You might not think about it very often,
but we are living through a golden age of technology.
Our homes and our pockets are full of inventions and gadgets
that 20 years ago would have been the stuff of science fiction.
Alexa, how exactly do you work?
Hmm, I don't know that. That's what we're going to find out.
These things have become such an integral part of our everyday lives
that we've forgotten to remember how clever they are.
I'm Professor Hannah Fry, and I want to open your eyes...
I'm having a great time!
..to the secret genius of everyday objects.
The ones that we take for granted, items that owe their existence
to generations of scientific innovation.
The Edison drove an electric car?
Yeah, this one.
In every episode,
I'm going to take one item and tear it apart, bit...
..by bit.
So now there's some stuff you can see.
Meet the people behind it...
Frankly, I thought many things were impossible.
..and unlock the remarkable...
Here is the clandestine listening device.
..and sometimes hilarious stories behind its invention.
Hello. Look at you!
This time, it's the bank card.
How much attention have you actually paid to this object
that you carry around with you all of the time?
I'll find out how a piece of ancient jewellery led to chip and pin.
He just took my mum's ring.
She's still upset about it. Yeah, she's still upset!
Why a man ironing in the 1960s...
Oh, it worked!
..revolutionised how data is stored on our cards.
And why we have Russian spies...
..to thank for contactless payments.
A bug? They put a bug in the seal? Absolutely.
So just so you know, we're not allowed to say where we are.
At all? No.
This is sort of top secret.
I did notice there weren't any signs outside, just barbed wire.
There's a reason for all of this secrecy and tight security.
And it's because we are at the biggest hub
for bank card transactions in Europe...
..the Visa Data Centre.
There are almost 4 billion of their bank cards in use
around the world, which makes Visa
one of the biggest bank card companies on the planet.
Have you ever let a TV crew inside? No, I don't think so.
We're in.
Every European card transaction goes through here.
This is where it all happens.
This is Rajat Taneja, Visa's head of technology.
Let's say this morning, I was at the train station.
I bought a coffee. I paid for it with my card.
What happens in that moment?
We have to verify the credential of the card.
We have to make sure there is no fraud going on.
We have to make sure that you have funds in your account.
We make an authorisation decision, send it back to the merchant's bank,
who then sends it to the merchant.
And all that happens in 300 milliseconds.
In the blink of an eye.
We do that, on an average day, nearly 700 million times.
Given my addiction to online shopping,
I think quite a few of those are from me.
That series of checks and approvals is only possible
thanks to your bank card.
Encoded securely within it is your unique information.
So every time that you swipe or tap or click,
your details can be verified
and the movement of your money can be authorised.
The thing is, I think all of us like to imagine that we have money.
But you haven't got money.
You've got data, just ones and zeros.
And all of that work that you do,
all of those numbers in your bank account,
all they mean is something that gives you permission
to talk to that computer over there in the corner.
The digital key that unlocks your cash is the humble bank card.
But how does a pocket-sized piece of plastic
make payments using just ones and zeros?
I'm going to take apart the bank card
and look at four key components,
from the microchip to the contactless antenna.
But we're going to start with the thin strip on the back
that encodes those ones and zeros onto the card.
It's called the magnetic stripe.
OK. So here's a bank card.
And on the back you have the little black line, the mag stripe.
Now, let me show you something with this.
So if I take some iron filings
and I just scatter them over the stripe...
And then tap away the excess.
You can see that the iron filings
are stuck to certain bits of the magnetic stripe.
Can you see that? Almost looks like a barcode, and it is, in a way.
It's ones and zeros, magnetic, not magnetic.
And it contains all the information that a bank card needs
to be able to complete your transactions.
So the first bit will be my card number, my account number,
then there'll be my name, my prefix,
and then things like the expiry date and the security code for the card.
All of that information contained in that tiny little strip.
It's quite clever, isn't it?
But where did the idea for this ingenious stripe come from?
Well, for that, first we have to go back...
..to the origin story of the bank card itself.
It's September 1958,
and the residents of the sleepy town of Fresno, California,
are guinea pigs in a bold experiment by the world's biggest bank.
Bank of America send all 60,000 of their Fresno customers
a new-fangled thing called a credit card.
Credit has been defined as man's confidence in man.
But people are used to paying with cash and cheques
and they don't trust this new plastic card.
And so the bank offer an incentive.
How about giving me a little credit?
Every card is preloaded with $300 to spend.
That's one way to persuade people.
Unsurprisingly, the trial, now known as the Fresno Drop,
is a huge success, as people flock to the shops...
People are always needing more money, more credit.
..to pay on plastic for the first time.
Do you have to use this exclusively yourself
or could you, if you were unwise enough, give it to your wife? Oh...
Probably wise not to answer that one.
12 months later,
more than 2 million cards have been sent out across California.
ARCHIVE: Credit card purchasing has become widely accepted.
And BankAmericard became a company that you may know...
..Visa.
The bank card had truly arrived.
But there was one problem with those early bank cards.
Taking payment was quite a difficult business.
You might remember these.
Some people called them the knuckle busters.
A charge card is used to make a sales slip.
But to everyone else, they were known as the ZipZap...
ZIP-ZAP!
..machine, probably for that reason.
And what they do is, they use carbon paper and pressure
to copy the embossed digits on your card
onto these little slips of paper.
And before any of you smart alecs try and pause the TV there,
those are fake details.
CHILD: How does the store get its money?
Well, the sales slip that was made out has several copies.
One copy was kept by the customer and the other by the seller,
who would send it off to the bank as proof of payment.
But the system was painfully slow and quite prone to error.
So if the bank card was ever going to successfully replace cash,
there needed to be a quicker way
of handing over our personal information.
The solution to speeding up payments
would come from an unexpected source - the CIA.
It's 1961, and we are in the midst of the Cold War.
The CIA is preparing to move into its new headquarters
in Langley, Virginia,
but the giant building poses a big security problem.
To demonstrate, I've flown to sunny Virginia
to have a look at the CIA building.
Not really. I've actually just come downstairs
in the building I work at to look at the BBC foyer instead.
But it kind of works, though, because in the BBC, like in the CIA,
there are certain parts of the building
that only certain people are allowed into.
And back in the day, it used to be that security guards
would just recognise your face.
Hi, Peter.
Hello.
Is this real audio or are we just, like, chatting?
I mean, imagine there's no distinction between the two.
I see. OK.
This is Dr Sean Vanatta.
He's an expert in US economic and social history.
Tell me about what was going on at the CIA at the time.
So after World War II, with the rise of the Cold War,
the government agencies are expanding.
And so the old ways of doing security,
where you have a guard at the door
who recognises people coming in and out, you know,
that just doesn't work any more.
It's quite a big ask... It's quite a big ask.
..for a security guard to learn thousands of faces.
But what has all of this got to do with the mag stripe?
Well, the CIA asked computer innovators IBM
to try and create a secure ID pass.
IBM is working on a variety of technologies
to basically input information into computer systems,
one of which is the mag stripe,
which has digital information.
The ones and zeros on magnetic tape
are just magnetic bits and not magnetic bits,
and that's how you store data.
ARCHIVE: Once data has been processed by a computer
and recorded on tape,
it may simply be stored in this form.
IBM had the idea to give CIA employees a card
with a unique strip of tape that identified who they were.
It would be the first digital security pass.
If only they could figure out how to attach the tape to plastic cards.
And that is where engineer Forrest Parry and his wife Dorothea come in.
One version of the story is that Parry is working.
You know, his wife is at home.
He sees his wife, like, ironing his shirts, got up and got some mag tape
and a bit of plastic.
Put it together, put it on the ironing board,
tried to soften the plastic to get it to stick,
and that seemed to work.
I just really like the idea that man does ironing.
It's a big enough news story to, like, make headlines.
That really amuses me.
Actually, most reports say that it was Dorothea
who had the brainwave, so we shouldn't give Parry all the credit.
Now, as a professor, I think it's only right
to do some due diligence here using some specialised equipment.
All right, so we've got plastic cards, we've got a bit of mag strip,
which I don't think I'd quite clocked
that it is exactly the same stuff that cassettes are on.
It's basically just magnetic tape. Of course, this is a reference
that no-one under the age of 30 will understand at all,
but anyway, let's move on. OK.
So we're going to iron this on there, then?
I think it's likely that we're going to make a horrid mess here,
but we'll see.
Like I said, very scientific.
There it is.
So we just kind of put it on. Hold it for a few seconds.
This could go very badly.
Let's have a look. What do we have?
Oh, it worked!
It properly worked.
Hey! We did it. A bank card.
You might be wondering why it was that mag stripes took off
when there were other potential technologies that could have worked.
And the reason is because IBM did something very clever
and very sneaky.
Their ultimate business was about selling gigantic computers,
so they deliberately didn't patent the mag stripe
so that everybody would go out and use it and get it cheaply
and then have to buy one of their massive, expensive computers
to get it all to work.
And that is exactly what happened.
The ID card success led to the first mag stripe bank card in 1969,
and IBM started making millions
from the sale of computer systems needed
to read those magnetic stripes.
Even now, more than 60 years on from Forest Parry's smart idea,
a black stripe remains a fixture on our bank cards.
But the mag stripe era is coming to an end
because of a fundamental flaw in the technology
that has cost banks and businesses billions.
I was once branded as Britain's greatest fraudster.
Meet Tony.
Tony knows more than most people about the mag stripe's weaknesses,
because he used to exploit them.
I started cloning credit cards when I was 15.
I'm now 48, so it was a long time ago.
Skimming is where someone takes a credit card
and they swipe it through a machine
that takes a cloned copy of that credit card.
The mag stripe is so easy to skim because it's not encrypted
and it's just there, open.
This is a card reader.
But to people like Tony, it's called a grabber,
for reasons you can probably guess.
I would take one of these in to someone that I had work in,
like in a place like this,
and I'd ask them to just keep it down the back,
away from where the customers are.
The card goes behind the counter, they swipe the card,
and then they take a clone of the card at the same time.
The customer would be none the wiser.
That's how simple it is.
Hold it there, Tony.
So if skimming mag stripes is this easy,
when did the banks find out?
Let's go back to Sean.
Very early on, people realised
that copying the information on the mag stripe
is not any different than sort of copying
one audio cassette to another.
If they knew in the 1970s,
how did they possibly end up being popular?
Within the banking industry, there are lots and lots of banks.
Lots of them are small.
They need essentially the cheapest solution possible.
So the mag stripe offers that. It's low cost, it's widely available,
it's easy to manufacture. It's worse than useless,
it's actually really dangerous to adopt this technology.
Banks doing something they knew was risky and dangerous?
Doesn't sound like them.
Back to Tony.
I had a girl that was working in a delicatessen for me,
and on the first Saturday that she used the grabber,
she got 300 card numbers.
And before you know it,
I'm committing countless amounts of fraud.
And how much money were you making?
Er, no comment.
Tony didn't clone the cards himself.
He'd leave that for a techie like Sol.
Seconds after plugging in the grabber,
Sol has got the skimmed card details up on his laptop -
the 16-digit card number,
the name, expiry date,
everything you need in the '90s to make a card payment.
It's all ready to be put onto the card.
And then using a card writer,
he puts that mag stripe data onto a blank card.
All I have to do is press a little button, swipe the card like that.
And it's written.
In total, it's taken less than five minutes
to create this forged bank card.
Well, that sounds easy.
Where's the catch?
I was eventually caught.
I jumped bail and I went on the run
and spent the next six years of my life running from the police.
Ah, there's the catch.
Tony was eventually sentenced to 12 months in prison.
In prison, I reformed.
I learned a lot of lessons and came out a different person.
These days, Tony is fighting for the other side,
advising businesses on how to avoid being the victim of fraudsters.
So that's the story of how the mag stripe came to be.
But with it being so easy to skim,
we had to find a way to make our cards safer.
The solution - to embed the card with its very own microchip,
also known as chip and PIN.
Unfortunately, you can't just iron a microchip onto a piece of plastic.
Modern bank cards need a slightly more sophisticated assembly.
Thames Technology is one of the few companies in the UK
producing bank cards from scratch.
From this factory, they make almost 8 million of them a year.
Have you got your wallet on you? No.
This is general manager Che Colford.
Have you got your wallet? Can I borrow it?
OK. So to me, the first thing that jumps out at me is his railcard,
where he looks very lovely.
When you look at these things, they're sort of all the same.
But are you looking at those and seeing different things
to what I'm seeing? Yeah. So with that particular one,
you'll see that's a luminous ink
and you see along the edge, it's an orange core. Yeah.
The colour of that mag stripe is different to the normal one.
Oh, yeah. So that's how it's evolved over time
with different finishes, different materials
and different personalisation methods.
You know when you're in a restaurant with friends
and everyone puts their card in,
I imagine that's an exciting moment for you.
You look at every single one of them. Thanks for your wallet, Chris.
I'll just hold on to that for you. Don't worry about it.
I promise we'll get to chip and pin in a minute.
But let's just see how Che makes bank cards first.
The bank card starts its life as simple blank sheets of plastic,
which are loaded into a giant printer.
Then, Forrest, or rather, Dorothea's mag stripe is added.
The printouts are sandwiched between two laminate sheets
and popped into an oven.
This is basically a sandwich toaster? More or less.
What comes out...
..is a solid piece of plastic,
which is then punched out into individual bank cards.
And now the bit we've all been waiting for,
how the chip is installed.
And this is where we place the chip into the card.
So we create the pocket where the chip is going to sit.
The chip is then glued into the card.
We then do various electrical testing to make sure it's live.
And then that's a completed card,
so take one out.
Look at that!
How strange to have something at the end that feels so familiar.
We might think we're familiar with our bank card,
but have you ever had a close-up look?
I mean, really close.
I've got the chip from a bank card under a microscope here.
This is the underside of it,
the bit that you never see.
There's all sorts of detail.
There's the little chip in the middle.
There's these gold wires holding it in place
and the circuitry around the edge.
So why is the chip so much more secure
than the more traditional mag stripe?
Well, the mag stripe gives you the same number every single time,
whereas the chip is much cleverer.
It's more like a miniature computer, and it gives you a unique code
every time that it's used.
Unlike the mag stripe, the chip doesn't reveal all the data needed
to copy the card.
The information the chip sends changes every transaction,
which makes it far harder to copy.
It's an ingenious device, and there are a few competing claims
about who originally came up with the idea for it.
But there's one story that I particularly like.
It's a story about the eccentric French inventor, Roland Moreno,
because he said that the idea came to him in a dream.
A dream... about signet rings.
Signet rings were a very big hit during the Middle Ages.
And the signet, that's the picture in the middle,
would either be a family crest or a monogram
or some really intricate picture,
essentially anything that made it really, really hard to copy.
So then, if you were ever sending an important document,
to prove that it came from you,
you would use this almost like a signature
by pressing it into hot wax.
Legend has it that way back in the 14th century,
King Edward III declared that his official documents
should be signed using his unique signet seal,
essentially an early version of
"If you like it, then you should have put a ring on it."
Hundreds of years later,
Roland Moreno would take this idea of ancient authentication
and turn it into one of the most successful technologies
of the 21st century.
His way of looking at life was always different.
You couldn't stop his brains from working.
You sort of had this mad, crazy inventor with his crazy hair.
Meet Marianne and Julia,
Roland Moreno's daughters.
My father, in the early '70s to mid-'70s,
really had this wish that physical money would disappear.
No more cash, no more chequebooks.
The microchip revolution had made electronics
smaller than ever thought possible,
and Roland's dream was to put one on a ring as a way of paying.
It would be a modern-day signet ring.
So in 1974, he set to work building a prototype in his workshop.
And that prototype has been in storage for years,
until we turned up with a camera crew.
Seeing these objects for the first time in many years,
it's actually quite moving.
He thought it would be very practical to have your payment card
on you all the time.
So he put the chip card on my mum's ring, actually.
And the idea would be that everyone could walk around
with a chip on their finger.
Sticking out from the microchip were these 16 tiny little legs.
The idea was that you would insert these legs
into a reader in the shops to make an electronic payment,
which is great for banking security,
terrible for jumpers.
He just took my mum's ring without asking her
what she thought about it.
She's still upset about it. Yeah, she's still upset about it!
As much as he tried,
Roland just couldn't get the banks to take on his idea,
but he refused to give up.
So then he had the idea of putting the chip on a piece of plastic.
And so you would use this card and put a secret code.
Does that sound familiar?
What Roland had invented
was the world's first chip and pin card and reader.
And this is it.
I think it's a beautiful object.
For a sprinkling of added jeopardy,
Roman made it that if you got the pin wrong three times in a row,
the chip would self-destruct.
Like a real-life James Bond gadget.
Once again, the banks were hesitant,
but there was interest from elsewhere.
In 1983, France Telecom realised that Moreno's chip card
could be preloaded with credit
and used in phone booths, replacing coins.
It was great as a teenager to use my dad's invention
to call my parents or my friends or my lover.
It was hugely successful, and the watching banks wanted in.
So by 1992, Roland's chip and pin
was mandatory on all bank cards in France.
REPORTER: When the bill arrives at a Parisian cafe, you don't need a pen.
You need a PIN number.
It changed the way almost everyone on the planet daily uses money.
Roland got a patent for his idea.
And when he died in 2012 aged 66, his company had made millions.
I do feel proud, extremely proud
of this invention started in a little room in '74 in Paris
by this crazy inventor.
He was celebrated in France.
But it took us a little while on this side of the Channel
to really appreciate the genius of his idea.
I find it slightly embarrassing
that we are lagging still ten years behind the French.
But in 2003, we finally caught up.
The way we use credit and debit cards is to change significantly.
The so-called chip and pin credit card system is going nationwide.
I think it's fantastic. Cut down on all that fraud, yeah.
Chip and pin was such an improvement on the mag stripe
that it cut counterfeit card fraud by over 50%,
and typing in your numbers quickly became the norm.
But who wants the hassle
of actually inserting your card into the terminal?
The next component is a secret wire hiding inside your bank card
that makes it possible for you to pay with a tap.
It is the contactless antenna.
My producer has very kindly lent me her bank card
and I'm going to drop it in this, which isn't a glass of water,
but a glass of acetone.
Acetone is essentially nail varnish remover.
This is sort of a super-strength version.
And initially, it doesn't look like much is happening.
But because the card is made of PVC...
Oh. Whoo!
It's quite stinky.
..you can see, actually, little bubbles starting to form
on the signature panel, and it's peeling away already.
And I think the mag stripe is starting to come away as well.
It's being destroyed in front of my very eyes.
It's about half an hour later.
And... I mean, it looks quite different.
All of the plastic has just curled off
and then sticking out of the wreckage,
there's just this very thin hint of a wire,
which I think we should fish out.
Let's try.
I'm trying to not get nail polish remover on my nicely done nail.
OK, here we go.
Look at that, it looks like a spider.
Wow.
There's loads of it.
So this is what's left.
This bit here is the chip
that does the job when you're doing chip and pin.
The really clever thing
is that all of this wire around the edge,
this is essentially an antenna.
And so when you're using wireless,
the handset gives off a little radio signal
which gets picked up by this wire
and it gives just enough to power the chip
to authenticate the transaction
and send it back out through the antenna
to be read by the card reader.
And the best thing about it -
I mean, I know your card looks a little bit different now,
I'll accept that, but it should still work.
So I've ordered a coffee.
Here we go.
Thank you very much.
How much is it? That'll be £3, please. I'll do that for you.
Let's try it.
CARD READER BEEPS
That's all done. Great.
It worked! I'm so impressed.
I know what you're thinking.
First, my producer needs a new bank card.
But second, how did they get an 85cm-long antenna
inside a card that's less than a millimetre thick?
Let's go back to the factory
and take a closer look at the filling of that card sandwich.
Is this where the magic happens?
So that is where the aerial antenna is
for the contactless element of the chips.
Before the cards go into the oven,
a sheet of 48 copper antennas is popped into the middle of it.
At this factory, they go through thousands of miles of wire a year
making their contactless cards.
It does look quite like a sandwich. Yeah.
You've got your completed sandwich ready for the next stage.
And the oven then seals it in place.
The technology behind contactless payments
is called radio-frequency identification, or RFID.
And that might seem like a new tech.
But its origins can be traced back almost 80 years to Russia.
ARCHIVE: This is the Kremlin, citadel of Russian communism.
Leon Theremin was a brilliant Russian inventor
obsessed with radio frequencies.
EERIE WAILING
And if you've seen just about any old science fiction film...
..you will be familiar with the sound of his most famous invention.
It's like a crying cat!
HIGH-PITCHED WAILING
The theremin has to be
one of the strangest musical instruments ever created,
because you because you don't actually touch it.
Instead, you interrupt the electromagnetic field of it
using your hands.
And that changes the frequency of the sound, like this.
PITCH WAVERS
Like a bad opera singer.
Leon saw the potential to turn it into a musical instrument.
Sci-fi films have never sounded the same since.
But in 1938,
Leon was arrested and accused of being a counter-revolutionary.
The musician was sent to a gulag labour camp.
But what has all of this got to do
with the contactless antenna in our bank cards?
Well, in a secret laboratory in the gulag,
the Soviets put Leon's physics expertise
to a far more sinister use.
I want you to imagine that it's 1945 in Soviet-era Russia.
The Second World War has just ended.
And in Moscow, the Russians have a gift
for the American ambassador.
Out of wood, they have carved
a copy of the great seal of the United States,
and they present it to the ambassador
with a group of schoolchildren
as this great message of hope and goodwill for the future.
It's a gift, essentially, that the ambassador cannot refuse.
And so he hangs it up in pride of position in his office.
But there's a twist to this tale because, as you might have guessed,
this seal is not quite the message of friendship
that the Russians were pretending it was,
because hiding inside of that wooden carving
is a tiny little device known as "the thing".
Do you remember a few years ago, when it was revealed
at the United Nations
that the Russians actually placed a sophisticated bugging device
inside the great seal of the United States?
Oh, yes. Leon had spent his years in the gulag
building an extraordinary new kind of spying device.
People come to me when nobody else will do it.
Yeah.
This is Neil Smith.
He's an amateur radio experimenter.
Let's start with the most obvious question,
which is, what is "the thing"?
Basically, it's an unpowered, entirely passive listening device
that you could hide almost anywhere.
A bug, they put a bug in the seal? Absolutely.
REPORTER: Technological breakthroughs in miniaturisation
have made possible the development of these hard to detect devices.
But why have Neil explain to us how The Thing worked
when we could have him go out and build one?
And as far as we know, no-one has tried this since the Russians.
So what the Russians did, inside...
..they mounted one of these.
So this contains the little microphone element,
and this is the external aerial.
And that's really all there is to it.
It's not quite as simple as Neil makes out.
Let me try to explain.
The Thing didn't have its own power source,
no battery, nothing like that.
And that meant that, when the Americans swept it for bugs,
nothing was detected.
Instead, a tiny microphone inside it was activated by a strong
electromagnetic signal blasted at the antenna
from outside of the embassy.
A wireless microphone, such as the one placed
in the seal's hidden cavity,
can be smaller than an eraser on a pencil.
That same aerial then transmitted the voices in the room
to a Russian van outside.
Everything said in a bugged room can be tape recorded
as far as a mile away without using any telltale wires.
How many hours did you spend doing this?
Now, Neil doesn't quite have
the resources of a global superpower,
but he has spent 200 hours in his shed working on this.
Let's hope it actually works, shall we?
We feel very excited to be the first civilians
who are making a Soviet-era spy device and testing out today.
Whether or not it works, I guess, is a different question.
Our researcher, Jack, is going to play the role
of the US ambassador, while Neil and I are Soviet spies.
Testing, testing. Good to go.
So this is the receiver? Yep.
OK. Hit us with your top secrets, Jack.
black sheep.
# Bah, bah, black sheep Have you any wool? #
We are sending an electromagnetic signal to The Thing.
And Neil now just has to make some minuscule tweaks to the receiver
and transmitter frequencies.
It's trial and error.
# Yes, sir, yes, sir Three bags full... #
And there's a lot of error.
Now, if this seems to be quite a boring shot, it's because no-one
in the crew can move.
Otherwise, it mucks up everything.
# Bah, bah, black sheep Have you any wool? #
But an hour of listening to a hissing radio
in a stairwell at the BBC...
It's there, it's there!
# One for the master One for the dame... #
..finally pays off when suddenly the crackliest
of faint voices can be heard.
STATIC
It's it.
That's it. That's it. That's it. That's it.
FAINT GARBLED SPEECH
STATIC
# Bah, bah, black sheep Have you any wool? #
STATIC
I definitely heard it.
I think that counts as a success.
HE EXHALES
Let's go tell Jack. Shall we go tell Jack?
Jack, Jack, we heard you. We heard you. No way.
I know that you were doing that for about an hour. Well done.
Well done. Very good.
OK, I'm not sure you could exactly use us to gather intelligence,
but we did at least get a very faint signal.
It seems quite a beautiful piece of carving.
Theremin's original betrayed the secrets
of four successive ambassadors for an incredible seven years.
All right, open it up.
And here is the...here is the clandestine listening device.
And when the Americans did finally find it, they weren't best pleased.
I have here today a concrete example of Soviet espionage.
It might feel like we're going off on a bit of a tangent here,
but actually this story is incredibly relevant to the idea
of bank cards.
When you're paying contactless, you need somehow to power
that very tiny microchip that's in there.
Yeah, I don't know if you've ever taken a bank card to pieces...
You know, it's funny you should mention that. ..but the little wire
that goes around it is an aerial, so it picks up the signal.
And because it's quite close, it's quite a good loud signal,
which you can then turn into electricity
to power your little chip. In effect, then,
the bank card is like The Thing hanging in the ambassador's wall
and the hand-held payment device the shops are using
to collect the money,
that is like all of the Russians sitting in a room
less than half a mile away,
listening in and transmitting electromagnetic waves.
Absolutely.
Leon was eventually released from the gulag.
ELECTRIC TONES WARBLE
He died in 1993, aged 97.
But it was another 14 years before the banks began
to utilise his technology.
From today,
these contactless cards are being launched.
Contactless was introduced in the UK back in 2007.
Next month, Barclays will allow you to make payments under £10
without entering a PIN number.
But not everyone was convinced.
It's not...not much trouble to stick four numbers in.
Now, around 70% of all card payments are made this way.
Contactless has certainly made paying for things easier
when you're out and about,
but if you want even more convenience...
BEEP
..then on next component is the reason you can buy stuff
without leaving your home at all.
The three, or sometimes four, numbers on the back of your card
is a secure identifier that protects you when you're spending online,
although not from those drunken eBay purchases you keep making.
It's the CVV, or card verification value.
So when you make a payment online, those CVV numbers,
they're not stored by the online portal.
And that is because, if their database ever gets breached
or stolen, the long card number on its own
can't really do that much.
You need these three numbers.
And this effectively, then, is like a little signature that proves
that the person making the payment is the one
that has the physical card.
The CVV was introduced in the late '90s to reduce fraud
as online payments started to become more popular.
But if you want to find out how the CVV came about,
then you're going to have to head back to the murky world
of the early internet age.
Imagine a world where every word ever written, every picture
ever painted and every film ever shot could be viewed instantly
in your home via an information superhighway.
Imagine that moment.
The World Wide Web has come on the scene.
It's the early 1990s.
Just purchasing things from your home computer
is a completely novel idea.
This is a shopping centre, and here it says
it's just off the information superhighway.
But using cars to pay online was so slow and insecure
that it looked like online shopping would just never catch on.
And like with any technology,
what online shopping needed was early adopters to drive demand.
And there was one group who took a particularly keen interest.
Before online shopping,
if you wanted to buy adult materials,
you either had to visit a specialist shop
or send away for it with a check in the mail.
That is a slow old business.
By the time it arrives, the mood might have gone.
If you have a home computer and a modem, access to information
is almost limitless.
However, some of that information is strictly for adults.
The internet offered a tantalising glimpse of instant content
and instant gratification,
but paying for it presented all kinds
of new challenges.
The thing about bank cards is they were designed to be used in person.
There are all sorts of security systems like signatures or pins
to make sure that the person who is with the card was the one
whose money it was.
And that was all completely fine, until the internet came along,
and suddenly you weren't physically present
when you were spending your money.
Fraud was completely rampant.
Richard, how did you first get into the world of internet porn?
Quite accidentally.
Ah, the refrain of men everywhere.
I'm meeting one of the pioneers of online card payments,
Richard Gordon,
who started out in the world of adult chat lines.
I had been hired by a young company
in the adult industry
to do some research for them
as to why they were having so many chargebacks.
Before you get too excited,
a chargeback isn't a genre of adult films.
It's when a customer claims that they didn't make a transaction.
To talk to two sexy girls for only 4.99 per minute, press two.
25% of their customers say they never made the call.
A quarter of their monthly income, people were denying it?
Exactly right.
So you call up your bank and you say, "It wasn't me,"
do they immediately take it off your statement?
Well, they used to.
You could just lie, then, surely? Absolutely.
And that was a big part of it.
It wasn't just the chat lines that hated chargebacks.
The banks did, too.
Each one cost about $12 to process back in the 1990s.
So the banks put pressure on the adult industry
to get their house in order.
HE CHUCKLES
And Richard was tasked with finding a solution.
We built something called Electronic Authorization Systems,
which basically analysed every transaction in real time
to see if there were other calls from that same number.
There were a series of algorithms that we had that analysed
the transactions.
Richard's system was able to cut down fraud by proving the chat line
calls had been made.
But then the internet came along, and once again, the banks had
no means of checking if a card payment was genuine.
Richard had to devise new ways to make sure that the banks were,
excuse the pun, satisfied.
The bankers did not want to be associated with anyone
that was involved in the adult industry.
So part of my job was to break that firewall down
and open up the banking to the industry.
Before accepting a payment, websites would ask Richard's company to run
checks on the card to see if there was
any dodgy activity going on.
As we developed into the internet world, we just had to continuously
upgrade and monitor the systems
so that they could stay ahead of the fraud.
Richard and other pioneers had proved to the banks
that card payments could be made safely without the card present.
React now to the demands of the internet marketplace or risk falling
by the wayside.
But by the mid 1990s, shopping online was gaining popularity.
And so a simpler and even more secure system was needed.
Worries about giving their credit card details are stopping many users
from buying online.
Enter Michael Stone and global credit agency Equifax.
While Richard's system had used phone numbers and billing histories,
Michael's elegant solution was just a number
generated from the user's card details that verified the card.
But crucially, retailers were not allowed to store it,
so only the real cardholder would know the number.
And the CVV number was quickly adopted worldwide
and is still on every bank card today.
Today, though, there are new threats to the security of the CVV number.
At Visa Europe's London headquarters,
they're at the front line
in the battle to keep our money safe.
I noticed there's a sign on the door here that says
that this is the war room.
Does it sometimes feel like you are at war?
We're at war with the criminals, for sure.
Leading her team into battle is Natalie Kelley,
who's Visa Europe's head of risk.
We have an entire risk operation centre.
They're looking at transaction anomalies that come in every day.
So if you could imagine,
it's a stream of data that's coming in.
Any time there's a spike in that data,
we go in and investigate it and say, what's happening?
Was it an enumeration attack?
What do you mean by an enumeration attack?
OK, so that's a great question.
If you think of it like you have a locker
and it's got three-digit codes on that locker.
You could roll those numbers 1,000 times,
and you're eventually going to get it right.
Well, enumeration is the same thing, but with a bot.
These bots can randomly generate millions of combinations
of 16-digit card numbers, expiry dates and CVV numbers
until they chance upon an active card.
You're eventually going to get a hit,
cos they're doing it rapidly, right?
And then they take that card number and they go buy high-ticket
transactions like five mobile phones, online TVs, anything
that they can get and then convert to cash quickly on the black market.
This is all automatic.
You can just set it running and go to sleep while this does it for you.
It's basically our AI against their AI.
Oh, wow. A war of AI. Yes.
Incredible.
Artificial intelligence is everywhere in the world
of modern finance, and much of it is unseen.
The more AI machines analyse large amounts of data,
the more they learn patterns and behaviour.
VISA are so confident in their AI that they'll even enable victims
of fraud to get their money back through their bank.
But the criminals are nothing if not determined.
I'll tell you, these guys are getting more sophisticated
every day. If you think of how Amazon works, right?
And it can tell you all the sellers and it rates the sellers
and it rates the goods and contents that they've bought.
They do the exact same thing on the dark web.
So you can just get yourself a hacker for hire on the dark web?
Yes. I didn't realise there was like an Amazon for hackers.
That's absolutely extraordinary. Do you want me to show you? Yes, I do! OK. Yes, obviously.
So this is the account. Oh, my word!
So you can see BINs, expiration dates...
But the number of ratings... Mm-hm. How extraordinary.
So there's photographs... And there's the card.
Which means faking card numbers in order to steal money.
This is extraordinary. Absolutely extraordinary.
Fraudsters openly selling their services on the dark web
to other criminals and being rated for the quality of their work.
You should ask me how they pay.
How do they pay?
They pay with bitcoin.
And the interesting thing about it
is they have three-factor authentication,
which is actually very secure.
I find it absolutely hilarious
that there is no fraud amongst the fraudsters.
Zero.
Criminals are always looking for areas of weakness in a bank card
that they can exploit.
And it's up to the card companies to stay one step ahead.
In less than 70 years, bank cards have gone from basic bits of plastic
to sophisticated mini computers carried in our pockets.
But the next big breakthrough might mean
we don't need bank cards at all.
Because the future of payments is biometric.
Biometrics are already part of our daily lives,
from going through passport control to unlocking your phone.
And the banking industry is looking at it
as a quick and secure way to pay.
The term biometrics just means using your body
as a way of identification.
Light. COMPUTER VOICE: Light.
Switch on. On.
Now. OK.
And it has a long history.
In Paris in the 1800s, Alphonse Bethune developed a method
of physical measurements to identify criminals.
And by the 20th century...
The local sheriff has picked up a suspect
and promptly fingerprints him.
..using fingerprints to help capture the bad guys was common.
As a means of identification,
they are absolutely infallible.
Beats. Bits.
Then, by the 1950s... Boots.
Bats. ..scientists have begun developing primitive voice
recognition computer programs.
Bots.
OK. Are you sort of in position? Yes, I am.
Early versions of face and iris recognition followed.
If you look up here on this bar graph, you can see,
it's 90% sure it's you, Mac.
Now face recognition payment systems are being developed.
Hopefully, you've felt it vibrate when you complete that left turn.
At Visa's Innovation Centre,
Richard Tomsett from tech company Onfido
and Visa Europe's CEO Charlotte Hogg,
they want to show me what the future of spending could look like.
What's the big idea behind it?
Why do you want facial recognition to be part of your payment system?
If you move to a world where increasingly you use biometrics,
and it can be face, it can be voice, it can be your thumbprint,
it can be the way you type.
You know, we're unique in lots of different ways.
Once you move to that world, you can begin to take out the steps
that we probably don't realise are quite clunky today.
The face recognition system they're developing could be used
to access your bank account and make online payments.
Today they want me to set up facial ID for a bank account.
I've already uploaded my driver's licence, which they'll store
as proof of who I am.
And a video of my face is now analysed by their AI system...
Lovely. Never looked better.
..to verify that it's me.
So what you're seeing in front here, the coloured axes are just showing
where your face is pointing.
OK. So that's fair enough. You've got a video of my face.
You've worked out where my eyes, my nose and my mouth are and so on.
But this is just a photograph of my driving licence.
How do you get enough information out of this
to say that I'm the same person?
Yeah, that's a good question.
So this is your video in the top left.
And in the bottom left is the photo that we've extracted
from your driving licence.
And on the right-hand side,
the main areas that the model is focusing on
in order to be able to match your face to the driving licence.
It's basically saying you've got a pointy nose,
that's what it's saying. Yeah, right.
What if I broke my nose?
If you've got a very severe break and you look very different,
it might cause some issues.
But you can wear make-up.
You could grow a beard. Or have your lips done?
Yeah. Or wear glasses.
And because of the way the models have been trained, they'll deal
with that with no problem.
What if you taped your nose down? I'm sorry.
Overtime, then, how much can we expect this to start appearing
in the ways that we make payments?
I think you will start to see it more and more often.
I mean, after we see it today, when you're using your mobile phone.
Increasingly, we're going to move to a world where it'll be a sole set
of characteristics, of contextual characteristics,
including biometrics.
This app may be able to identify me without a problem,
thanks to my DISTINGUISHED nose.
But if we want to use tech like this in place of bank cards...
Hang on!
..I also want to know that it can't be fooled.
This is you as a flat print-out.
That's absolutely hilarious.
So that's pretty persuasive, apart from the sheen on my hair.
The model recognises it's a spoof. As you turn it,
it gets increasingly confident
because it's much easier for it to see,
"OK. That's a 2D flat thing, right."
No offence, but that's quite a rubbish spoof. Can you do better?
What if you had, like a 3D model of my face?
A 3D model of your face.
Well, I don't have a 3D model of your face.
I do have a 3D model of another face.
I feel like I've just walked onto the set of a bad Bond movie.
That's genuinely terrifying.
It's good, isn't it?
And we'll put on some hair.
I'm completely horrified and delighted in equal measure.
I mean, look, I've come home from a night out once or twice
and looked like that.
So it has detected it looks like a face.
You could probably take it off now.
The model has very confidently seen
THE 3D mask is not a real person.
So the liveness check, as we call it, has failed.
And I wouldn't be able to pass through and create an account then.
No, mercifully.
The thing that's extraordinary about this approach, though,
is that the model is just looking at examples and working out
for itself which ones are real and which ones are by you telling it
with lots of examples.
Yes, that's exactly right.
Using artificial intelligence, the more examples of spoof faces
they show the system, the better that it gets at distinguishing real
faces from masks.
But what about the privacy issues around this use
of personal information?
Are you getting any pushback from customers about moving
towards this kind of technology?
Think increasingly, as you feel more secure, as you see the evidence
that you're buying and you're buying with biometrics and you are secure,
then people will adopt it.
Presumably, though, at some point, you will have a database
of an entire country's worth of faces.
No.
So we don't store data in that kind of way.
We'll only store data that we have permission to store.
So we obviously have to take a video of someone and then it will pass
through our system to be analysed.
But we'll only store that if we've been given explicit permission
from the user of the system to do that.
It's all very well for companies to say that they are acting
responsibly.
But this is new technology, regulation is lagging behind,
and it might not always be enough to just take their word for it.
It's one thing if you're just unlocking your smartphone,
but it's quite another when you realise the extent
to which data about who we are and what our faces look like
is being harvested.
Last year, an American company was fined £7.5 million
for harvesting 20 billion online images
with the intention, probably, of using them for facial recognition.
I think it's worth asking questions and being informed
about your own data.
Who has access to it?
Is it secure? And how could it be potentially used in future?
Technology never stays still.
It changes incredibly fast,
and it may well be that soon our bank cards
will be obsolete,
but whatever comes next...
Oh, it worked!
..we can be sure that there are more brilliant ideas to come.
No-one in their right minds would describe this as high-tech,
and yet, hiding within it,
once you peel back those layers of plastic,
it's nothing less than a marvel of human ingenuity.
Next time...
Thanks.
The food delivery apps on your phone.
It's the story of pensioners in Gateshead ordering Greggs
in the 1980s.
20p - oh, if only!
Pizza that pioneered online delivery.
Does the pizza come out of the floppy drive?
Oh, and a little bit of submarine warfare and Soviet satellites.
BEEPING
To explore the interesting dilemmas behind some familiar pieces
of technology and hear some of my own thoughts,
go to...
..and follow the links to the Open University.