Skimming. We have all heard of it, but, like many other threats, having our card’s data copied without realising seems intangible, something that happens to other people – until it happens to us too. With over one billion dollars lost to skimming in 2014 in Europe alone, however, chances are that sooner or later it will hit close to home.
Bulgarian startup SkimProt has developed an ingenious solution and, with over 18,000 copies sold, they are quickly making a name for themselves in the close-knit banking industry. Inventures.eu talked to three of the team members – co-founder and marketing manager Georgi Kanev, and Emil Tzolov and Emiliya (Ema) Kaneva, who are in charge of developing new markets – to discuss the challenges of marketing a global hardware solution out of Sofia.
A problem worldwide
A quick look at the worldwide losses due to skimming. Photo credit: Skimprot
Going beyond just Europe, the losses due to skimming worldwide are valued at over ten billion dollars and SkimProt is the first product that successfully protects the card owner’s money before they leave their account. “Our data shows that 100 per cent of the skimming cases are due to information being stolen from the magnetic stripe,” Georgi points out. This is one of the main reasons why entire countries are migrating to chip (EMV-enabled) cards. However, until the whole world completes migrations, expected to happen in 2025, all devices are still required to read magnetic stripes. In fact, out of about 11 billion banking cards in circulation, only about three billion are EMV-enabled, the SkimProt team informs.
Those trends aren’t likely to change overnight, Emil says. “Judging by the fact that our cards still have embossing, so you can use indigo, paper and your signature to pay in some remote countries, I don’t believe the magnetic stripe will go away soon.”
Once burned and a new idea was born
[reference id=’4397′]
A simple data theft started it all. Dimitar Chobanov, an IT security specialist, and one of the co-founders of the company, was toying with the idea of placing advertising stickers on bank cards. While he was mulling over the placement and look of these stickers, fate intervened in the face of a small device placed on an ATM and his card was skimmed. “He realised that the sticker could be placed on top of the magnetic stripe and protect the information that skimming devices read,” Georgi explains.
But figuring out how to protect the data and still have a functional card took a number of replacement trips to the bank. As he experimented with different kinds of tape and stickers his cards was “swallowed” by ATMs more than ten times. Hefound out why this did not work – the sticker had to have a magnetic stripe too, because this is the primary point of information for the ATM to determine whether the inserted card is, indeed, a bank card.
None of us had done this before and everything is completely new.Co-founder Georgi Kanev
“At that time I worked in a printing house and we had worked together before, so he came to us to see whether we could produce the first prototypes,” Georgi recalls. Having printed the first prototypes, they realised their expertise fit in nicely and they created the SkimProt company. Dimitar provided the intellectual property and the Demax printing house – the initial capital. In exchange for the capital, they signed an exclusive contract, obligating SkimProt to print a certain amount of stickers in the printing house over a period of time. “The company shares are divided between four people,” Georgi explains. “Together with another Demax colleague, Kamen Nestorov, we have 51 per cent, while the other 49 per cent are split among Dimitar and his partner Nikolay Tsaprev.”
Now, they have grown into a team of six. “We are a young team, the oldest here is about 32, and we are having a lot of fun in the process of building a company,” Georgi starts. And their easy camaraderie is evident as Emil joins saying “none of us had done this before and everything is completely new – starting a business from scratch, developing a product and packaging, looking for clients, explaining why you are unique.”
Simply sophisticated: a sticker with four different layers
The simple-looking sticker has four layers. Photo credit: Skimprot
While the idea sounds simple, Dimitar’s experiments proved that looks can be deceiving. In fact, Georgi points out, the sticker has four different layers, starting with a custom adhesive – to keep it securely in place, but also allow for complete removal, in case a machine is not EVM-enabled. The screening layer does not allow the original information contained in the bank’s magnetic stripe to show through, while the magnetic one contains valid service codes, used by Visa and Mastercard, instructing the ATM to read the chip instead. Finally, this is all coated in a protective layer, designed to withstand the daily wear and tear of the card. At the same time, it has to be thin enough not to prevent the card from entering the slot.
The CARTES award helped spread the word about their innovative product. Photo credit: Skimprot
It took close to a year and a half to get from the first prototype to a product ready for sale – and a lot of that time went into designing the packaging and ensuring a stringent quality assurance procedures. These efforts did not remain unnoticed when they attended the world’s largest banking security expo – CARTES Secure Connexions in the US earlier this year and came back with the Sesames Award for Best Innovation in card manufacturing. “It was a shock because we were up against Oberthur Technologies, one of the biggest players in the business and a local, US company, with a US jury,” Emil recalls. This helped increase their visibility in the industry and they are still getting calls from clients who found out about them because of the award.
Unique challenges befitting a unique product
With patents pending on their product, the team admits that the uniqueness of their invention is both a blessing and a curse: “It gives us a competitive advantage, but at the same time creates a lot of obstacles that we face on a daily basis,” Georgi says.
It is very hard to get people to trust a small startup company, from a small country.Co-founder Emil Tzolov on one of the biggest hurdles
One of the biggest issues they face is trust. “It is very hard to get people to trust a small startup company, from a small country,” Emil points out. This is why, extra effort has been put into having their product certified by a number of independent labs. They all agree that sadly, this also has to do with Bulgaria’s image being closely tied to skimming. In fact, unofficial data points to Bulgarian nationals being behind 95 per cent of the skimming thefts worldwide so, it is understandable that some clients preferred to see “made in EU”, rather than “made in Bulgaria” written on the packaging. “A handful of people have created this notoriety that reflects on everything from our country,” Georgi laments, “but it is only fitting that if Bulgaria is the cradle of this problem, it should also be the place where the solution is born”. He even tells of “some people from the other side of the law,” visiting the office to learn more about the SkimProt solution and confirming that it indeed works in protecting from their devices. Asked if the team has ever been strong-armed into giving up on their product, he smiles and says “we are still too small to be a problem”.
Packaging had to be updated to battle the mistrust in a Bulgarian product. Photo credit: Skimprot
Becoming bigger is Emil and Ema’s key task and they are also struggling with their own set of challenges – namely in finding the best partners in the most promising markets. “In the beginning, when we saw the map of the EMV migration, the most prospective countries seemed to be the ones in South America, like Mexico, where 44 per cent of the population has been a skimming victim at least once,” Emil says. However, uptake there has been slow, mostly because of lack of trust. “Do not start a business in Bulgaria,” Emil warns, frustrated with all the challenges, and admits they have been thinking of registering a company in Austria, or Germany, where opportunities for hardware startups are much more. Yet, their location has helped a bit, as they already have distribution contracts for neighbouring Romania, Serbia and Greece, as well as for England and Denmark and all the way up to Kazakhstan. “Of the 18,000 stickers sold to date, about half have been sold abroad,” Emil points out, noting that they are on their way to signing even more contracts and hope to have distribution established in ten markets by the middle of next year.
Of the 18,000 stickers sold to date, about half have been sold abroad.Co-founder Ema Kaneva
Ema is facing a lack of understanding on the local market too: “A woman told me, I have already been skimmed four times, why would I need this product,” she sighs. Sometimes people simply distrust the product because they feel that, at five euros per sticker, it is too cheap for what it promises to do.
Banks and financial institutions seem to be their natural partners too and the team is swinging between push and pull strategies depending on the market. In South Africa, for example, they printed 6,000 branded stickers for a bank which gave these away as a gesture to their most valuable clients. In Bulgaria, banks say they have insurance against skimming and do not understand the added value of offering their clients extra protection, Ema explains. “This is why we need strategic partners abroad, people who know what approach would work on their local market,” Georgi says.
A full pipeline
Despite citing exciting data on their growth potential, the three are already working on innovations – they are trying to achieve a thinner version of their sticker, they are looking into a sticker to cover the three-digit cvv code that becomes transparent when touched and a sticker to disable RFID technology on cards. Those experiments go hand in hand with painstaking attempts to pinpoint the correct marketing strategies before they lunge for too many more markets. “We are looking for slow and sustainable development, we are not a software company looking to scale quickly, we want to take it step by step but ensure that we make the least mistakes possible,” Emil says.
