Square first came to fame with a credit card reader you could plug into your iPhone jack. But next year, the company's signature device will be on its way to obsolescence as the U.S transitions to a new kind of credit card that verifies purchases with an embedded computer chip.
In anticipation of this sweeping change in the way Americans pay, Square designers and engineers have been working on new hardware the company hopes will not only navigate that change, but make Square the first and best option for the millions of merchants who will need to make the switch.
The change happens in October 2015, when credit card companies will start cajoling merchants to accept cards that work via a more secure embedded chip rather than the classic---and classically easy to hack---stripe on the back of every card now. In what's being called the great "liability shift," the major card networks---Visa, Mastercard, American Express, Discover---say merchants who don't offer a way to accept the new chip-based cards, also known as EMV cards, by the deadline will be responsible for any fraud they suffer as a result, not the card companies.
>'It gives us the opportunity to ruthlessly edit what this thing is.'
The big challenge in making the shift is that every business that takes credit cards will need to buy new hardware capable of reading the new cards. Chip-card readers aren't new---EMV has been in use for years in Europe, Canada, Asia, and Latin America---but the transition in the U.S. gives Square a chance to make its reader the first many merchants in the world's largest economy see.
"It gives us the opportunity to ruthlessly edit what this thing is," says Jesse Dorogusker, Square's head of hardware design, whose other credits include designing the Lightning plug connector for iPhones and iPads during his eight years at Apple. Last week, WIRED sat down with Dorogusker for an exclusive peek at Square's newest card reader, which will accept chip and stripe both.
While Square's earliest readers were mainly pitched to small businesses and individuals who didn't think accepting credit cards was within their reach, the EMV switchover gives the company a chance to convince businesses they should leapfrog more traditional terminals that read chips and embrace Square's distinctive minimalist approach. "The big scary 're-terminalization' moment that everyone is standing and staring at, we're going to make that easier for millions," Dorogusker says.
The push to develop its new reader came not just from next year's deadline but from existing customers asking Square what they needed to know about the change and whether the company could help. While the new chip-based cards are the same size and shape as the old magnetic strip version, the underlying technology is completely different. A stripe simply encodes the numbers already stamped on the front of the card. "Your card really plays no role but giving up its secrets," Dorogusker says.
A chip-based card, on the other hand, essentially contains a mini-computer that for now at least is much more tamper-proof than a stripe. The secret information they contain that identifies one card from another is tougher to steal, tougher to duplicate, and all together more difficult to manipulate, because each transaction amounts to what the company describes as a "unique impression" to encrypt each sale.
It's this heightened security that is motivating the credit card industry to push for the switch, and some big stores have already started. Target, for example, shamed by the 40 million card numbers stolen from its system, says that all its stores would be equipped to accept chip-based cards by early 2015, ahead of the deadline.
But that increased complexity also raised the design challenge for Square, starting with the form factor. Up until now, Square's card readers were designed for a single motion: the swipe. But chip-based cards don't work that way.
The chips themselves are visibly located in the middle on the left end of the cards, and most readers use a slot that resembles a shorter version of an ATM for dipping in the entire end of the card. Also, unlike magnetic-stripe cards, chip cards stay in the reader for the duration of the transaction. A Square reader the width of an entire credit card---which is almost exactly the width of an iPhone 5s---would be unwieldy. So Square opted instead for a partial slot that takes just the upper left corner of the card, which keeps the new reader reasonably smaller than the phone, though significantly larger than its current swipe-only reader.
But Dorogusker and company also reckoned that a change in consumer behavior this momentous would hardly happen smoothly or right away. Merchants will likely have to be able to accept magnetic-stripe cards for years to come as the switchover plods along among cardholders and issuers. "In the U.S., I think it will be a transitional market for quite a long time," he says.
That's why the new Square reader also includes a track for swiping, separated from the chip slot by a thin piece of plastic. Fortunately for Dorogusker, he and his team had already put in the work to shrink the "head" needed to read a magnetic stripe down to the size of a child's fingernail. That left plenty of room for the rest of the internal components needed to make its mobile reader chip-ready.
One of the biggest pieces of internal gadgetry needed to accept chip-based cards is a battery. The cards themselves don't carry a power source. They rely on readers to power the chips, which are capable of exchanging much more data with credit card issuers across the network than simple identification information (Chip cards can be customized with different kinds of restrictions on how much can be spent and where, for example).
So, the new Square reader comes equipped with a super-thin battery and a mini-USB port to charge it, a feature its stripe-only reader doesn't require. And manage that power, Dorogusker says, Square wrote the software to run the new reader from scratch. "The software is probably hardest to describe and the hardest to do." The onboard algorithms try to keep the reader powered long enough to go through a busy day of business without needing to be charged.
The software also works to get around the inherent slowness of chip-reading compared to stripe-swiping, and additional technology works to prevent tampering---the primary reason for the switch to chips.
The one major feature that will be missing from the new reader will be an additional layer of security from which the popular nickname for EMV comes: "chip and PIN." The most secure chip-based card systems also require a PIN instead of an easily forged signature to verify the identity of the cardholder. Dorogusker says that, in the U.S., card issuers aren't requiring PINs as part of the transition, so merchants who take Square will use a "chip and signature" system.
To be sure, a keypad for entering PINs would make the reader too large for use with smartphones. Though Dorogusker wouldn't speculate on PINs as a future option, it seems plausible that Square's Register app could offer a PIN-entry option, much as it allows cardholders to scribble their signatures on the touchscreen already.
Whatever future iterations have in store, Square appears to be prepared for the big switch coming in little more than a year. In the future, Dorogusker says he hopes to shrink down the chip-card reader to get closer to the current stripe-reader's size. But the most important thing, he says, is simply creating a way for Square to be there as soon as it's needed.
"The real reason we got on it early is that it was definitely coming, definitely complicated, and we don't totally control when it's coming," Dorogusker says. "This is really about making sure our merchants can accept whatever comes across the counter."
