Card, mobile credential, payment and security
Manufacturers try to rein in the supply chain, but is it in vain?
When it comes to securing the ID card printer supply chain, the process can be a lot like selling a car. Once a dealership sells a car to an individual, the dealer no longer has insight into whether the buyer sells that car to someone else.
“That’s the point where we lose visibility,” says Ryan Park, senior manager of product marketing for secure issuance for HID Global, which manufacturers the FARGO line of card printers.
For this reason, protecting printers and supplies is an ongoing challenge for manufacturers in the industry. Ultimately printers can end up on eBay or other online sites, where fraudsters can buy them to create fake driver licenses, campus IDs or credit cards with mag stripes. “At some point, you as a manufacturer lose control of the printers you sell,” Park says.
But there are measures manufacturers can take to reduce the chances that printers will end up in the wrong hands, or that if they do they won’t have the capabilities needed to replicate authentic cards. The key is working with authorized dealers, creating layers of security on cards to make them harder to reproduce and educating dealers and end users on how to safely get rid of unwanted printers, manufacturers say. There is also an initiative in the UK for law enforcement and printer companies to work together to prevent the cards and printers from falling into the wrong hands.
In protecting its printers, one of the first safeguards that card printer manufacturer Digital Identification Solutions (DIS) takes is making sure that the retailers its dealers hire are authorized by contract to sell the company’s products.
“What we’re looking for is when a dealer comes back to us and says a bid is being awarded to some company we haven’t even heard of,” says Jonathan Bowen, business development manager with DIS.
In the past, DIS has cautioned its end users about buying printers from unauthorized resellers. “You don’t know the age of those supplies, or how they’ve been stored and handled, and that puts us at risk,” Bowen says. “It’s not just about fraud for us; it’s about how we do business every day.”
Adding layers of security onto the actual card is key to protecting the printer supply chain, manufacturers say. That way even if a printer ends up being used fraudulently, the person would not have all the tools needed to add those security features and make a card that appears legitimate.
Holographic foils, special laminates and UV printing are examples of security features that can help prevent card duplication.
“An ID document, if well done, will have some exclusive security features that are not commercially available on the street,” says Benoit Guez, director of smart cards and new technology for card manufacturer CPI Card Group. “Those can be on the material of the plastic, the printing, the personalization and on the overlay protecting the personalization.”
Most of CPI’s cards start with white plastic on which the issuer prints cardholder information. That information is protected with a secure overlay that may contain a hologram or some other feature.
Some printers contain UV printer ribbons, so that when someone uses a UV black light to verify an ID, they can examine the card to make sure it contains certain security elements. This tends to be the case on driver licenses and national IDs.
“That’s a really easy-to-add security feature for the end user, but we had to have a way to secure it so UV ribbons wouldn’t end up everywhere on the market,” Bowen says.
To address this, DIS requires dealers who sell the special printer ribbons to sign an appendix to their contract, agreeing to a multi-step process in which they track every printer they sell to an end user. They must log the date the printer was sold and how many supplies went out. There is also a form the end user must sign.
Anytime a user prints with one of Digital ID’s UV panels, the MAC address of that specific printer is printed directly onto the card as a unique identifier. Without a black light, the number is invisible to the naked eye.
“Let’s say a counterpart of mine in Europe is going to use UV on the cards, and a year after selling that, they start finding there are fake national ID cards being sold for 2,500 euros. The cards look so legit that they actually have the printer number printed on it. We can go back and find out where the printer was sold (since) we’ve had these machines on the market,” Bowen says.
Manufacturers can also code their printer products to work only for the appropriate user. For instance, if the federal government purchased card printers from HID for a large installation, HID could encode the printers ribbons to work only with printers sold to the government client, Park says.
Printers being resold on sites such as eBay or craigslist are usually the real deal. “It’s just generally the older real deal,” Bowen says. Such printers may be five or six years old, or may be damaged and need some repair to become functional again.
Sometimes schools or other legitimate organizations purchase the used printers to create badges for students and employees. But this isn’t always the case.
“There are definitely printers out on eBay that someone who knows what they’re doing can buy and create realistic looking (fraudulent) badges,” Bowen says.
HID gives directions on how to properly dispose of old printers. However, much like auto dealers cannot control the resale of their cars, printer manufacturers cannot legally restrict suppliers in the U.S. and Canada from reselling printers online.
“We haven’t found a good recourse legally to prevent that,” Bowen says, adding that the only thing they’ve been able to do is offer trade-in values to pull those printers back in. “It’s a hard one to control for sure.”
That doesn’t stop the individual end users from implementing their own safeguards. Airports, government agencies and other entities where ID security is paramount often have their own systems in place for safely phasing out printers and supplies to ensure they do not go back into the market on eBay.
Within the Department of Defense, for example, there are only a few suppliers qualified to sell government-marked material, Park says, adding that a fraudster would actually have to buy a printer from one of those qualified vendors.
The rules can be different in the corporate world when companies are ready to unload their old printers. If a corporation wants a new printer to produce its employees’ ID badges, HID allows them to participate in a trade-in program within its dealer channel.
“Or you can throw it up on eBay, which may be why more often than not, you see printers for sale on the Internet,” Park says.
To some degree, dealers are on the honor system. “In the U.S. you may be able to trust, but there are parts of the world where bribes and kickbacks are an everyday part of life,” Bowen says.
Forged documents are easily detected by the trained eye. But an untrained individual wouldn’t know how to differentiate cards, which is why Guez says education is key in protecting the printer supply chain.
“People can scan a real card and try to change the name and photo, and then print it on plastic. And they usually miss all the security features. So a forged document is just a basic document, and that’s obvious to anyone who knows a little bit,” he says.
Requiring two or more forms of identification, such as a passport or birth certificate, can also help rule out fraudulent cards, he says.
Of course, not all fraudulent IDs are created using purchased or otherwise-obtained printers. Often, fake national IDs and driver licenses turn out to be cases of internal fraud where someone within the organization uses actual printers and supplies. “They’ve forged IDs that they issue on real machines in real offices in real time … when no one notices (they’re making) a fake ID,” Bowen says.
For now, taking precautions by adding security layers and educating and vetting printer dealers and users may be the only real recourse printer manufacturers have against fraudsters.
“In the end, I don’t think there’s a perfect way to prevent legitimate supplies from falling into the hands of illegitimate people,” Bowen says. “As we distribute legitimate supplies around the world, it takes constant vigilance to make sure these aren’t distributed into the wrong hands.”
