands of comparison operations until it finds the match. An important technical characteristic of a 1-to-many reader is the number of comparisons that can be performed in one second, which is considered the maximum time that users can wait at a door without noticing a delay. Currently most 1-to-many readers are capable of performing 2,000–3,000 matching operations per second.
   Stolen cards can be reported quickly by cardholders, but a compromised account can be hoarded by a thief for weeks or months before any fraudulent use, making it difficult to identify the source of the compromise. The cardholder may not discover fraudulent use until receiving a billing statement, which may be delivered infrequently. For smaller amounts (e.g $100 or €100) many won't notice anything. Cardholders can mitigate this fraud risk by checking their account frequently to ensure constant awareness in case there are any suspicious, unknown transactions or activities.
  
  Section::::Stolen cards.
   A cleaning card for a motorized card reader will need a magnetic stripe built into it to activate the acceptance shutter.
  
  Section::::Area of application.:Cleaning of check and document scanners.
   BULLET::::- The first code, called CVC1 or CVV1, is encoded on track two of the magnetic stripe of the card and used for card present transactions. The purpose of the code is to verify that a payment card is actually in the hand of the merchant. This code is automatically retrieved when the magnetic stripe of a card is read (swiped) on a point-of-sale (card present) device and is verified by the issuer. A limitation is that if the entire card has been duplicated and the magnetic stripe copied, then the code is still valid. (See credit card fraud § skimming.)
   Section::::Part 1: Basic principles and requirements for PINs in card-based systems.:Smart card readers.
  
  A PIN may be stored in a secure smart card, and verified offline by that card. The PIN entry device and the reader used for the card that will verify the PIN may be integrated into a single physically secure unit, but they do not need to be.
  
  Additional requirements that apply to smart card readers include:
  
  BULLET::::- The card reader should be constructed in such a way as to prevent someone monitoring the communications to the card by inserting a monitoring device into the card slot.
   Access control card readers are used in physical security systems to read a credential that allows access through access control points, typically a locked door. An access control reader can be a magnetic stripe reader, a bar code reader, a proximity reader, a smart card reader, or a biometric reader.
  
  Access control readers are classified by functions they are able to perform and by identification technology:
  
  Section::::Access control card reader.:Barcode.
   Section::::Common problems.
  
  The ICC is fragile and regular wear can make the card unusable. Older cards tended to de-laminate with repeated insertion/removal from readers, but this problem appears to be less significant with the newer (PIV-compliant) cards. Also, the gold contacts on the ICC can become dirty and require cleaning with either solvents or a rubber pencil eraser.
   BULLET::::- A "read-lock" does not block an intended "read" by another transaction. The respective "read-lock" for the intended read is acquired (shared with the previous read) immediately after the intended read is requested, and then the intended read itself takes place.
   Motorized readers are built in, for example ATMs. The credit/debit-card is inserted into the card slot, where the first magnetic head is placed. If a magnetic stripe can be recognized, a shutter will be opened and the card will be transported to the second magnetic head by roles. The card is read, thereby the device knows whether the transaction goes over the micro chip or the magnetic stripe. If no micro chip is placed on the card, the transaction goes directly above the magnetic head. If the data gives the order for a transaction over the micro chip, the card is placed on the chip reading contact and is stopped. The chip contacts, are fitted on the chip and now the transaction begins. If the reading of the magnetic stripe respectively by the micro chip is not possible, the card will be declined.
   The cleaning card is not only cleaning the reading area of the magnetic head which is cleared. There is also a cleaning process within the device along the card path. The cleaning in these high dirt build-up areas is especially important and ensures efficient cleaning of the card reader.
  
  Section::::Area of application.:Cleaning of chip reading contacts.
  