Magnetic stripe is the dark band on the back of a payment card that stores the card number, expiry date and other account data as magnetised particles, read by swiping the card through a terminal. Developed at IBM in the 1960s and standardised in ISO/IEC 7811 and 7813, it was the main point-of-sale interface for about four decades. Payment cards use up to three tracks, with most authorizations reading Track 2. Because every swipe returns the same static data, skimmed tracks can be written onto blank cards, which is why PCI DSS bans storing full track data after authorization. Under scheme liability shifts, merchants without chip terminals carry counterfeit losses, and Mastercard plans stripe-free cards by 2033.
What is a magnetic stripe card
A magnetic stripe card is any card whose data is read from that band: bank cards, older transit tickets, hotel key cards, loyalty cards. In payments the term now usually means a card read by swipe rather than chip or tap. Most bank cards still carry a stripe for fallback, even though it is rarely the primary interface outside a few markets.
How does magnetic stripe technology work
The stripe holds tiny iron-oxide or barium-ferrite particles whose magnetic orientation encodes bits. Swiping the card past the reader head produces a changing current that the terminal decodes. Payment cards use up to three tracks:
- Track 1: up to 79 alphanumeric characters, including cardholder name, PAN, expiry and service code.
- Track 2: up to 40 numeric characters with PAN, expiry, service code and discretionary data. Most payment authorizations use Track 2.
- Track 3: rarely used by payment cards.
The discretionary data includes the CVV1 or CVC1, a code different from the three digits printed on the back. Bank cards use high-coercivity stripes that resist accidental erasure by everyday magnets.
Why the stripe is easy to clone
Every swipe reads the same static data. A skimmer hidden in an ATM slot or fuel pump copies the tracks, and the data can be written onto a blank card that works anywhere magstripe is accepted. That is why PCI DSS forbids storing full track data after authorization, even in encrypted form.
The service code gives issuers a defence: a first digit of 2 or 6 tells the terminal the card has a chip, so a swipe on a chip-capable terminal should be refused or at least flagged as fallback.
Magnetic stripe vs EMV chip
An EMV chip is a small computer that signs each transaction with a unique cryptogram, so copied data cannot be replayed. The stripe has no processor and no dynamic data.
The liability rules follow. Under scheme liability shifts, if a counterfeit card is swiped at a merchant that has not upgraded to chip terminals, the merchant carries the fraud loss. The US applied this in October 2015, which is when chip adoption there accelerated.
The planned end of the stripe
Mastercard has announced a phase-out: new cards in Europe no longer need a stripe from 2024, US banks stop being required to issue them from 2027, and by 2033 no Mastercard credit or debit card should carry one. Merchants whose point of sale estate still depends on swipe, such as some unattended kiosks, will need replacement hardware well before then.