1 00:00:02,520 --> 00:00:05,360 You might not think about it very often, 2 00:00:05,360 --> 00:00:09,320 but we are living through a golden age of technology. 3 00:00:09,320 --> 00:00:14,240 Our homes and our pockets are full of inventions and gadgets 4 00:00:14,240 --> 00:00:17,200 that 20 years ago would have been the stuff of science fiction. 5 00:00:17,200 --> 00:00:20,680 Alexa, how exactly do you work? 6 00:00:20,680 --> 00:00:23,840 Hmm, I don't know that. That's what we're going to find out. 7 00:00:23,840 --> 00:00:27,920 These things have become such an integral part of our everyday lives 8 00:00:27,920 --> 00:00:31,200 that we've forgotten to remember how clever they are. 9 00:00:31,200 --> 00:00:35,280 I'm Professor Hannah Fry, and I want to open your eyes... 10 00:00:35,280 --> 00:00:37,040 I'm having a great time! 11 00:00:37,040 --> 00:00:40,000 ..to the secret genius of everyday objects. 12 00:00:41,400 --> 00:00:46,240 The ones that we take for granted, items that owe their existence 13 00:00:46,240 --> 00:00:49,120 to generations of scientific innovation. 14 00:00:49,120 --> 00:00:51,680 The Edison drove an electric car? 15 00:00:51,680 --> 00:00:52,720 Yeah, this one. 16 00:00:53,840 --> 00:00:55,080 In every episode, 17 00:00:56,200 --> 00:01:01,000 I'm going to take one item and tear it apart, bit... 18 00:01:02,920 --> 00:01:04,240 ..by bit. 19 00:01:04,240 --> 00:01:06,400 So now there's some stuff you can see. 20 00:01:06,400 --> 00:01:08,080 Meet the people behind it... 21 00:01:08,080 --> 00:01:10,280 Frankly, I thought many things were impossible. 22 00:01:10,280 --> 00:01:11,920 ..and unlock the remarkable... 23 00:01:11,920 --> 00:01:14,920 Here is the clandestine listening device. 24 00:01:14,920 --> 00:01:19,760 ..and sometimes hilarious stories behind its invention. 25 00:01:19,760 --> 00:01:21,240 Hello. Look at you! 26 00:01:24,880 --> 00:01:27,760 This time, it's the bank card. 27 00:01:29,560 --> 00:01:31,880 How much attention have you actually paid to this object 28 00:01:31,880 --> 00:01:34,440 that you carry around with you all of the time? 29 00:01:34,440 --> 00:01:39,000 I'll find out how a piece of ancient jewellery led to chip and pin. 30 00:01:39,000 --> 00:01:40,720 He just took my mum's ring. 31 00:01:40,720 --> 00:01:43,880 She's still upset about it. Yeah, she's still upset! 32 00:01:43,880 --> 00:01:47,400 Why a man ironing in the 1960s... 33 00:01:47,400 --> 00:01:48,440 Oh, it worked! 34 00:01:48,440 --> 00:01:52,760 ..revolutionised how data is stored on our cards. 35 00:01:54,120 --> 00:01:56,880 And why we have Russian spies... 36 00:01:56,880 --> 00:01:59,480 ..to thank for contactless payments. 37 00:01:59,480 --> 00:02:02,520 A bug? They put a bug in the seal? Absolutely. 38 00:02:14,120 --> 00:02:18,240 So just so you know, we're not allowed to say where we are. 39 00:02:18,240 --> 00:02:19,600 At all? No. 40 00:02:19,600 --> 00:02:21,520 This is sort of top secret. 41 00:02:21,520 --> 00:02:24,880 I did notice there weren't any signs outside, just barbed wire. 42 00:02:24,880 --> 00:02:28,760 There's a reason for all of this secrecy and tight security. 43 00:02:28,760 --> 00:02:31,240 And it's because we are at the biggest hub 44 00:02:31,240 --> 00:02:33,760 for bank card transactions in Europe... 45 00:02:34,920 --> 00:02:36,480 ..the Visa Data Centre. 46 00:02:37,960 --> 00:02:40,480 There are almost 4 billion of their bank cards in use 47 00:02:40,480 --> 00:02:42,880 around the world, which makes Visa 48 00:02:42,880 --> 00:02:47,360 one of the biggest bank card companies on the planet. 49 00:02:47,360 --> 00:02:50,440 Have you ever let a TV crew inside? No, I don't think so. 50 00:02:50,440 --> 00:02:52,080 We're in. 51 00:02:52,080 --> 00:02:55,680 Every European card transaction goes through here. 52 00:02:55,680 --> 00:02:57,320 This is where it all happens. 53 00:02:57,320 --> 00:03:02,000 This is Rajat Taneja, Visa's head of technology. 54 00:03:02,000 --> 00:03:04,440 Let's say this morning, I was at the train station. 55 00:03:04,440 --> 00:03:06,560 I bought a coffee. I paid for it with my card. 56 00:03:06,560 --> 00:03:09,240 What happens in that moment? 57 00:03:09,240 --> 00:03:11,600 We have to verify the credential of the card. 58 00:03:11,600 --> 00:03:13,760 We have to make sure there is no fraud going on. 59 00:03:13,760 --> 00:03:17,320 We have to make sure that you have funds in your account. 60 00:03:17,320 --> 00:03:22,000 We make an authorisation decision, send it back to the merchant's bank, 61 00:03:22,000 --> 00:03:23,720 who then sends it to the merchant. 62 00:03:23,720 --> 00:03:26,560 And all that happens in 300 milliseconds. 63 00:03:26,560 --> 00:03:27,920 In the blink of an eye. 64 00:03:27,920 --> 00:03:29,880 In the blink of an eye. 65 00:03:29,880 --> 00:03:34,880 We do that, on an average day, nearly 700 million times. 66 00:03:34,880 --> 00:03:36,680 Given my addiction to online shopping, 67 00:03:36,680 --> 00:03:38,280 I think quite a few of those are from me. 68 00:03:42,560 --> 00:03:45,680 That series of checks and approvals is only possible 69 00:03:45,680 --> 00:03:48,000 thanks to your bank card. 70 00:03:48,000 --> 00:03:52,120 Encoded securely within it is your unique information. 71 00:03:52,120 --> 00:03:55,600 So every time that you swipe or tap or click, 72 00:03:55,600 --> 00:03:57,720 your details can be verified 73 00:03:57,720 --> 00:04:01,400 and the movement of your money can be authorised. 74 00:04:02,920 --> 00:04:06,800 The thing is, I think all of us like to imagine that we have money. 75 00:04:06,800 --> 00:04:08,000 But you haven't got money. 76 00:04:08,000 --> 00:04:10,560 You've got data, just ones and zeros. 77 00:04:10,560 --> 00:04:12,760 And all of that work that you do, 78 00:04:12,760 --> 00:04:15,200 all of those numbers in your bank account, 79 00:04:15,200 --> 00:04:18,720 all they mean is something that gives you permission 80 00:04:18,720 --> 00:04:22,200 to talk to that computer over there in the corner. 81 00:04:23,600 --> 00:04:28,760 The digital key that unlocks your cash is the humble bank card. 82 00:04:28,760 --> 00:04:32,440 But how does a pocket-sized piece of plastic 83 00:04:32,440 --> 00:04:35,560 make payments using just ones and zeros? 84 00:04:39,440 --> 00:04:42,160 I'm going to take apart the bank card 85 00:04:42,160 --> 00:04:44,840 and look at four key components, 86 00:04:44,840 --> 00:04:48,800 from the microchip to the contactless antenna. 87 00:04:48,800 --> 00:04:51,200 But we're going to start with the thin strip on the back 88 00:04:51,200 --> 00:04:54,920 that encodes those ones and zeros onto the card. 89 00:04:54,920 --> 00:04:57,240 It's called the magnetic stripe. 90 00:04:59,960 --> 00:05:01,640 OK. So here's a bank card. 91 00:05:01,640 --> 00:05:05,400 And on the back you have the little black line, the mag stripe. 92 00:05:05,400 --> 00:05:07,320 Now, let me show you something with this. 93 00:05:07,320 --> 00:05:09,480 So if I take some iron filings 94 00:05:09,480 --> 00:05:12,360 and I just scatter them over the stripe... 95 00:05:14,480 --> 00:05:16,600 And then tap away the excess. 96 00:05:19,600 --> 00:05:21,360 You can see that the iron filings 97 00:05:21,360 --> 00:05:24,680 are stuck to certain bits of the magnetic stripe. 98 00:05:24,680 --> 00:05:28,240 Can you see that? Almost looks like a barcode, and it is, in a way. 99 00:05:28,240 --> 00:05:31,240 It's ones and zeros, magnetic, not magnetic. 100 00:05:31,240 --> 00:05:34,800 And it contains all the information that a bank card needs 101 00:05:34,800 --> 00:05:37,120 to be able to complete your transactions. 102 00:05:37,120 --> 00:05:40,360 So the first bit will be my card number, my account number, 103 00:05:40,360 --> 00:05:42,880 then there'll be my name, my prefix, 104 00:05:42,880 --> 00:05:47,920 and then things like the expiry date and the security code for the card. 105 00:05:48,960 --> 00:05:51,440 All of that information contained in that tiny little strip. 106 00:05:51,440 --> 00:05:53,280 It's quite clever, isn't it? 107 00:05:54,320 --> 00:05:59,280 But where did the idea for this ingenious stripe come from? 108 00:05:59,280 --> 00:06:02,160 Well, for that, first we have to go back... 109 00:06:03,840 --> 00:06:06,840 ..to the origin story of the bank card itself. 110 00:06:06,840 --> 00:06:08,920 It's September 1958, 111 00:06:08,920 --> 00:06:13,760 and the residents of the sleepy town of Fresno, California, 112 00:06:13,760 --> 00:06:19,040 are guinea pigs in a bold experiment by the world's biggest bank. 113 00:06:19,040 --> 00:06:23,920 Bank of America send all 60,000 of their Fresno customers 114 00:06:23,920 --> 00:06:27,720 a new-fangled thing called a credit card. 115 00:06:27,720 --> 00:06:31,480 Credit has been defined as man's confidence in man. 116 00:06:31,480 --> 00:06:34,600 But people are used to paying with cash and cheques 117 00:06:34,600 --> 00:06:38,480 and they don't trust this new plastic card. 118 00:06:38,480 --> 00:06:41,520 And so the bank offer an incentive. 119 00:06:41,520 --> 00:06:43,480 How about giving me a little credit? 120 00:06:43,480 --> 00:06:48,200 Every card is preloaded with $300 to spend. 121 00:06:48,200 --> 00:06:50,520 That's one way to persuade people. 122 00:06:53,600 --> 00:06:57,200 Unsurprisingly, the trial, now known as the Fresno Drop, 123 00:06:57,200 --> 00:07:01,560 is a huge success, as people flock to the shops... 124 00:07:01,560 --> 00:07:05,080 People are always needing more money, more credit. 125 00:07:05,080 --> 00:07:07,440 ..to pay on plastic for the first time. 126 00:07:07,440 --> 00:07:10,280 Do you have to use this exclusively yourself 127 00:07:10,280 --> 00:07:14,360 or could you, if you were unwise enough, give it to your wife? Oh... 128 00:07:14,360 --> 00:07:16,680 Probably wise not to answer that one. 129 00:07:17,960 --> 00:07:19,080 12 months later, 130 00:07:19,080 --> 00:07:23,320 more than 2 million cards have been sent out across California. 131 00:07:23,320 --> 00:07:27,120 ARCHIVE: Credit card purchasing has become widely accepted. 132 00:07:27,120 --> 00:07:30,920 And BankAmericard became a company that you may know... 133 00:07:30,920 --> 00:07:32,320 ..Visa. 134 00:07:32,320 --> 00:07:33,960 The bank card had truly arrived. 135 00:07:37,120 --> 00:07:41,200 But there was one problem with those early bank cards. 136 00:07:41,200 --> 00:07:45,320 Taking payment was quite a difficult business. 137 00:07:45,320 --> 00:07:46,520 You might remember these. 138 00:07:46,520 --> 00:07:48,520 Some people called them the knuckle busters. 139 00:07:48,520 --> 00:07:51,960 A charge card is used to make a sales slip. 140 00:07:51,960 --> 00:07:54,840 But to everyone else, they were known as the ZipZap... 141 00:07:54,840 --> 00:07:55,960 ZIP-ZAP! 142 00:07:55,960 --> 00:07:59,240 ..machine, probably for that reason. 143 00:07:59,240 --> 00:08:03,160 And what they do is, they use carbon paper and pressure 144 00:08:03,160 --> 00:08:05,760 to copy the embossed digits on your card 145 00:08:05,760 --> 00:08:08,360 onto these little slips of paper. 146 00:08:08,360 --> 00:08:12,520 And before any of you smart alecs try and pause the TV there, 147 00:08:12,520 --> 00:08:14,840 those are fake details. 148 00:08:14,840 --> 00:08:17,080 CHILD: How does the store get its money? 149 00:08:17,080 --> 00:08:21,040 Well, the sales slip that was made out has several copies. 150 00:08:21,040 --> 00:08:24,640 One copy was kept by the customer and the other by the seller, 151 00:08:24,640 --> 00:08:27,320 who would send it off to the bank as proof of payment. 152 00:08:27,320 --> 00:08:31,640 But the system was painfully slow and quite prone to error. 153 00:08:31,640 --> 00:08:35,200 So if the bank card was ever going to successfully replace cash, 154 00:08:35,200 --> 00:08:36,880 there needed to be a quicker way 155 00:08:36,880 --> 00:08:39,720 of handing over our personal information. 156 00:08:42,640 --> 00:08:44,640 The solution to speeding up payments 157 00:08:44,640 --> 00:08:47,600 would come from an unexpected source - the CIA. 158 00:08:49,160 --> 00:08:53,840 It's 1961, and we are in the midst of the Cold War. 159 00:08:53,840 --> 00:08:57,480 The CIA is preparing to move into its new headquarters 160 00:08:57,480 --> 00:08:59,280 in Langley, Virginia, 161 00:08:59,280 --> 00:09:04,120 but the giant building poses a big security problem. 162 00:09:04,120 --> 00:09:07,240 To demonstrate, I've flown to sunny Virginia 163 00:09:07,240 --> 00:09:08,960 to have a look at the CIA building. 164 00:09:08,960 --> 00:09:11,400 Not really. I've actually just come downstairs 165 00:09:11,400 --> 00:09:14,480 in the building I work at to look at the BBC foyer instead. 166 00:09:14,480 --> 00:09:17,080 But it kind of works, though, because in the BBC, like in the CIA, 167 00:09:17,080 --> 00:09:19,240 there are certain parts of the building 168 00:09:19,240 --> 00:09:21,600 that only certain people are allowed into. 169 00:09:21,600 --> 00:09:24,680 And back in the day, it used to be that security guards 170 00:09:24,680 --> 00:09:27,200 would just recognise your face. 171 00:09:27,200 --> 00:09:28,280 Hi, Peter. 172 00:09:28,280 --> 00:09:29,640 Hello. 173 00:09:29,640 --> 00:09:32,480 Is this real audio or are we just, like, chatting? 174 00:09:32,480 --> 00:09:34,880 I mean, imagine there's no distinction between the two. 175 00:09:34,880 --> 00:09:36,320 I see. OK. 176 00:09:36,320 --> 00:09:38,600 This is Dr Sean Vanatta. 177 00:09:38,600 --> 00:09:41,920 He's an expert in US economic and social history. 178 00:09:41,920 --> 00:09:45,200 Tell me about what was going on at the CIA at the time. 179 00:09:45,200 --> 00:09:48,320 So after World War II, with the rise of the Cold War, 180 00:09:48,320 --> 00:09:50,600 the government agencies are expanding. 181 00:09:50,600 --> 00:09:52,880 And so the old ways of doing security, 182 00:09:52,880 --> 00:09:55,040 where you have a guard at the door 183 00:09:55,040 --> 00:09:58,440 who recognises people coming in and out, you know, 184 00:09:58,440 --> 00:09:59,840 that just doesn't work any more. 185 00:09:59,840 --> 00:10:01,720 It's quite a big ask... It's quite a big ask. 186 00:10:01,720 --> 00:10:04,000 ..for a security guard to learn thousands of faces. 187 00:10:04,000 --> 00:10:07,160 But what has all of this got to do with the mag stripe? 188 00:10:07,160 --> 00:10:11,440 Well, the CIA asked computer innovators IBM 189 00:10:11,440 --> 00:10:14,400 to try and create a secure ID pass. 190 00:10:15,440 --> 00:10:18,480 IBM is working on a variety of technologies 191 00:10:18,480 --> 00:10:22,440 to basically input information into computer systems, 192 00:10:22,440 --> 00:10:24,600 one of which is the mag stripe, 193 00:10:24,600 --> 00:10:27,600 which has digital information. 194 00:10:27,600 --> 00:10:29,960 The ones and zeros on magnetic tape 195 00:10:29,960 --> 00:10:32,960 are just magnetic bits and not magnetic bits, 196 00:10:32,960 --> 00:10:34,960 and that's how you store data. 197 00:10:34,960 --> 00:10:37,840 ARCHIVE: Once data has been processed by a computer 198 00:10:37,840 --> 00:10:39,080 and recorded on tape, 199 00:10:39,080 --> 00:10:41,280 it may simply be stored in this form. 200 00:10:41,280 --> 00:10:45,200 IBM had the idea to give CIA employees a card 201 00:10:45,200 --> 00:10:50,440 with a unique strip of tape that identified who they were. 202 00:10:50,440 --> 00:10:53,520 It would be the first digital security pass. 203 00:10:53,520 --> 00:10:58,280 If only they could figure out how to attach the tape to plastic cards. 204 00:10:58,280 --> 00:11:04,040 And that is where engineer Forrest Parry and his wife Dorothea come in. 205 00:11:04,040 --> 00:11:06,920 One version of the story is that Parry is working. 206 00:11:06,920 --> 00:11:08,720 You know, his wife is at home. 207 00:11:08,720 --> 00:11:13,880 He sees his wife, like, ironing his shirts, got up and got some mag tape 208 00:11:13,880 --> 00:11:15,000 and a bit of plastic. 209 00:11:15,000 --> 00:11:17,600 Put it together, put it on the ironing board, 210 00:11:17,600 --> 00:11:20,720 tried to soften the plastic to get it to stick, 211 00:11:20,720 --> 00:11:22,400 and that seemed to work. 212 00:11:22,400 --> 00:11:26,240 I just really like the idea that man does ironing. 213 00:11:26,240 --> 00:11:29,120 It's a big enough news story to, like, make headlines. 214 00:11:29,120 --> 00:11:30,680 That really amuses me. 215 00:11:30,680 --> 00:11:34,640 Actually, most reports say that it was Dorothea 216 00:11:34,640 --> 00:11:38,160 who had the brainwave, so we shouldn't give Parry all the credit. 217 00:11:39,160 --> 00:11:42,920 Now, as a professor, I think it's only right 218 00:11:42,920 --> 00:11:47,560 to do some due diligence here using some specialised equipment. 219 00:11:48,920 --> 00:11:52,280 All right, so we've got plastic cards, we've got a bit of mag strip, 220 00:11:52,280 --> 00:11:53,840 which I don't think I'd quite clocked 221 00:11:53,840 --> 00:11:56,560 that it is exactly the same stuff that cassettes are on. 222 00:11:56,560 --> 00:11:59,320 It's basically just magnetic tape. Of course, this is a reference 223 00:11:59,320 --> 00:12:01,560 that no-one under the age of 30 will understand at all, 224 00:12:01,560 --> 00:12:03,240 but anyway, let's move on. OK. 225 00:12:03,240 --> 00:12:05,080 So we're going to iron this on there, then? 226 00:12:05,080 --> 00:12:07,800 I think it's likely that we're going to make a horrid mess here, 227 00:12:07,800 --> 00:12:09,640 but we'll see. 228 00:12:09,640 --> 00:12:12,400 Like I said, very scientific. 229 00:12:12,400 --> 00:12:13,760 There it is. 230 00:12:13,760 --> 00:12:17,320 So we just kind of put it on. Hold it for a few seconds. 231 00:12:17,320 --> 00:12:19,200 This could go very badly. 232 00:12:20,440 --> 00:12:22,200 Let's have a look. What do we have? 233 00:12:22,200 --> 00:12:23,920 Oh, it worked! 234 00:12:24,960 --> 00:12:26,560 It properly worked. 235 00:12:26,560 --> 00:12:29,680 Hey! We did it. A bank card. 236 00:12:32,480 --> 00:12:35,200 You might be wondering why it was that mag stripes took off 237 00:12:35,200 --> 00:12:38,600 when there were other potential technologies that could have worked. 238 00:12:38,600 --> 00:12:41,800 And the reason is because IBM did something very clever 239 00:12:41,800 --> 00:12:43,120 and very sneaky. 240 00:12:43,120 --> 00:12:47,280 Their ultimate business was about selling gigantic computers, 241 00:12:47,280 --> 00:12:50,320 so they deliberately didn't patent the mag stripe 242 00:12:50,320 --> 00:12:53,680 so that everybody would go out and use it and get it cheaply 243 00:12:53,680 --> 00:12:57,320 and then have to buy one of their massive, expensive computers 244 00:12:57,320 --> 00:12:58,960 to get it all to work. 245 00:13:00,680 --> 00:13:03,320 And that is exactly what happened. 246 00:13:03,320 --> 00:13:08,160 The ID card success led to the first mag stripe bank card in 1969, 247 00:13:08,160 --> 00:13:12,240 and IBM started making millions 248 00:13:12,240 --> 00:13:15,480 from the sale of computer systems needed 249 00:13:15,480 --> 00:13:18,080 to read those magnetic stripes. 250 00:13:19,480 --> 00:13:23,560 Even now, more than 60 years on from Forest Parry's smart idea, 251 00:13:23,560 --> 00:13:27,240 a black stripe remains a fixture on our bank cards. 252 00:13:31,480 --> 00:13:34,160 But the mag stripe era is coming to an end 253 00:13:34,160 --> 00:13:37,480 because of a fundamental flaw in the technology 254 00:13:37,480 --> 00:13:40,680 that has cost banks and businesses billions. 255 00:13:42,040 --> 00:13:45,920 I was once branded as Britain's greatest fraudster. 256 00:13:45,920 --> 00:13:47,280 Meet Tony. 257 00:13:47,280 --> 00:13:51,280 Tony knows more than most people about the mag stripe's weaknesses, 258 00:13:51,280 --> 00:13:53,960 because he used to exploit them. 259 00:13:53,960 --> 00:13:57,360 I started cloning credit cards when I was 15. 260 00:13:57,360 --> 00:14:00,400 I'm now 48, so it was a long time ago. 261 00:14:02,640 --> 00:14:07,480 Skimming is where someone takes a credit card 262 00:14:07,480 --> 00:14:10,520 and they swipe it through a machine 263 00:14:10,520 --> 00:14:14,440 that takes a cloned copy of that credit card. 264 00:14:15,400 --> 00:14:18,680 The mag stripe is so easy to skim because it's not encrypted 265 00:14:18,680 --> 00:14:21,160 and it's just there, open. 266 00:14:21,160 --> 00:14:22,680 This is a card reader. 267 00:14:22,680 --> 00:14:25,840 But to people like Tony, it's called a grabber, 268 00:14:25,840 --> 00:14:28,040 for reasons you can probably guess. 269 00:14:28,040 --> 00:14:31,560 I would take one of these in to someone that I had work in, 270 00:14:31,560 --> 00:14:33,160 like in a place like this, 271 00:14:33,160 --> 00:14:35,960 and I'd ask them to just keep it down the back, 272 00:14:35,960 --> 00:14:38,280 away from where the customers are. 273 00:14:38,280 --> 00:14:41,440 The card goes behind the counter, they swipe the card, 274 00:14:41,440 --> 00:14:44,440 and then they take a clone of the card at the same time. 275 00:14:44,440 --> 00:14:46,880 The customer would be none the wiser. 276 00:14:46,880 --> 00:14:48,600 That's how simple it is. 277 00:14:48,600 --> 00:14:50,680 Hold it there, Tony. 278 00:14:50,680 --> 00:14:53,640 So if skimming mag stripes is this easy, 279 00:14:53,640 --> 00:14:56,160 when did the banks find out? 280 00:14:56,160 --> 00:14:57,400 Let's go back to Sean. 281 00:14:57,400 --> 00:14:59,080 Very early on, people realised 282 00:14:59,080 --> 00:15:02,000 that copying the information on the mag stripe 283 00:15:02,000 --> 00:15:04,600 is not any different than sort of copying 284 00:15:04,600 --> 00:15:07,040 one audio cassette to another. 285 00:15:07,040 --> 00:15:09,680 If they knew in the 1970s, 286 00:15:09,680 --> 00:15:13,520 how did they possibly end up being popular? 287 00:15:13,520 --> 00:15:17,680 Within the banking industry, there are lots and lots of banks. 288 00:15:17,680 --> 00:15:18,880 Lots of them are small. 289 00:15:18,880 --> 00:15:22,080 They need essentially the cheapest solution possible. 290 00:15:22,080 --> 00:15:25,720 So the mag stripe offers that. It's low cost, it's widely available, 291 00:15:25,720 --> 00:15:28,560 it's easy to manufacture. It's worse than useless, 292 00:15:28,560 --> 00:15:32,240 it's actually really dangerous to adopt this technology. 293 00:15:32,240 --> 00:15:36,240 Banks doing something they knew was risky and dangerous? 294 00:15:36,240 --> 00:15:37,520 Doesn't sound like them. 295 00:15:37,520 --> 00:15:39,800 Back to Tony. 296 00:15:39,800 --> 00:15:43,640 I had a girl that was working in a delicatessen for me, 297 00:15:43,640 --> 00:15:46,040 and on the first Saturday that she used the grabber, 298 00:15:46,040 --> 00:15:47,560 she got 300 card numbers. 299 00:15:47,560 --> 00:15:48,640 And before you know it, 300 00:15:48,640 --> 00:15:51,400 I'm committing countless amounts of fraud. 301 00:15:51,400 --> 00:15:54,760 And how much money were you making? 302 00:15:54,760 --> 00:15:55,800 Er, no comment. 303 00:15:57,640 --> 00:16:00,280 Tony didn't clone the cards himself. 304 00:16:00,280 --> 00:16:03,040 He'd leave that for a techie like Sol. 305 00:16:04,600 --> 00:16:06,640 Seconds after plugging in the grabber, 306 00:16:06,640 --> 00:16:10,320 Sol has got the skimmed card details up on his laptop - 307 00:16:10,320 --> 00:16:12,200 the 16-digit card number, 308 00:16:12,200 --> 00:16:13,920 the name, expiry date, 309 00:16:13,920 --> 00:16:17,440 everything you need in the '90s to make a card payment. 310 00:16:17,440 --> 00:16:20,560 It's all ready to be put onto the card. 311 00:16:20,560 --> 00:16:22,200 And then using a card writer, 312 00:16:22,200 --> 00:16:25,800 he puts that mag stripe data onto a blank card. 313 00:16:25,800 --> 00:16:29,400 All I have to do is press a little button, swipe the card like that. 314 00:16:29,400 --> 00:16:31,440 And it's written. 315 00:16:31,440 --> 00:16:33,600 In total, it's taken less than five minutes 316 00:16:33,600 --> 00:16:36,120 to create this forged bank card. 317 00:16:36,120 --> 00:16:38,520 Well, that sounds easy. 318 00:16:38,520 --> 00:16:39,840 Where's the catch? 319 00:16:41,520 --> 00:16:43,480 I was eventually caught. 320 00:16:43,480 --> 00:16:46,160 I jumped bail and I went on the run 321 00:16:46,160 --> 00:16:51,320 and spent the next six years of my life running from the police. 322 00:16:51,320 --> 00:16:53,880 Ah, there's the catch. 323 00:16:53,880 --> 00:16:57,520 Tony was eventually sentenced to 12 months in prison. 324 00:16:57,520 --> 00:16:59,080 In prison, I reformed. 325 00:16:59,080 --> 00:17:03,920 I learned a lot of lessons and came out a different person. 326 00:17:03,920 --> 00:17:07,680 These days, Tony is fighting for the other side, 327 00:17:07,680 --> 00:17:11,840 advising businesses on how to avoid being the victim of fraudsters. 328 00:17:15,000 --> 00:17:18,600 So that's the story of how the mag stripe came to be. 329 00:17:18,600 --> 00:17:20,720 But with it being so easy to skim, 330 00:17:20,720 --> 00:17:23,680 we had to find a way to make our cards safer. 331 00:17:25,080 --> 00:17:29,480 The solution - to embed the card with its very own microchip, 332 00:17:29,480 --> 00:17:31,640 also known as chip and PIN. 333 00:17:35,760 --> 00:17:40,240 Unfortunately, you can't just iron a microchip onto a piece of plastic. 334 00:17:40,240 --> 00:17:43,600 Modern bank cards need a slightly more sophisticated assembly. 335 00:17:44,800 --> 00:17:48,240 Thames Technology is one of the few companies in the UK 336 00:17:48,240 --> 00:17:50,680 producing bank cards from scratch. 337 00:17:51,760 --> 00:17:55,920 From this factory, they make almost 8 million of them a year. 338 00:17:55,920 --> 00:17:57,520 Have you got your wallet on you? No. 339 00:17:57,520 --> 00:18:00,600 This is general manager Che Colford. 340 00:18:01,840 --> 00:18:03,640 Have you got your wallet? Can I borrow it? 341 00:18:03,640 --> 00:18:08,720 OK. So to me, the first thing that jumps out at me is his railcard, 342 00:18:08,720 --> 00:18:10,200 where he looks very lovely. 343 00:18:10,200 --> 00:18:13,000 When you look at these things, they're sort of all the same. 344 00:18:13,000 --> 00:18:15,720 But are you looking at those and seeing different things 345 00:18:15,720 --> 00:18:18,160 to what I'm seeing? Yeah. So with that particular one, 346 00:18:18,160 --> 00:18:19,640 you'll see that's a luminous ink 347 00:18:19,640 --> 00:18:22,680 and you see along the edge, it's an orange core. Yeah. 348 00:18:22,680 --> 00:18:25,680 The colour of that mag stripe is different to the normal one. 349 00:18:25,680 --> 00:18:28,040 Oh, yeah. So that's how it's evolved over time 350 00:18:28,040 --> 00:18:30,400 with different finishes, different materials 351 00:18:30,400 --> 00:18:32,480 and different personalisation methods. 352 00:18:32,480 --> 00:18:34,560 You know when you're in a restaurant with friends 353 00:18:34,560 --> 00:18:36,120 and everyone puts their card in, 354 00:18:36,120 --> 00:18:38,000 I imagine that's an exciting moment for you. 355 00:18:38,000 --> 00:18:40,920 You look at every single one of them. Thanks for your wallet, Chris. 356 00:18:40,920 --> 00:18:43,320 I'll just hold on to that for you. Don't worry about it. 357 00:18:43,320 --> 00:18:46,240 I promise we'll get to chip and pin in a minute. 358 00:18:46,240 --> 00:18:50,200 But let's just see how Che makes bank cards first. 359 00:18:50,200 --> 00:18:54,480 The bank card starts its life as simple blank sheets of plastic, 360 00:18:54,480 --> 00:18:57,840 which are loaded into a giant printer. 361 00:18:57,840 --> 00:19:02,080 Then, Forrest, or rather, Dorothea's mag stripe is added. 362 00:19:04,280 --> 00:19:07,400 The printouts are sandwiched between two laminate sheets 363 00:19:07,400 --> 00:19:09,080 and popped into an oven. 364 00:19:09,080 --> 00:19:11,760 This is basically a sandwich toaster? More or less. 365 00:19:14,360 --> 00:19:15,480 What comes out... 366 00:19:16,560 --> 00:19:18,680 ..is a solid piece of plastic, 367 00:19:18,680 --> 00:19:22,480 which is then punched out into individual bank cards. 368 00:19:23,640 --> 00:19:25,480 And now the bit we've all been waiting for, 369 00:19:25,480 --> 00:19:27,360 how the chip is installed. 370 00:19:28,400 --> 00:19:30,600 And this is where we place the chip into the card. 371 00:19:30,600 --> 00:19:34,080 So we create the pocket where the chip is going to sit. 372 00:19:34,080 --> 00:19:36,480 The chip is then glued into the card. 373 00:19:36,480 --> 00:19:41,520 We then do various electrical testing to make sure it's live. 374 00:19:41,520 --> 00:19:43,080 And then that's a completed card, 375 00:19:43,080 --> 00:19:44,280 so take one out. 376 00:19:46,120 --> 00:19:48,200 Look at that! 377 00:19:48,200 --> 00:19:52,400 How strange to have something at the end that feels so familiar. 378 00:19:54,760 --> 00:19:58,280 We might think we're familiar with our bank card, 379 00:19:58,280 --> 00:20:01,200 but have you ever had a close-up look? 380 00:20:01,200 --> 00:20:02,720 I mean, really close. 381 00:20:04,040 --> 00:20:07,040 I've got the chip from a bank card under a microscope here. 382 00:20:07,040 --> 00:20:08,640 This is the underside of it, 383 00:20:08,640 --> 00:20:10,360 the bit that you never see. 384 00:20:10,360 --> 00:20:11,680 There's all sorts of detail. 385 00:20:11,680 --> 00:20:13,280 There's the little chip in the middle. 386 00:20:13,280 --> 00:20:16,840 There's these gold wires holding it in place 387 00:20:16,840 --> 00:20:19,560 and the circuitry around the edge. 388 00:20:19,560 --> 00:20:22,600 So why is the chip so much more secure 389 00:20:22,600 --> 00:20:26,280 than the more traditional mag stripe? 390 00:20:26,280 --> 00:20:29,240 Well, the mag stripe gives you the same number every single time, 391 00:20:29,240 --> 00:20:32,800 whereas the chip is much cleverer. 392 00:20:32,800 --> 00:20:38,640 It's more like a miniature computer, and it gives you a unique code 393 00:20:38,640 --> 00:20:40,280 every time that it's used. 394 00:20:40,280 --> 00:20:44,320 Unlike the mag stripe, the chip doesn't reveal all the data needed 395 00:20:44,320 --> 00:20:45,800 to copy the card. 396 00:20:45,800 --> 00:20:50,520 The information the chip sends changes every transaction, 397 00:20:50,520 --> 00:20:52,960 which makes it far harder to copy. 398 00:20:54,360 --> 00:20:57,600 It's an ingenious device, and there are a few competing claims 399 00:20:57,600 --> 00:21:01,320 about who originally came up with the idea for it. 400 00:21:01,320 --> 00:21:03,880 But there's one story that I particularly like. 401 00:21:03,880 --> 00:21:09,040 It's a story about the eccentric French inventor, Roland Moreno, 402 00:21:09,040 --> 00:21:12,880 because he said that the idea came to him in a dream. 403 00:21:14,040 --> 00:21:17,440 A dream... about signet rings. 404 00:21:19,800 --> 00:21:22,840 Signet rings were a very big hit during the Middle Ages. 405 00:21:22,840 --> 00:21:25,080 And the signet, that's the picture in the middle, 406 00:21:25,080 --> 00:21:27,960 would either be a family crest or a monogram 407 00:21:27,960 --> 00:21:30,000 or some really intricate picture, 408 00:21:30,000 --> 00:21:35,120 essentially anything that made it really, really hard to copy. 409 00:21:35,120 --> 00:21:37,840 So then, if you were ever sending an important document, 410 00:21:37,840 --> 00:21:39,560 to prove that it came from you, 411 00:21:39,560 --> 00:21:42,000 you would use this almost like a signature 412 00:21:42,000 --> 00:21:44,320 by pressing it into hot wax. 413 00:21:45,480 --> 00:21:48,480 Legend has it that way back in the 14th century, 414 00:21:48,480 --> 00:21:51,840 King Edward III declared that his official documents 415 00:21:51,840 --> 00:21:55,000 should be signed using his unique signet seal, 416 00:21:55,000 --> 00:21:57,400 essentially an early version of 417 00:21:57,400 --> 00:22:00,600 "If you like it, then you should have put a ring on it." 418 00:22:00,600 --> 00:22:02,200 Hundreds of years later, 419 00:22:02,200 --> 00:22:06,400 Roland Moreno would take this idea of ancient authentication 420 00:22:06,400 --> 00:22:10,000 and turn it into one of the most successful technologies 421 00:22:10,000 --> 00:22:11,360 of the 21st century. 422 00:22:13,680 --> 00:22:17,760 His way of looking at life was always different. 423 00:22:17,760 --> 00:22:20,800 You couldn't stop his brains from working. 424 00:22:21,800 --> 00:22:26,200 You sort of had this mad, crazy inventor with his crazy hair. 425 00:22:28,040 --> 00:22:30,320 Meet Marianne and Julia, 426 00:22:30,320 --> 00:22:31,960 Roland Moreno's daughters. 427 00:22:31,960 --> 00:22:35,520 My father, in the early '70s to mid-'70s, 428 00:22:35,520 --> 00:22:39,400 really had this wish that physical money would disappear. 429 00:22:39,400 --> 00:22:41,800 No more cash, no more chequebooks. 430 00:22:43,320 --> 00:22:46,000 The microchip revolution had made electronics 431 00:22:46,000 --> 00:22:48,240 smaller than ever thought possible, 432 00:22:48,240 --> 00:22:52,400 and Roland's dream was to put one on a ring as a way of paying. 433 00:22:52,400 --> 00:22:55,120 It would be a modern-day signet ring. 434 00:22:55,120 --> 00:23:00,280 So in 1974, he set to work building a prototype in his workshop. 435 00:23:02,400 --> 00:23:05,840 And that prototype has been in storage for years, 436 00:23:05,840 --> 00:23:07,760 until we turned up with a camera crew. 437 00:23:07,760 --> 00:23:11,040 Seeing these objects for the first time in many years, 438 00:23:11,040 --> 00:23:13,120 it's actually quite moving. 439 00:23:13,120 --> 00:23:16,400 He thought it would be very practical to have your payment card 440 00:23:16,400 --> 00:23:18,000 on you all the time. 441 00:23:18,000 --> 00:23:22,160 So he put the chip card on my mum's ring, actually. 442 00:23:22,160 --> 00:23:24,920 And the idea would be that everyone could walk around 443 00:23:24,920 --> 00:23:26,680 with a chip on their finger. 444 00:23:27,720 --> 00:23:31,480 Sticking out from the microchip were these 16 tiny little legs. 445 00:23:31,480 --> 00:23:33,640 The idea was that you would insert these legs 446 00:23:33,640 --> 00:23:36,640 into a reader in the shops to make an electronic payment, 447 00:23:36,640 --> 00:23:39,000 which is great for banking security, 448 00:23:39,000 --> 00:23:40,920 terrible for jumpers. 449 00:23:40,920 --> 00:23:43,800 He just took my mum's ring without asking her 450 00:23:43,800 --> 00:23:45,760 what she thought about it. 451 00:23:45,760 --> 00:23:49,280 She's still upset about it. Yeah, she's still upset about it! 452 00:23:51,080 --> 00:23:52,160 As much as he tried, 453 00:23:52,160 --> 00:23:56,120 Roland just couldn't get the banks to take on his idea, 454 00:23:56,120 --> 00:23:58,040 but he refused to give up. 455 00:23:58,040 --> 00:24:02,040 So then he had the idea of putting the chip on a piece of plastic. 456 00:24:02,040 --> 00:24:06,000 And so you would use this card and put a secret code. 457 00:24:07,280 --> 00:24:09,000 Does that sound familiar? 458 00:24:09,000 --> 00:24:10,680 What Roland had invented 459 00:24:10,680 --> 00:24:14,000 was the world's first chip and pin card and reader. 460 00:24:14,000 --> 00:24:16,800 And this is it. 461 00:24:16,800 --> 00:24:19,040 I think it's a beautiful object. 462 00:24:19,040 --> 00:24:21,600 For a sprinkling of added jeopardy, 463 00:24:21,600 --> 00:24:24,960 Roman made it that if you got the pin wrong three times in a row, 464 00:24:24,960 --> 00:24:27,280 the chip would self-destruct. 465 00:24:27,280 --> 00:24:29,800 Like a real-life James Bond gadget. 466 00:24:29,800 --> 00:24:32,840 Once again, the banks were hesitant, 467 00:24:32,840 --> 00:24:36,440 but there was interest from elsewhere. 468 00:24:36,440 --> 00:24:40,400 In 1983, France Telecom realised that Moreno's chip card 469 00:24:40,400 --> 00:24:42,640 could be preloaded with credit 470 00:24:42,640 --> 00:24:46,440 and used in phone booths, replacing coins. 471 00:24:46,440 --> 00:24:49,560 It was great as a teenager to use my dad's invention 472 00:24:49,560 --> 00:24:53,280 to call my parents or my friends or my lover. 473 00:24:53,280 --> 00:24:58,240 It was hugely successful, and the watching banks wanted in. 474 00:24:58,240 --> 00:25:00,840 So by 1992, Roland's chip and pin 475 00:25:00,840 --> 00:25:04,320 was mandatory on all bank cards in France. 476 00:25:04,320 --> 00:25:07,560 REPORTER: When the bill arrives at a Parisian cafe, you don't need a pen. 477 00:25:07,560 --> 00:25:09,160 You need a PIN number. 478 00:25:10,480 --> 00:25:15,840 It changed the way almost everyone on the planet daily uses money. 479 00:25:17,640 --> 00:25:19,720 Roland got a patent for his idea. 480 00:25:19,720 --> 00:25:25,560 And when he died in 2012 aged 66, his company had made millions. 481 00:25:27,200 --> 00:25:29,920 I do feel proud, extremely proud 482 00:25:29,920 --> 00:25:34,560 of this invention started in a little room in '74 in Paris 483 00:25:34,560 --> 00:25:37,280 by this crazy inventor. 484 00:25:40,440 --> 00:25:42,480 He was celebrated in France. 485 00:25:44,200 --> 00:25:46,920 But it took us a little while on this side of the Channel 486 00:25:46,920 --> 00:25:50,120 to really appreciate the genius of his idea. 487 00:25:51,120 --> 00:25:52,600 I find it slightly embarrassing 488 00:25:52,600 --> 00:25:55,560 that we are lagging still ten years behind the French. 489 00:25:55,560 --> 00:25:59,680 But in 2003, we finally caught up. 490 00:25:59,680 --> 00:26:03,280 The way we use credit and debit cards is to change significantly. 491 00:26:03,280 --> 00:26:07,400 The so-called chip and pin credit card system is going nationwide. 492 00:26:07,400 --> 00:26:10,600 I think it's fantastic. Cut down on all that fraud, yeah. 493 00:26:13,440 --> 00:26:16,280 Chip and pin was such an improvement on the mag stripe 494 00:26:16,280 --> 00:26:19,760 that it cut counterfeit card fraud by over 50%, 495 00:26:19,760 --> 00:26:23,560 and typing in your numbers quickly became the norm. 496 00:26:25,400 --> 00:26:26,640 But who wants the hassle 497 00:26:26,640 --> 00:26:29,680 of actually inserting your card into the terminal? 498 00:26:31,200 --> 00:26:35,640 The next component is a secret wire hiding inside your bank card 499 00:26:35,640 --> 00:26:40,000 that makes it possible for you to pay with a tap. 500 00:26:40,000 --> 00:26:42,200 It is the contactless antenna. 501 00:26:45,960 --> 00:26:49,320 My producer has very kindly lent me her bank card 502 00:26:49,320 --> 00:26:53,360 and I'm going to drop it in this, which isn't a glass of water, 503 00:26:53,360 --> 00:26:55,040 but a glass of acetone. 504 00:26:56,920 --> 00:26:59,440 Acetone is essentially nail varnish remover. 505 00:26:59,440 --> 00:27:01,920 This is sort of a super-strength version. 506 00:27:01,920 --> 00:27:05,160 And initially, it doesn't look like much is happening. 507 00:27:05,160 --> 00:27:10,920 But because the card is made of PVC... 508 00:27:10,920 --> 00:27:13,160 Oh. Whoo! 509 00:27:13,160 --> 00:27:14,880 It's quite stinky. 510 00:27:16,400 --> 00:27:19,280 ..you can see, actually, little bubbles starting to form 511 00:27:19,280 --> 00:27:23,160 on the signature panel, and it's peeling away already. 512 00:27:23,160 --> 00:27:28,560 And I think the mag stripe is starting to come away as well. 513 00:27:28,560 --> 00:27:31,520 It's being destroyed in front of my very eyes. 514 00:27:36,840 --> 00:27:38,520 It's about half an hour later. 515 00:27:38,520 --> 00:27:41,960 And... I mean, it looks quite different. 516 00:27:43,200 --> 00:27:46,480 All of the plastic has just curled off 517 00:27:46,480 --> 00:27:49,960 and then sticking out of the wreckage, 518 00:27:49,960 --> 00:27:53,040 there's just this very thin hint of a wire, 519 00:27:53,040 --> 00:27:55,080 which I think we should fish out. 520 00:27:55,080 --> 00:27:56,360 Let's try. 521 00:27:56,360 --> 00:28:00,960 I'm trying to not get nail polish remover on my nicely done nail. 522 00:28:00,960 --> 00:28:03,600 OK, here we go. 523 00:28:04,680 --> 00:28:07,200 Look at that, it looks like a spider. 524 00:28:09,840 --> 00:28:10,880 Wow. 525 00:28:12,160 --> 00:28:13,440 There's loads of it. 526 00:28:18,000 --> 00:28:20,160 So this is what's left. 527 00:28:20,160 --> 00:28:23,440 This bit here is the chip 528 00:28:23,440 --> 00:28:27,600 that does the job when you're doing chip and pin. 529 00:28:27,600 --> 00:28:29,440 The really clever thing 530 00:28:29,440 --> 00:28:32,560 is that all of this wire around the edge, 531 00:28:32,560 --> 00:28:35,520 this is essentially an antenna. 532 00:28:35,520 --> 00:28:38,080 And so when you're using wireless, 533 00:28:38,080 --> 00:28:41,000 the handset gives off a little radio signal 534 00:28:41,000 --> 00:28:43,160 which gets picked up by this wire 535 00:28:43,160 --> 00:28:46,480 and it gives just enough to power the chip 536 00:28:46,480 --> 00:28:49,240 to authenticate the transaction 537 00:28:49,240 --> 00:28:52,280 and send it back out through the antenna 538 00:28:52,280 --> 00:28:55,120 to be read by the card reader. 539 00:28:55,120 --> 00:28:56,920 And the best thing about it - 540 00:28:56,920 --> 00:28:59,680 I mean, I know your card looks a little bit different now, 541 00:28:59,680 --> 00:29:02,760 I'll accept that, but it should still work. 542 00:29:02,760 --> 00:29:04,960 So I've ordered a coffee. 543 00:29:04,960 --> 00:29:06,040 Here we go. 544 00:29:06,040 --> 00:29:07,560 Thank you very much. 545 00:29:07,560 --> 00:29:10,080 How much is it? That'll be £3, please. I'll do that for you. 546 00:29:14,360 --> 00:29:16,200 Let's try it. 547 00:29:16,200 --> 00:29:17,480 CARD READER BEEPS 548 00:29:18,960 --> 00:29:21,640 That's all done. Great. 549 00:29:21,640 --> 00:29:23,640 It worked! I'm so impressed. 550 00:29:25,040 --> 00:29:26,320 I know what you're thinking. 551 00:29:26,320 --> 00:29:28,880 First, my producer needs a new bank card. 552 00:29:28,880 --> 00:29:32,680 But second, how did they get an 85cm-long antenna 553 00:29:32,680 --> 00:29:37,160 inside a card that's less than a millimetre thick? 554 00:29:37,160 --> 00:29:39,920 Let's go back to the factory 555 00:29:39,920 --> 00:29:44,560 and take a closer look at the filling of that card sandwich. 556 00:29:44,560 --> 00:29:46,480 Is this where the magic happens? 557 00:29:46,480 --> 00:29:49,040 So that is where the aerial antenna is 558 00:29:49,040 --> 00:29:51,680 for the contactless element of the chips. 559 00:29:51,680 --> 00:29:53,800 Before the cards go into the oven, 560 00:29:53,800 --> 00:29:58,120 a sheet of 48 copper antennas is popped into the middle of it. 561 00:29:58,120 --> 00:30:02,080 At this factory, they go through thousands of miles of wire a year 562 00:30:02,080 --> 00:30:05,640 making their contactless cards. 563 00:30:05,640 --> 00:30:07,600 It does look quite like a sandwich. Yeah. 564 00:30:07,600 --> 00:30:12,320 You've got your completed sandwich ready for the next stage. 565 00:30:12,320 --> 00:30:14,920 And the oven then seals it in place. 566 00:30:19,360 --> 00:30:21,600 The technology behind contactless payments 567 00:30:21,600 --> 00:30:26,280 is called radio-frequency identification, or RFID. 568 00:30:26,280 --> 00:30:28,920 And that might seem like a new tech. 569 00:30:31,520 --> 00:30:36,200 But its origins can be traced back almost 80 years to Russia. 570 00:30:36,200 --> 00:30:39,720 ARCHIVE: This is the Kremlin, citadel of Russian communism. 571 00:30:41,120 --> 00:30:44,040 Leon Theremin was a brilliant Russian inventor 572 00:30:44,040 --> 00:30:46,360 obsessed with radio frequencies. 573 00:30:47,480 --> 00:30:49,120 EERIE WAILING 574 00:30:49,120 --> 00:30:53,400 And if you've seen just about any old science fiction film... 575 00:30:55,240 --> 00:30:59,920 ..you will be familiar with the sound of his most famous invention. 576 00:31:02,040 --> 00:31:04,200 It's like a crying cat! 577 00:31:04,200 --> 00:31:06,400 HIGH-PITCHED WAILING 578 00:31:08,360 --> 00:31:09,520 The theremin has to be 579 00:31:09,520 --> 00:31:13,000 one of the strangest musical instruments ever created, 580 00:31:13,000 --> 00:31:16,080 because you because you don't actually touch it. 581 00:31:16,080 --> 00:31:19,800 Instead, you interrupt the electromagnetic field of it 582 00:31:19,800 --> 00:31:21,480 using your hands. 583 00:31:23,680 --> 00:31:26,880 And that changes the frequency of the sound, like this. 584 00:31:26,880 --> 00:31:28,720 PITCH WAVERS 585 00:31:32,000 --> 00:31:33,760 Like a bad opera singer. 586 00:31:36,600 --> 00:31:41,000 Leon saw the potential to turn it into a musical instrument. 587 00:31:44,280 --> 00:31:47,680 Sci-fi films have never sounded the same since. 588 00:31:53,040 --> 00:31:54,920 But in 1938, 589 00:31:54,920 --> 00:32:01,160 Leon was arrested and accused of being a counter-revolutionary. 590 00:32:01,160 --> 00:32:04,320 The musician was sent to a gulag labour camp. 591 00:32:05,440 --> 00:32:06,960 But what has all of this got to do 592 00:32:06,960 --> 00:32:10,640 with the contactless antenna in our bank cards? 593 00:32:10,640 --> 00:32:13,440 Well, in a secret laboratory in the gulag, 594 00:32:13,440 --> 00:32:16,360 the Soviets put Leon's physics expertise 595 00:32:16,360 --> 00:32:18,240 to a far more sinister use. 596 00:32:20,760 --> 00:32:26,040 I want you to imagine that it's 1945 in Soviet-era Russia. 597 00:32:26,040 --> 00:32:27,600 The Second World War has just ended. 598 00:32:27,600 --> 00:32:31,360 And in Moscow, the Russians have a gift 599 00:32:31,360 --> 00:32:33,760 for the American ambassador. 600 00:32:33,760 --> 00:32:35,920 Out of wood, they have carved 601 00:32:35,920 --> 00:32:38,600 a copy of the great seal of the United States, 602 00:32:38,600 --> 00:32:40,920 and they present it to the ambassador 603 00:32:40,920 --> 00:32:43,160 with a group of schoolchildren 604 00:32:43,160 --> 00:32:47,480 as this great message of hope and goodwill for the future. 605 00:32:47,480 --> 00:32:50,800 It's a gift, essentially, that the ambassador cannot refuse. 606 00:32:50,800 --> 00:32:54,920 And so he hangs it up in pride of position in his office. 607 00:32:56,760 --> 00:33:00,200 But there's a twist to this tale because, as you might have guessed, 608 00:33:00,200 --> 00:33:03,000 this seal is not quite the message of friendship 609 00:33:03,000 --> 00:33:05,760 that the Russians were pretending it was, 610 00:33:05,760 --> 00:33:08,760 because hiding inside of that wooden carving 611 00:33:08,760 --> 00:33:13,560 is a tiny little device known as "the thing". 612 00:33:13,560 --> 00:33:16,280 Do you remember a few years ago, when it was revealed 613 00:33:16,280 --> 00:33:17,360 at the United Nations 614 00:33:17,360 --> 00:33:20,720 that the Russians actually placed a sophisticated bugging device 615 00:33:20,720 --> 00:33:23,520 inside the great seal of the United States? 616 00:33:23,520 --> 00:33:27,040 Oh, yes. Leon had spent his years in the gulag 617 00:33:27,040 --> 00:33:31,840 building an extraordinary new kind of spying device. 618 00:33:31,840 --> 00:33:36,040 People come to me when nobody else will do it. 619 00:33:36,040 --> 00:33:37,640 Yeah. 620 00:33:37,640 --> 00:33:39,160 This is Neil Smith. 621 00:33:39,160 --> 00:33:42,360 He's an amateur radio experimenter. 622 00:33:42,360 --> 00:33:44,560 Let's start with the most obvious question, 623 00:33:44,560 --> 00:33:46,120 which is, what is "the thing"? 624 00:33:46,120 --> 00:33:50,440 Basically, it's an unpowered, entirely passive listening device 625 00:33:50,440 --> 00:33:52,720 that you could hide almost anywhere. 626 00:33:52,720 --> 00:33:55,800 A bug, they put a bug in the seal? Absolutely. 627 00:33:55,800 --> 00:33:58,960 REPORTER: Technological breakthroughs in miniaturisation 628 00:33:58,960 --> 00:34:03,440 have made possible the development of these hard to detect devices. 629 00:34:04,600 --> 00:34:07,560 But why have Neil explain to us how The Thing worked 630 00:34:07,560 --> 00:34:10,200 when we could have him go out and build one? 631 00:34:10,200 --> 00:34:14,400 And as far as we know, no-one has tried this since the Russians. 632 00:34:14,400 --> 00:34:18,600 So what the Russians did, inside... 633 00:34:20,320 --> 00:34:22,440 ..they mounted one of these. 634 00:34:22,440 --> 00:34:26,800 So this contains the little microphone element, 635 00:34:26,800 --> 00:34:29,360 and this is the external aerial. 636 00:34:29,360 --> 00:34:32,760 And that's really all there is to it. 637 00:34:32,760 --> 00:34:35,880 It's not quite as simple as Neil makes out. 638 00:34:35,880 --> 00:34:37,520 Let me try to explain. 639 00:34:38,560 --> 00:34:41,080 The Thing didn't have its own power source, 640 00:34:41,080 --> 00:34:42,960 no battery, nothing like that. 641 00:34:42,960 --> 00:34:46,520 And that meant that, when the Americans swept it for bugs, 642 00:34:46,520 --> 00:34:48,400 nothing was detected. 643 00:34:48,400 --> 00:34:53,240 Instead, a tiny microphone inside it was activated by a strong 644 00:34:53,240 --> 00:34:57,120 electromagnetic signal blasted at the antenna 645 00:34:57,120 --> 00:34:59,280 from outside of the embassy. 646 00:34:59,280 --> 00:35:01,440 A wireless microphone, such as the one placed 647 00:35:01,440 --> 00:35:02,880 in the seal's hidden cavity, 648 00:35:02,880 --> 00:35:05,360 can be smaller than an eraser on a pencil. 649 00:35:05,360 --> 00:35:09,360 That same aerial then transmitted the voices in the room 650 00:35:09,360 --> 00:35:11,360 to a Russian van outside. 651 00:35:11,360 --> 00:35:14,240 Everything said in a bugged room can be tape recorded 652 00:35:14,240 --> 00:35:17,320 as far as a mile away without using any telltale wires. 653 00:35:17,320 --> 00:35:20,320 How many hours did you spend doing this? 654 00:35:20,320 --> 00:35:22,000 Now, Neil doesn't quite have 655 00:35:22,000 --> 00:35:24,240 the resources of a global superpower, 656 00:35:24,240 --> 00:35:28,400 but he has spent 200 hours in his shed working on this. 657 00:35:29,960 --> 00:35:31,880 Let's hope it actually works, shall we? 658 00:35:31,880 --> 00:35:35,280 We feel very excited to be the first civilians 659 00:35:35,280 --> 00:35:39,320 who are making a Soviet-era spy device and testing out today. 660 00:35:39,320 --> 00:35:41,800 Whether or not it works, I guess, is a different question. 661 00:35:42,960 --> 00:35:45,440 Our researcher, Jack, is going to play the role 662 00:35:45,440 --> 00:35:49,040 of the US ambassador, while Neil and I are Soviet spies. 663 00:35:51,560 --> 00:35:53,520 Testing, testing. Good to go. 664 00:35:53,520 --> 00:35:56,160 So this is the receiver? Yep. 665 00:35:56,160 --> 00:35:59,040 OK. Hit us with your top secrets, Jack. 666 00:35:59,040 --> 00:36:00,840 black sheep. 667 00:36:00,840 --> 00:36:03,040 # Bah, bah, black sheep Have you any wool? # 668 00:36:03,040 --> 00:36:07,040 We are sending an electromagnetic signal to The Thing. 669 00:36:07,040 --> 00:36:11,200 And Neil now just has to make some minuscule tweaks to the receiver 670 00:36:11,200 --> 00:36:14,160 and transmitter frequencies. 671 00:36:14,160 --> 00:36:15,600 It's trial and error. 672 00:36:15,600 --> 00:36:18,840 # Yes, sir, yes, sir Three bags full... # 673 00:36:18,840 --> 00:36:21,360 And there's a lot of error. 674 00:36:21,360 --> 00:36:25,080 Now, if this seems to be quite a boring shot, it's because no-one 675 00:36:25,080 --> 00:36:27,080 in the crew can move. 676 00:36:27,080 --> 00:36:28,640 Otherwise, it mucks up everything. 677 00:36:28,640 --> 00:36:31,680 # Bah, bah, black sheep Have you any wool? # 678 00:36:31,680 --> 00:36:35,400 But an hour of listening to a hissing radio 679 00:36:35,400 --> 00:36:37,000 in a stairwell at the BBC... 680 00:36:37,000 --> 00:36:38,400 It's there, it's there! 681 00:36:38,400 --> 00:36:41,400 # One for the master One for the dame... # 682 00:36:42,440 --> 00:36:46,080 ..finally pays off when suddenly the crackliest 683 00:36:46,080 --> 00:36:48,000 of faint voices can be heard. 684 00:36:48,000 --> 00:36:49,280 STATIC 685 00:36:48,000 --> 00:36:49,280 It's it. 686 00:36:49,280 --> 00:36:51,400 That's it. That's it. That's it. That's it. 687 00:36:52,840 --> 00:36:54,800 FAINT GARBLED SPEECH 688 00:36:54,800 --> 00:36:57,040 STATIC 689 00:36:57,040 --> 00:36:59,840 # Bah, bah, black sheep Have you any wool? # 690 00:36:59,840 --> 00:37:01,400 STATIC 691 00:36:59,840 --> 00:37:01,400 I definitely heard it. 692 00:37:02,400 --> 00:37:03,920 I think that counts as a success. 693 00:37:03,920 --> 00:37:05,440 HE EXHALES 694 00:37:05,440 --> 00:37:07,440 Let's go tell Jack. Shall we go tell Jack? 695 00:37:07,440 --> 00:37:10,160 Jack, Jack, we heard you. We heard you. No way. 696 00:37:10,160 --> 00:37:12,760 I know that you were doing that for about an hour. Well done. 697 00:37:12,760 --> 00:37:14,920 Well done. Very good. 698 00:37:16,720 --> 00:37:19,880 OK, I'm not sure you could exactly use us to gather intelligence, 699 00:37:19,880 --> 00:37:22,680 but we did at least get a very faint signal. 700 00:37:23,840 --> 00:37:26,720 It seems quite a beautiful piece of carving. 701 00:37:26,720 --> 00:37:29,360 Theremin's original betrayed the secrets 702 00:37:29,360 --> 00:37:34,560 of four successive ambassadors for an incredible seven years. 703 00:37:34,560 --> 00:37:36,760 All right, open it up. 704 00:37:36,760 --> 00:37:41,080 And here is the...here is the clandestine listening device. 705 00:37:42,640 --> 00:37:46,840 And when the Americans did finally find it, they weren't best pleased. 706 00:37:46,840 --> 00:37:53,160 I have here today a concrete example of Soviet espionage. 707 00:37:55,080 --> 00:37:57,600 It might feel like we're going off on a bit of a tangent here, 708 00:37:57,600 --> 00:38:02,040 but actually this story is incredibly relevant to the idea 709 00:38:02,040 --> 00:38:03,280 of bank cards. 710 00:38:03,280 --> 00:38:06,720 When you're paying contactless, you need somehow to power 711 00:38:06,720 --> 00:38:09,000 that very tiny microchip that's in there. 712 00:38:09,000 --> 00:38:11,280 Yeah, I don't know if you've ever taken a bank card to pieces... 713 00:38:11,280 --> 00:38:15,080 You know, it's funny you should mention that. ..but the little wire 714 00:38:15,080 --> 00:38:19,400 that goes around it is an aerial, so it picks up the signal. 715 00:38:19,400 --> 00:38:22,800 And because it's quite close, it's quite a good loud signal, 716 00:38:22,800 --> 00:38:25,120 which you can then turn into electricity 717 00:38:25,120 --> 00:38:27,760 to power your little chip. In effect, then, 718 00:38:27,760 --> 00:38:32,440 the bank card is like The Thing hanging in the ambassador's wall 719 00:38:32,440 --> 00:38:36,360 and the hand-held payment device the shops are using 720 00:38:36,360 --> 00:38:37,560 to collect the money, 721 00:38:37,560 --> 00:38:40,200 that is like all of the Russians sitting in a room 722 00:38:40,200 --> 00:38:41,680 less than half a mile away, 723 00:38:41,680 --> 00:38:44,600 listening in and transmitting electromagnetic waves. 724 00:38:44,600 --> 00:38:45,920 Absolutely. 725 00:38:49,240 --> 00:38:51,680 Leon was eventually released from the gulag. 726 00:38:51,680 --> 00:38:55,160 ELECTRIC TONES WARBLE 727 00:38:55,160 --> 00:38:58,480 He died in 1993, aged 97. 728 00:38:58,480 --> 00:39:02,280 But it was another 14 years before the banks began 729 00:39:02,280 --> 00:39:04,720 to utilise his technology. 730 00:39:04,720 --> 00:39:06,000 From today, 731 00:39:06,000 --> 00:39:08,400 these contactless cards are being launched. 732 00:39:08,400 --> 00:39:13,640 Contactless was introduced in the UK back in 2007. 733 00:39:13,640 --> 00:39:17,520 Next month, Barclays will allow you to make payments under £10 734 00:39:17,520 --> 00:39:19,760 without entering a PIN number. 735 00:39:19,760 --> 00:39:21,680 But not everyone was convinced. 736 00:39:21,680 --> 00:39:24,440 It's not...not much trouble to stick four numbers in. 737 00:39:24,440 --> 00:39:29,240 Now, around 70% of all card payments are made this way. 738 00:39:29,240 --> 00:39:32,000 Contactless has certainly made paying for things easier 739 00:39:32,000 --> 00:39:33,120 when you're out and about, 740 00:39:33,120 --> 00:39:35,440 but if you want even more convenience... 741 00:39:37,000 --> 00:39:38,840 BEEP 742 00:39:38,840 --> 00:39:41,800 ..then on next component is the reason you can buy stuff 743 00:39:41,800 --> 00:39:44,000 without leaving your home at all. 744 00:39:46,600 --> 00:39:49,880 The three, or sometimes four, numbers on the back of your card 745 00:39:49,880 --> 00:39:53,560 is a secure identifier that protects you when you're spending online, 746 00:39:53,560 --> 00:39:57,720 although not from those drunken eBay purchases you keep making. 747 00:39:59,560 --> 00:40:02,440 It's the CVV, or card verification value. 748 00:40:05,720 --> 00:40:09,160 So when you make a payment online, those CVV numbers, 749 00:40:09,160 --> 00:40:12,000 they're not stored by the online portal. 750 00:40:12,000 --> 00:40:15,560 And that is because, if their database ever gets breached 751 00:40:15,560 --> 00:40:18,800 or stolen, the long card number on its own 752 00:40:18,800 --> 00:40:20,520 can't really do that much. 753 00:40:20,520 --> 00:40:22,040 You need these three numbers. 754 00:40:22,040 --> 00:40:26,480 And this effectively, then, is like a little signature that proves 755 00:40:26,480 --> 00:40:29,200 that the person making the payment is the one 756 00:40:29,200 --> 00:40:30,840 that has the physical card. 757 00:40:32,440 --> 00:40:36,720 The CVV was introduced in the late '90s to reduce fraud 758 00:40:36,720 --> 00:40:39,600 as online payments started to become more popular. 759 00:40:39,600 --> 00:40:43,480 But if you want to find out how the CVV came about, 760 00:40:43,480 --> 00:40:46,480 then you're going to have to head back to the murky world 761 00:40:46,480 --> 00:40:48,400 of the early internet age. 762 00:40:49,480 --> 00:40:53,040 Imagine a world where every word ever written, every picture 763 00:40:53,040 --> 00:40:56,800 ever painted and every film ever shot could be viewed instantly 764 00:40:56,800 --> 00:41:00,600 in your home via an information superhighway. 765 00:41:00,600 --> 00:41:01,800 Imagine that moment. 766 00:41:01,800 --> 00:41:04,120 The World Wide Web has come on the scene. 767 00:41:04,120 --> 00:41:06,120 It's the early 1990s. 768 00:41:06,120 --> 00:41:08,880 Just purchasing things from your home computer 769 00:41:08,880 --> 00:41:11,160 is a completely novel idea. 770 00:41:11,160 --> 00:41:13,360 This is a shopping centre, and here it says 771 00:41:13,360 --> 00:41:16,440 it's just off the information superhighway. 772 00:41:17,680 --> 00:41:21,320 But using cars to pay online was so slow and insecure 773 00:41:21,320 --> 00:41:24,080 that it looked like online shopping would just never catch on. 774 00:41:29,720 --> 00:41:31,760 And like with any technology, 775 00:41:31,760 --> 00:41:36,400 what online shopping needed was early adopters to drive demand. 776 00:41:36,400 --> 00:41:40,080 And there was one group who took a particularly keen interest. 777 00:41:40,080 --> 00:41:42,320 Before online shopping, 778 00:41:42,320 --> 00:41:45,320 if you wanted to buy adult materials, 779 00:41:45,320 --> 00:41:47,920 you either had to visit a specialist shop 780 00:41:47,920 --> 00:41:50,600 or send away for it with a check in the mail. 781 00:41:50,600 --> 00:41:52,800 That is a slow old business. 782 00:41:52,800 --> 00:41:55,760 By the time it arrives, the mood might have gone. 783 00:41:55,760 --> 00:41:59,120 If you have a home computer and a modem, access to information 784 00:41:59,120 --> 00:42:00,720 is almost limitless. 785 00:42:00,720 --> 00:42:03,680 However, some of that information is strictly for adults. 786 00:42:04,680 --> 00:42:08,960 The internet offered a tantalising glimpse of instant content 787 00:42:08,960 --> 00:42:11,320 and instant gratification, 788 00:42:11,320 --> 00:42:14,400 but paying for it presented all kinds 789 00:42:14,400 --> 00:42:15,720 of new challenges. 790 00:42:17,040 --> 00:42:21,480 The thing about bank cards is they were designed to be used in person. 791 00:42:21,480 --> 00:42:24,600 There are all sorts of security systems like signatures or pins 792 00:42:24,600 --> 00:42:28,200 to make sure that the person who is with the card was the one 793 00:42:28,200 --> 00:42:29,400 whose money it was. 794 00:42:29,400 --> 00:42:33,000 And that was all completely fine, until the internet came along, 795 00:42:33,000 --> 00:42:34,760 and suddenly you weren't physically present 796 00:42:34,760 --> 00:42:36,600 when you were spending your money. 797 00:42:36,600 --> 00:42:38,680 Fraud was completely rampant. 798 00:42:40,440 --> 00:42:43,320 Richard, how did you first get into the world of internet porn? 799 00:42:43,320 --> 00:42:44,800 Quite accidentally. 800 00:42:45,800 --> 00:42:48,320 Ah, the refrain of men everywhere. 801 00:42:48,320 --> 00:42:50,840 I'm meeting one of the pioneers of online card payments, 802 00:42:50,840 --> 00:42:52,440 Richard Gordon, 803 00:42:52,440 --> 00:42:55,080 who started out in the world of adult chat lines. 804 00:42:56,520 --> 00:42:59,600 I had been hired by a young company 805 00:42:59,600 --> 00:43:01,560 in the adult industry 806 00:43:01,560 --> 00:43:03,640 to do some research for them 807 00:43:03,640 --> 00:43:07,160 as to why they were having so many chargebacks. 808 00:43:08,480 --> 00:43:10,000 Before you get too excited, 809 00:43:10,000 --> 00:43:13,320 a chargeback isn't a genre of adult films. 810 00:43:13,320 --> 00:43:16,920 It's when a customer claims that they didn't make a transaction. 811 00:43:16,920 --> 00:43:22,800 To talk to two sexy girls for only 4.99 per minute, press two. 812 00:43:22,800 --> 00:43:28,600 25% of their customers say they never made the call. 813 00:43:29,640 --> 00:43:33,320 A quarter of their monthly income, people were denying it? 814 00:43:33,320 --> 00:43:34,480 Exactly right. 815 00:43:34,480 --> 00:43:37,560 So you call up your bank and you say, "It wasn't me," 816 00:43:37,560 --> 00:43:39,920 do they immediately take it off your statement? 817 00:43:39,920 --> 00:43:41,080 Well, they used to. 818 00:43:41,080 --> 00:43:43,320 You could just lie, then, surely? Absolutely. 819 00:43:43,320 --> 00:43:45,800 And that was a big part of it. 820 00:43:45,800 --> 00:43:48,520 It wasn't just the chat lines that hated chargebacks. 821 00:43:48,520 --> 00:43:50,280 The banks did, too. 822 00:43:50,280 --> 00:43:54,960 Each one cost about $12 to process back in the 1990s. 823 00:43:54,960 --> 00:43:57,600 So the banks put pressure on the adult industry 824 00:43:57,600 --> 00:43:59,640 to get their house in order. 825 00:43:59,640 --> 00:44:01,040 HE CHUCKLES 826 00:44:01,040 --> 00:44:04,000 And Richard was tasked with finding a solution. 827 00:44:06,440 --> 00:44:10,440 We built something called Electronic Authorization Systems, 828 00:44:10,440 --> 00:44:17,320 which basically analysed every transaction in real time 829 00:44:17,320 --> 00:44:21,080 to see if there were other calls from that same number. 830 00:44:21,080 --> 00:44:26,240 There were a series of algorithms that we had that analysed 831 00:44:26,240 --> 00:44:27,480 the transactions. 832 00:44:29,000 --> 00:44:32,720 Richard's system was able to cut down fraud by proving the chat line 833 00:44:32,720 --> 00:44:34,160 calls had been made. 834 00:44:36,480 --> 00:44:40,120 But then the internet came along, and once again, the banks had 835 00:44:40,120 --> 00:44:43,320 no means of checking if a card payment was genuine. 836 00:44:43,320 --> 00:44:47,680 Richard had to devise new ways to make sure that the banks were, 837 00:44:47,680 --> 00:44:50,080 excuse the pun, satisfied. 838 00:44:50,080 --> 00:44:54,080 The bankers did not want to be associated with anyone 839 00:44:54,080 --> 00:44:57,280 that was involved in the adult industry. 840 00:44:57,280 --> 00:45:01,760 So part of my job was to break that firewall down 841 00:45:01,760 --> 00:45:05,800 and open up the banking to the industry. 842 00:45:07,680 --> 00:45:11,000 Before accepting a payment, websites would ask Richard's company to run 843 00:45:11,000 --> 00:45:12,960 checks on the card to see if there was 844 00:45:12,960 --> 00:45:15,640 any dodgy activity going on. 845 00:45:15,640 --> 00:45:20,840 As we developed into the internet world, we just had to continuously 846 00:45:20,840 --> 00:45:24,800 upgrade and monitor the systems 847 00:45:24,800 --> 00:45:27,160 so that they could stay ahead of the fraud. 848 00:45:29,120 --> 00:45:31,520 Richard and other pioneers had proved to the banks 849 00:45:31,520 --> 00:45:35,880 that card payments could be made safely without the card present. 850 00:45:35,880 --> 00:45:39,600 React now to the demands of the internet marketplace or risk falling 851 00:45:39,600 --> 00:45:40,840 by the wayside. 852 00:45:40,840 --> 00:45:45,160 But by the mid 1990s, shopping online was gaining popularity. 853 00:45:45,160 --> 00:45:49,320 And so a simpler and even more secure system was needed. 854 00:45:49,320 --> 00:45:53,080 Worries about giving their credit card details are stopping many users 855 00:45:53,080 --> 00:45:54,320 from buying online. 856 00:45:54,320 --> 00:45:58,280 Enter Michael Stone and global credit agency Equifax. 857 00:45:58,280 --> 00:46:01,880 While Richard's system had used phone numbers and billing histories, 858 00:46:01,880 --> 00:46:05,520 Michael's elegant solution was just a number 859 00:46:05,520 --> 00:46:09,800 generated from the user's card details that verified the card. 860 00:46:09,800 --> 00:46:13,200 But crucially, retailers were not allowed to store it, 861 00:46:13,200 --> 00:46:16,760 so only the real cardholder would know the number. 862 00:46:16,760 --> 00:46:20,200 And the CVV number was quickly adopted worldwide 863 00:46:20,200 --> 00:46:22,880 and is still on every bank card today. 864 00:46:25,600 --> 00:46:30,000 Today, though, there are new threats to the security of the CVV number. 865 00:46:31,040 --> 00:46:33,120 At Visa Europe's London headquarters, 866 00:46:33,120 --> 00:46:34,280 they're at the front line 867 00:46:34,280 --> 00:46:37,240 in the battle to keep our money safe. 868 00:46:37,240 --> 00:46:40,040 I noticed there's a sign on the door here that says 869 00:46:40,040 --> 00:46:41,480 that this is the war room. 870 00:46:41,480 --> 00:46:44,120 Does it sometimes feel like you are at war? 871 00:46:44,120 --> 00:46:46,160 We're at war with the criminals, for sure. 872 00:46:47,160 --> 00:46:50,400 Leading her team into battle is Natalie Kelley, 873 00:46:50,400 --> 00:46:53,200 who's Visa Europe's head of risk. 874 00:46:53,200 --> 00:46:55,160 We have an entire risk operation centre. 875 00:46:55,160 --> 00:46:58,200 They're looking at transaction anomalies that come in every day. 876 00:46:58,200 --> 00:46:59,400 So if you could imagine, 877 00:46:59,400 --> 00:47:01,320 it's a stream of data that's coming in. 878 00:47:01,320 --> 00:47:03,480 Any time there's a spike in that data, 879 00:47:03,480 --> 00:47:06,320 we go in and investigate it and say, what's happening? 880 00:47:06,320 --> 00:47:07,880 Was it an enumeration attack? 881 00:47:07,880 --> 00:47:09,640 What do you mean by an enumeration attack? 882 00:47:09,640 --> 00:47:11,000 OK, so that's a great question. 883 00:47:11,000 --> 00:47:13,760 If you think of it like you have a locker 884 00:47:13,760 --> 00:47:16,480 and it's got three-digit codes on that locker. 885 00:47:16,480 --> 00:47:18,200 You could roll those numbers 1,000 times, 886 00:47:18,200 --> 00:47:20,080 and you're eventually going to get it right. 887 00:47:20,080 --> 00:47:24,440 Well, enumeration is the same thing, but with a bot. 888 00:47:24,440 --> 00:47:28,200 These bots can randomly generate millions of combinations 889 00:47:28,200 --> 00:47:33,200 of 16-digit card numbers, expiry dates and CVV numbers 890 00:47:33,200 --> 00:47:36,840 until they chance upon an active card. 891 00:47:36,840 --> 00:47:38,560 You're eventually going to get a hit, 892 00:47:38,560 --> 00:47:40,280 cos they're doing it rapidly, right? 893 00:47:40,280 --> 00:47:43,200 And then they take that card number and they go buy high-ticket 894 00:47:43,200 --> 00:47:46,800 transactions like five mobile phones, online TVs, anything 895 00:47:46,800 --> 00:47:49,640 that they can get and then convert to cash quickly on the black market. 896 00:47:49,640 --> 00:47:50,960 This is all automatic. 897 00:47:50,960 --> 00:47:54,680 You can just set it running and go to sleep while this does it for you. 898 00:47:54,680 --> 00:47:56,920 It's basically our AI against their AI. 899 00:47:56,920 --> 00:48:00,240 Oh, wow. A war of AI. Yes. 900 00:48:01,320 --> 00:48:03,040 Incredible. 901 00:48:03,040 --> 00:48:05,480 Artificial intelligence is everywhere in the world 902 00:48:05,480 --> 00:48:09,200 of modern finance, and much of it is unseen. 903 00:48:09,200 --> 00:48:12,240 The more AI machines analyse large amounts of data, 904 00:48:12,240 --> 00:48:15,280 the more they learn patterns and behaviour. 905 00:48:16,800 --> 00:48:21,080 VISA are so confident in their AI that they'll even enable victims 906 00:48:21,080 --> 00:48:24,240 of fraud to get their money back through their bank. 907 00:48:24,240 --> 00:48:26,840 But the criminals are nothing if not determined. 908 00:48:29,360 --> 00:48:31,960 I'll tell you, these guys are getting more sophisticated 909 00:48:31,960 --> 00:48:35,960 every day. If you think of how Amazon works, right? 910 00:48:35,960 --> 00:48:38,640 And it can tell you all the sellers and it rates the sellers 911 00:48:38,640 --> 00:48:40,960 and it rates the goods and contents that they've bought. 912 00:48:40,960 --> 00:48:44,080 They do the exact same thing on the dark web. 913 00:48:44,080 --> 00:48:47,600 So you can just get yourself a hacker for hire on the dark web? 914 00:48:47,600 --> 00:48:51,240 Yes. I didn't realise there was like an Amazon for hackers. 915 00:48:51,240 --> 00:48:54,640 That's absolutely extraordinary. Do you want me to show you? Yes, I do! OK. Yes, obviously. 916 00:48:56,200 --> 00:48:59,080 So this is the account. Oh, my word! 917 00:48:59,080 --> 00:49:01,200 So you can see BINs, expiration dates... 918 00:49:01,200 --> 00:49:04,800 But the number of ratings... Mm-hm. How extraordinary. 919 00:49:04,800 --> 00:49:07,760 So there's photographs... And there's the card. 920 00:49:07,760 --> 00:49:11,880 Which means faking card numbers in order to steal money. 921 00:49:11,880 --> 00:49:15,040 This is extraordinary. Absolutely extraordinary. 922 00:49:15,040 --> 00:49:18,600 Fraudsters openly selling their services on the dark web 923 00:49:18,600 --> 00:49:23,360 to other criminals and being rated for the quality of their work. 924 00:49:23,360 --> 00:49:25,360 You should ask me how they pay. 925 00:49:25,360 --> 00:49:27,040 How do they pay? 926 00:49:27,040 --> 00:49:29,720 They pay with bitcoin. 927 00:49:29,720 --> 00:49:31,320 And the interesting thing about it 928 00:49:31,320 --> 00:49:33,240 is they have three-factor authentication, 929 00:49:33,240 --> 00:49:34,680 which is actually very secure. 930 00:49:34,680 --> 00:49:36,880 I find it absolutely hilarious 931 00:49:36,880 --> 00:49:39,520 that there is no fraud amongst the fraudsters. 932 00:49:39,520 --> 00:49:41,080 Zero. 933 00:49:43,000 --> 00:49:46,400 Criminals are always looking for areas of weakness in a bank card 934 00:49:46,400 --> 00:49:47,600 that they can exploit. 935 00:49:47,600 --> 00:49:51,680 And it's up to the card companies to stay one step ahead. 936 00:49:53,120 --> 00:49:59,040 In less than 70 years, bank cards have gone from basic bits of plastic 937 00:49:59,040 --> 00:50:03,800 to sophisticated mini computers carried in our pockets. 938 00:50:03,800 --> 00:50:06,440 But the next big breakthrough might mean 939 00:50:06,440 --> 00:50:08,480 we don't need bank cards at all. 940 00:50:11,160 --> 00:50:14,720 Because the future of payments is biometric. 941 00:50:16,000 --> 00:50:19,400 Biometrics are already part of our daily lives, 942 00:50:19,400 --> 00:50:24,000 from going through passport control to unlocking your phone. 943 00:50:24,000 --> 00:50:26,400 And the banking industry is looking at it 944 00:50:26,400 --> 00:50:29,440 as a quick and secure way to pay. 945 00:50:29,440 --> 00:50:32,240 The term biometrics just means using your body 946 00:50:32,240 --> 00:50:35,000 as a way of identification. 947 00:50:35,000 --> 00:50:37,000 Light. COMPUTER VOICE: Light. 948 00:50:37,000 --> 00:50:38,880 Switch on. On. 949 00:50:38,880 --> 00:50:42,000 Now. OK. 950 00:50:42,000 --> 00:50:43,920 And it has a long history. 951 00:50:45,320 --> 00:50:49,400 In Paris in the 1800s, Alphonse Bethune developed a method 952 00:50:49,400 --> 00:50:52,800 of physical measurements to identify criminals. 953 00:50:54,040 --> 00:50:55,520 And by the 20th century... 954 00:50:55,520 --> 00:50:57,800 The local sheriff has picked up a suspect 955 00:50:57,800 --> 00:50:59,440 and promptly fingerprints him. 956 00:50:59,440 --> 00:51:03,120 ..using fingerprints to help capture the bad guys was common. 957 00:51:03,120 --> 00:51:04,920 As a means of identification, 958 00:51:04,920 --> 00:51:07,120 they are absolutely infallible. 959 00:51:07,120 --> 00:51:10,240 Beats. Bits. 960 00:51:10,240 --> 00:51:12,080 Then, by the 1950s... Boots. 961 00:51:13,080 --> 00:51:16,040 Bats. ..scientists have begun developing primitive voice 962 00:51:16,040 --> 00:51:18,280 recognition computer programs. 963 00:51:18,280 --> 00:51:19,800 Bots. 964 00:51:19,800 --> 00:51:22,480 OK. Are you sort of in position? Yes, I am. 965 00:51:22,480 --> 00:51:27,240 Early versions of face and iris recognition followed. 966 00:51:27,240 --> 00:51:29,760 If you look up here on this bar graph, you can see, 967 00:51:29,760 --> 00:51:31,400 it's 90% sure it's you, Mac. 968 00:51:36,000 --> 00:51:39,800 Now face recognition payment systems are being developed. 969 00:51:39,800 --> 00:51:42,760 Hopefully, you've felt it vibrate when you complete that left turn. 970 00:51:42,760 --> 00:51:45,400 At Visa's Innovation Centre, 971 00:51:45,400 --> 00:51:48,800 Richard Tomsett from tech company Onfido 972 00:51:48,800 --> 00:51:52,360 and Visa Europe's CEO Charlotte Hogg, 973 00:51:52,360 --> 00:51:56,080 they want to show me what the future of spending could look like. 974 00:51:57,120 --> 00:51:58,720 What's the big idea behind it? 975 00:51:58,720 --> 00:52:02,760 Why do you want facial recognition to be part of your payment system? 976 00:52:02,760 --> 00:52:05,480 If you move to a world where increasingly you use biometrics, 977 00:52:05,480 --> 00:52:08,760 and it can be face, it can be voice, it can be your thumbprint, 978 00:52:08,760 --> 00:52:10,040 it can be the way you type. 979 00:52:10,040 --> 00:52:12,880 You know, we're unique in lots of different ways. 980 00:52:12,880 --> 00:52:15,880 Once you move to that world, you can begin to take out the steps 981 00:52:15,880 --> 00:52:19,560 that we probably don't realise are quite clunky today. 982 00:52:19,560 --> 00:52:22,200 The face recognition system they're developing could be used 983 00:52:22,200 --> 00:52:25,680 to access your bank account and make online payments. 984 00:52:25,680 --> 00:52:29,360 Today they want me to set up facial ID for a bank account. 985 00:52:29,360 --> 00:52:33,720 I've already uploaded my driver's licence, which they'll store 986 00:52:33,720 --> 00:52:35,520 as proof of who I am. 987 00:52:35,520 --> 00:52:39,840 And a video of my face is now analysed by their AI system... 988 00:52:39,840 --> 00:52:42,040 Lovely. Never looked better. 989 00:52:42,040 --> 00:52:44,400 ..to verify that it's me. 990 00:52:44,400 --> 00:52:48,120 So what you're seeing in front here, the coloured axes are just showing 991 00:52:48,120 --> 00:52:50,240 where your face is pointing. 992 00:52:50,240 --> 00:52:52,600 OK. So that's fair enough. You've got a video of my face. 993 00:52:52,600 --> 00:52:56,080 You've worked out where my eyes, my nose and my mouth are and so on. 994 00:52:56,080 --> 00:52:58,640 But this is just a photograph of my driving licence. 995 00:52:58,640 --> 00:53:01,120 How do you get enough information out of this 996 00:53:01,120 --> 00:53:02,480 to say that I'm the same person? 997 00:53:02,480 --> 00:53:03,720 Yeah, that's a good question. 998 00:53:03,720 --> 00:53:06,000 So this is your video in the top left. 999 00:53:06,000 --> 00:53:08,480 And in the bottom left is the photo that we've extracted 1000 00:53:08,480 --> 00:53:09,720 from your driving licence. 1001 00:53:09,720 --> 00:53:11,280 And on the right-hand side, 1002 00:53:11,280 --> 00:53:13,720 the main areas that the model is focusing on 1003 00:53:13,720 --> 00:53:18,000 in order to be able to match your face to the driving licence. 1004 00:53:18,000 --> 00:53:19,880 It's basically saying you've got a pointy nose, 1005 00:53:19,880 --> 00:53:23,000 that's what it's saying. Yeah, right. 1006 00:53:24,040 --> 00:53:25,920 What if I broke my nose? 1007 00:53:25,920 --> 00:53:28,920 If you've got a very severe break and you look very different, 1008 00:53:28,920 --> 00:53:30,280 it might cause some issues. 1009 00:53:30,280 --> 00:53:31,560 But you can wear make-up. 1010 00:53:31,560 --> 00:53:33,520 You could grow a beard. Or have your lips done? 1011 00:53:33,520 --> 00:53:35,040 Yeah. Or wear glasses. 1012 00:53:35,040 --> 00:53:37,760 And because of the way the models have been trained, they'll deal 1013 00:53:37,760 --> 00:53:39,800 with that with no problem. 1014 00:53:39,800 --> 00:53:42,600 What if you taped your nose down? I'm sorry. 1015 00:53:44,040 --> 00:53:48,280 Overtime, then, how much can we expect this to start appearing 1016 00:53:48,280 --> 00:53:50,520 in the ways that we make payments? 1017 00:53:50,520 --> 00:53:52,800 I think you will start to see it more and more often. 1018 00:53:52,800 --> 00:53:55,600 I mean, after we see it today, when you're using your mobile phone. 1019 00:53:55,600 --> 00:53:58,920 Increasingly, we're going to move to a world where it'll be a sole set 1020 00:53:58,920 --> 00:54:01,080 of characteristics, of contextual characteristics, 1021 00:54:01,080 --> 00:54:02,440 including biometrics. 1022 00:54:03,400 --> 00:54:06,520 This app may be able to identify me without a problem, 1023 00:54:06,520 --> 00:54:08,640 thanks to my DISTINGUISHED nose. 1024 00:54:09,760 --> 00:54:12,520 But if we want to use tech like this in place of bank cards... 1025 00:54:12,520 --> 00:54:13,720 Hang on! 1026 00:54:13,720 --> 00:54:16,280 ..I also want to know that it can't be fooled. 1027 00:54:16,280 --> 00:54:18,520 This is you as a flat print-out. 1028 00:54:18,520 --> 00:54:21,040 That's absolutely hilarious. 1029 00:54:21,040 --> 00:54:24,120 So that's pretty persuasive, apart from the sheen on my hair. 1030 00:54:24,120 --> 00:54:26,760 The model recognises it's a spoof. As you turn it, 1031 00:54:26,760 --> 00:54:28,360 it gets increasingly confident 1032 00:54:28,360 --> 00:54:30,560 because it's much easier for it to see, 1033 00:54:30,560 --> 00:54:32,080 "OK. That's a 2D flat thing, right." 1034 00:54:33,240 --> 00:54:35,760 No offence, but that's quite a rubbish spoof. Can you do better? 1035 00:54:35,760 --> 00:54:38,160 What if you had, like a 3D model of my face? 1036 00:54:38,160 --> 00:54:39,240 A 3D model of your face. 1037 00:54:39,240 --> 00:54:41,120 Well, I don't have a 3D model of your face. 1038 00:54:41,120 --> 00:54:43,800 I do have a 3D model of another face. 1039 00:54:46,080 --> 00:54:50,000 I feel like I've just walked onto the set of a bad Bond movie. 1040 00:54:51,240 --> 00:54:53,040 That's genuinely terrifying. 1041 00:54:53,040 --> 00:54:54,480 It's good, isn't it? 1042 00:54:56,440 --> 00:54:58,640 And we'll put on some hair. 1043 00:54:58,640 --> 00:55:02,800 I'm completely horrified and delighted in equal measure. 1044 00:55:02,800 --> 00:55:05,840 I mean, look, I've come home from a night out once or twice 1045 00:55:05,840 --> 00:55:07,280 and looked like that. 1046 00:55:07,280 --> 00:55:10,360 So it has detected it looks like a face. 1047 00:55:10,360 --> 00:55:11,960 You could probably take it off now. 1048 00:55:15,360 --> 00:55:17,640 The model has very confidently seen 1049 00:55:17,640 --> 00:55:19,200 THE 3D mask is not a real person. 1050 00:55:19,200 --> 00:55:21,920 So the liveness check, as we call it, has failed. 1051 00:55:21,920 --> 00:55:24,720 And I wouldn't be able to pass through and create an account then. 1052 00:55:26,360 --> 00:55:28,240 No, mercifully. 1053 00:55:28,240 --> 00:55:30,600 The thing that's extraordinary about this approach, though, 1054 00:55:30,600 --> 00:55:33,400 is that the model is just looking at examples and working out 1055 00:55:33,400 --> 00:55:36,960 for itself which ones are real and which ones are by you telling it 1056 00:55:36,960 --> 00:55:38,600 with lots of examples. 1057 00:55:38,600 --> 00:55:40,600 Yes, that's exactly right. 1058 00:55:40,600 --> 00:55:44,440 Using artificial intelligence, the more examples of spoof faces 1059 00:55:44,440 --> 00:55:48,040 they show the system, the better that it gets at distinguishing real 1060 00:55:48,040 --> 00:55:49,960 faces from masks. 1061 00:55:49,960 --> 00:55:52,200 But what about the privacy issues around this use 1062 00:55:52,200 --> 00:55:54,280 of personal information? 1063 00:55:54,280 --> 00:55:56,840 Are you getting any pushback from customers about moving 1064 00:55:56,840 --> 00:55:58,360 towards this kind of technology? 1065 00:55:58,360 --> 00:56:02,120 Think increasingly, as you feel more secure, as you see the evidence 1066 00:56:02,120 --> 00:56:06,280 that you're buying and you're buying with biometrics and you are secure, 1067 00:56:06,280 --> 00:56:08,680 then people will adopt it. 1068 00:56:08,680 --> 00:56:11,840 Presumably, though, at some point, you will have a database 1069 00:56:11,840 --> 00:56:14,600 of an entire country's worth of faces. 1070 00:56:14,600 --> 00:56:16,120 No. 1071 00:56:16,120 --> 00:56:18,960 So we don't store data in that kind of way. 1072 00:56:18,960 --> 00:56:22,840 We'll only store data that we have permission to store. 1073 00:56:22,840 --> 00:56:27,320 So we obviously have to take a video of someone and then it will pass 1074 00:56:27,320 --> 00:56:28,720 through our system to be analysed. 1075 00:56:28,720 --> 00:56:32,200 But we'll only store that if we've been given explicit permission 1076 00:56:32,200 --> 00:56:34,080 from the user of the system to do that. 1077 00:56:34,080 --> 00:56:37,760 It's all very well for companies to say that they are acting 1078 00:56:37,760 --> 00:56:38,800 responsibly. 1079 00:56:40,440 --> 00:56:44,680 But this is new technology, regulation is lagging behind, 1080 00:56:44,680 --> 00:56:48,840 and it might not always be enough to just take their word for it. 1081 00:56:48,840 --> 00:56:51,760 It's one thing if you're just unlocking your smartphone, 1082 00:56:51,760 --> 00:56:55,320 but it's quite another when you realise the extent 1083 00:56:55,320 --> 00:56:58,840 to which data about who we are and what our faces look like 1084 00:56:58,840 --> 00:57:00,800 is being harvested. 1085 00:57:00,800 --> 00:57:05,480 Last year, an American company was fined £7.5 million 1086 00:57:05,480 --> 00:57:10,480 for harvesting 20 billion online images 1087 00:57:10,480 --> 00:57:15,120 with the intention, probably, of using them for facial recognition. 1088 00:57:16,720 --> 00:57:20,280 I think it's worth asking questions and being informed 1089 00:57:20,280 --> 00:57:21,880 about your own data. 1090 00:57:21,880 --> 00:57:24,040 Who has access to it? 1091 00:57:24,040 --> 00:57:28,360 Is it secure? And how could it be potentially used in future? 1092 00:57:30,640 --> 00:57:32,600 Technology never stays still. 1093 00:57:32,600 --> 00:57:35,240 It changes incredibly fast, 1094 00:57:35,240 --> 00:57:37,720 and it may well be that soon our bank cards 1095 00:57:37,720 --> 00:57:39,280 will be obsolete, 1096 00:57:39,280 --> 00:57:41,240 but whatever comes next... 1097 00:57:41,240 --> 00:57:43,720 Oh, it worked! 1098 00:57:43,720 --> 00:57:47,000 ..we can be sure that there are more brilliant ideas to come. 1099 00:57:52,120 --> 00:57:55,520 No-one in their right minds would describe this as high-tech, 1100 00:57:55,520 --> 00:57:57,840 and yet, hiding within it, 1101 00:57:57,840 --> 00:58:00,880 once you peel back those layers of plastic, 1102 00:58:00,880 --> 00:58:05,080 it's nothing less than a marvel of human ingenuity. 1103 00:58:06,920 --> 00:58:08,200 Next time... 1104 00:58:09,400 --> 00:58:10,560 Thanks. 1105 00:58:10,560 --> 00:58:13,240 The food delivery apps on your phone. 1106 00:58:14,840 --> 00:58:18,200 It's the story of pensioners in Gateshead ordering Greggs 1107 00:58:18,200 --> 00:58:19,960 in the 1980s. 1108 00:58:19,960 --> 00:58:23,000 20p - oh, if only! 1109 00:58:23,000 --> 00:58:26,000 Pizza that pioneered online delivery. 1110 00:58:26,000 --> 00:58:28,480 Does the pizza come out of the floppy drive? 1111 00:58:28,480 --> 00:58:32,520 Oh, and a little bit of submarine warfare and Soviet satellites. 1112 00:58:33,960 --> 00:58:35,760 BEEPING 1113 00:58:38,040 --> 00:58:41,120 To explore the interesting dilemmas behind some familiar pieces 1114 00:58:41,120 --> 00:58:44,040 of technology and hear some of my own thoughts, 1115 00:58:44,040 --> 00:58:47,560 go to... 1116 00:58:47,560 --> 00:58:49,960 ..and follow the links to the Open University.