Why does my debit card have a stripe AND a chip?
Details depend on bank, card type and country, so they vary quite a lot, but the generic model is the following:
- The magnetic stripe contains, mostly, a computer-readable copy of the information embossed on the card: account number, holder name, expiration date.
- The chip contains a secret key which is used to "sign" (not necessarily a true signature; often a MAC) transactions.
- The chip knows the PIN code and refuses to work until the PIN code has been presented; it also locks itself if too many wrong PIN codes are presented.
When a payment terminal uses the magnetic strip, it must talk to the bank, establish a secure tunnel with the bank, send the PIN code entered by the user, and verify that the owner's account has enough money on it.
On the other hand, when a payment terminal uses the chip, the PIN code is sent to the chip only, and there is little need to talk to the bank at all. The whole transaction can be conducted offline. Of course, for big amounts, it is still a good idea to talk to the bank to know whether that much money exists on the buyer's account, but small transactions can be done efficiently with no network at all.
Thus, the magnetic stripe and the chip are used in two different ways, and having both does not mean that the security is lowered to the security of the weaker of the two. From the bank point of view, chips are better, because they are more efficient (no need to handle a network call) and harder to clone (statistics show a fraud rate divided by about 10). This is often translated into financial advantages granted to merchants who switch to chip-aware terminals.
There can be variants in all of the above. For instance, some card include in the magnetic stripe an encrypted version of the PIN code -- but it won't be verified in the payment terminal. Instead, the terminal will have to talk to a regional bunkerized server who knows the decryption key and can do the verification. For some other card types, it is pretty clear that the magnetic stripe does not know anything about the PIN code, e.g. the chip-less American Express cards (from a few years ago) where you could change your PIN code by phoning your bank.
In any case, all the security features of a debit or credit card are not meant to protect you. They protect the bank. From the point of view of the bank, you are the enemy (regardless of what they claim in their ads).
It is a question of liability:
- If a merchant uses chip & pin, and the transaction turns out to be fraud, the card issuer pays for the fraud (assuming the merchant has not been negligent).
- If a merchant uses the magnetic stripe, and the transaction turns out to be fraud, the merchant pays for the fraud.
When chip & pin was first introduced, in theory a merchant could have made a business decision not to pay for the new card terminals, and just to accept the fraud liability. In practice, everyone decided to move to chip & pin, which is exactly what the card schemes wanted.