eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
The good news for companies that accept credit cards is that most banks will be issuing credit cards with EMV chips well before the coming liability shift in October 2015.
The bad news is that merchants that don’t accept EMV (Europay, Mastercard and Visa) chips will have to absorb the cost of fraudulent transactions due to counterfeit credit cards.
Previously, banks had absorbed those costs. EMV chips are microprocessors embedded in cards that make counterfeiting the cards virtually impossible.
That means that companies that accept credit cards at point-of-sale (POS) terminals will have to either buy new terminals or they’ll have to enable the EMV chip readers on the terminals they already have.
The surprising news is that the majority of card issuers will use chip-and-signature cards rather than chip-and-PIN cards. Chip and signature cards protect against counterfeit credit and debit cards, but not against fraudulent use of lost or stolen cards.
The worse news is that the fraudsters are well aware of the coming use of cards with EMV chips, and will change their focus to online merchants and to financial institutions that have not made the change to the new cards.
“Credit card fraud changes,” said Julie Conroy, research director for the Retail Banking and Payments Practice at the Aite Group. “Organized crime rings aren’t going to sit and watch their bottom line go away. We’ll see a shift to card-not-present and application fraud.”
Conroy prepared a report from the Aite Group that determined that about 70 percent of cards in the U.S. will have EMV chips by 2015, with most card issuers sending out such cards in the fourth quarter 2014 or first quarter 2015.
“We’re racing to get ahead of card-not-present fraud,” Ellen Richey, chief enterprise risk officer and chief legal officer for Visa International, told eWEEK. Richey said that Visa has developed a process called tokenization that can help prevent card-not-present fraud.
“The card-not-present channel has a technology called tokenization that changes the card number into a different number that can be limited in its use,” she said. “Once you do that, the value of the token is much less than the value of the card number, and you can make it useless for other kinds of transactions. It makes it much harder to use the data.”
Richey said that Visa has donated the tokenization method to EMVco, which is the company that developed and manages the standards for EMV chips. By doing this, Visa has made it possible for any card issuer to use tokenization and do it in a standards-based way.
Debit cards are somewhat further behind in their move to EMV chips. Most of the delay has been due to a federal court decision that held that the Federal Reserve had exceeded its authority when it set up routing procedures for debit cards.
70 Percent of U.S. Credit Cards to Include EMV Chips 2015
That decision was overturned in March, but until it was, many banks put their debit card transitions on hold.
Conroy said that when debit cards with EMV chips arrive, she expects almost all of them to be chip and PIN cards. The reason is that consumers are already used to providing a PIN for their debit cards. The reason for not using PINs for most credit cards is that card issuers are trying to keep things simple. She said that the explanation she gets from banks is, “We don’t want to have to teach Americans how to do two things at once.”
But there’s also the concern about teaching merchants how to do new things, observed Dick Mitchell, solutions director for Randstad Technology Deployment Services. Mitchell handles deployment of new card reader machines for merchants. “They have to have the right POS terminal,” Mitchell said, noting that the merchant’s processor also has to support use of EMV chips. But he also noted that a major effort is training the staff in how to use the new technology.
Some small U.S. merchants have already made the switch to accepting cards with chips, as have a few larger companies. Some Walmart stores already accept chip and PIN cards. The company has also announced that Sam’s Club stores will begin issuing cards with EMV chips and will accept those cards starting by the end of 2014.
Target, the big-box retailer that was hit with a point-of-sale data breach that affected more than 70 million customers and stimulated the discussion about the urgent need for chip and PIN cards, has announced that it will begin issuing and accepting EMV cards by the end of 2014.
Unfortunately, there are still needs that have to be addressed before merchants can start accepting EMV chips. The most significant one is training of card issuer employees. One Bank of America executive told eWEEK recently that there were no issuers of chip-based cards in the U.S., and that in fact it was technically illegal for those cards to be used in the United States. It’s worth noting that Bank of America is one of the card issuers already providing EMV chips for portions of its credit card user base.
It’s also worth noting that right now, only merchants with POS terminals are being required to support EMV chips. There’s a two-year delay in the liability shift for ATMs and for fuel dispensers at gas stations.
Despite the seemingly slow pace of movement, the U.S. is moving forward, with much of the transition taking place well in advance of the liability shift in 2015. So now it’s important that we all watch out for other types of credit card fraud and related crime. The criminals aren’t giving up, which means neither can you.
Editor’s Note: This article was corrected to clarify who who will be liable for fraud resulting from lost or stolen credit cards after the implementation of EMV Cards.