EMV technology and chip cards will bring consumers enhanced security when shopping.
The nationwide shift to chip-enabled credit and debit cards officially takes place October 1, and there are a lot of questions about why and how. EMV—which stands for Europay, MasterCard and Visa, the three companies that orginally created the standard—is a global standard for payment cards eq uipped with computer chips as well as for the technology used to authenticate chip-card transactions.
The United States is the last major market still using magnetic-stripe cards, which are easy to duplicate, and card issuers are migrating to the new technology to protect consumers and reduce the costs of fraud.
In 2014, merchants lost, on average, 0.68 percent revenue—a 33 percent greater proportion than the previous year, according to the LexisNexis True Cost of Fraud Study. Merchants also incurred more costs in addition to their fraud losses, with each $1 of fraud costing them $3.08, compared to $2.70 in 2013.
Europe switched to the chip system 20 years ago because its networks couldn’t handle real-time authentication. For U.S. merchants and financial institutions, the switch to EMV means adding new in-store technology and internal processing systems, and complying with new liability rules. For consumers, it means activating new cards.
Most of all, it means greater protection against fraud.
EMV technology 101
EMV is a technical standard for smart payment cards and for the payment terminals and automated teller machines that can accept them, according to an online search. The standard is now managed by EMVCo, a consortium with control split equally among Visa, MasterCard, JCB, American Express, China UnionPay and Discover.
EMV-compliant cards and equipment are widespread except in a few countries internationally with a few exceptions (the United States being the largest). Typically, a country’s national payment association, in coordination with MasterCard International, Visa International, American Express and JCB, jointly plan and implement EMV systems. In 1993, several international payment companies agreed to develop smart-card specifications for credit and debit cards. The original brands were MasterCard, Visa and Europay. The first version of the EMV system was released in 1994. In 1998, the specifications became stable.
The United States began accepting EMV-compliant cards in 2014, with MasterCard the first company allowed to use the technology. Before 2014, the consensus in America was that there were enough security measures in place to avoid credit card theft and that the smart chip was unnecessary.
Onboard with EMV
What finally prompted the United States to get onboard with EMV technology? A continual string of data breaches over recent years is fueling the change. And a massive data breach at Target Corporation over the holidays last year, which impacted 40 million customers, underscored the need, once again, for the United States to move toward EMV technology.
The irony is, Target was already well underway in making the switch when the breach happened, according to Molly Snyder, a spokesperson for Target Corp., based in Minneapolis, Minn. “The move to EMV technology is something we’ve long believed in,” she says. “We accelerated the process after the breach to give customers peace of mind, and it certainly provides enhanced security from cybercrime.”
Target is now leading the way in upgrading payment security for consumers. Its switch to EMV technology involves a three-stage process. First, it installed the hardware that would accept chip cards in all stores. Second, it’s completed rolling out the software to the 1,800 Target stores nationwide. And finally, it will begin re-issuing millions of Target REDcard credit cards later this fall. “We stand behind chip-and-PIN cards, and will accept all chip cards later this year,” says Snyder. (PIN means Personal Identification Number and is the unique passcode used with debit cards.)
“The Target information compromise was high profile, but just one of many in recent years that highlights the increase in fraud activity and focuses on the need for the United States to adopt this technology,” says Ron Felder, executive vice president and chief lending officer at Redwood Credit Union (RCU).A more secure card
What makes EMV cards more secure than traditional cards? An EMV card has a small, metallic square, which is a computer chip, that sets it apart from the traditional magnetic stripe cards.
Magnetic stripes on traditional credit and debit cards contain unchanging data. Whoever accesses that data gains the card and cardholder information necessary to make purchases. That makes traditional cards a major target for counterfeiters. Magnetic stripes can be easily copied from one card to another and used to make fraudulent purchases.
A chip card works differently. When a chip card is inserted into a payment terminal, it creates a one-time transaction code. In other words, chips can’t be duplicated as easily as magnetic stripes. Any payment details would only be stored with the one-time code. While EMV technology won’t prevent data breaches altogether, it will make it more difficult and, experts hope, it will significantly reduce fraud. (See “How Do You Use a Chip Card?” below)
“Chip cards offer important new levels of security that provide consumers with enhanced protection from fraudulent transactions,” says Lindsey Strange, senior vice president and retail regional executive for Umpqua Bank. For example, she says, the chip makes it more difficult for third parties to use a customer’s account information to make a counterfeit copy of EMV cards.Banks and retailers
North Bay financial institutions have been in the process of making the switch for months. “We’ve been working on this for more than a year now. It’s been a large focus and priority for us,” says Felder. RCU began issuing new chip credit cards in June and began reissuing chip cards to existing credit- and debit-card holders starting in July. By October, the majority of RCU members will have their new chip cards. (RCU will be distributing more than 200,000 chip cards in total.)
According to Felder, the new chip cards offer two key advantages. First, and most important, is the enhanced layer of security. “When swiping a card, your account information is being passed to the merchant,” he says. “The chip card uses an encrypted code so the merchant won’t get your personal information, which is a huge advantage. And second, chip cards have been standard for the rest of the world for years. When you travel overseas, you’ll now have a card that works.”
Umpqua Bank is also using a phased-approach to provide consumers and businesses with upgraded consumer and commercial credit cards and debit cards. “We take the safety and security of our customers very seriously, and upgrading to EMV cards represents a significant change in the industry,” says Strange. “For us, it’s an important opportunity to improve overall security for our customers and one we’ve been working on for some time. We began issuing EMV credit cards in February for current customers whose cards have expired or need to be reissued as well as for all new cardholders. We began issuing prepaid and commercial chipped credit cards July 1 and will begin issuing debit cards on October 1.”
As for local retailers, some businesses have had the new terminals in place for a while. Oliver’s Markets (which currently has stores in Santa Rosa and Cotati) has had the new terminals in place since the first of the year. “It wasn’t a costly enterprise for us,” says Tom Scott, chief executive officer. “When we updated our computers, we added the [new] card readers.” The machinery still reads both the chip and the magnetic strip, he adds, so it’s been a turnkey process for customers.Stanley Jacobs, M.D, a facial plastic surgeon with offices in San Francisco and Healdsburg, will make the switch before the October 1 deadline. “Our business is mainly transacted with credit card machines, with Visa being the most used by our patients,” he says. “The chiped cards will reduce fraud significantly.”
Liability Shift
U.S. banks have been issuing chip cards over the past year, ahead of the October 1, 2015, deadline. After this date, a “liability shift” will take place. Any retailers that choose to accept payments made via a chip card’s magnetic stripe can continue doing so, but they’ll accept liability for any fraudulent purchases, according to an online search.
Visa and MasterCard are telling banks and retailers that if they continue to use the old system, it will be at their own financial risk. While not everyone will be transitioned to the new system by October 1, issuers and merchants who haven’t made the switch may assume additional liability.
What if a merchant doesn’t have EMV technology in place by October 1? This doesn’t affect your own personal liability.
“After October 1, if a customer uses his or her EMV card and the merchant doesn’t have an EMV-enabled terminal, the merchant is at risk should a data breach occur, which is an incentive for retailers to convert their terminals,” explains Felder. “We won’t see 100 percent conversion by October 1, but the further out we get, the more adoption we expect to see by both issuers and merchants.”
Traditionally, if an in-store transaction is conducted using a counterfeit, stolen or compromised card, consumer losses from that transaction fall back on the payment processor or issuing bank, depending on the card’s terms and conditions.
After October 1, 2015 (a deadline created by major U.S. credit card issuers), the liability will shift to whichever party is the least EMV-compliant in a fraudulent transaction. For example, if your bank issues a chip card and you use it at a retailer that hasn’t changed its system to accept the chip card, the cost of the fraud will fall back on the retailer.
Major credit card issuers have published detailed schedules about the upcoming shift in liability. Check with your credit card issuer for details.
Any parties not EMV-ready by October 1 of this year could face much higher costs in the event of a large data breach. Automated fuel dispensers have two additional years, until October 1, 2017, to make the shift to EMV. Until then, they’ll follow existing fraud liability rulings. So pay at the pump at your own risk.
The future of EMV
Although the October 1 deadline is strongly encouraged for all payment processing parties to become EMV-compliant, experts don’t believe everyone will be EMV-ready by that date. Aite Groupestimates that70 percent of credit cards and 40 percent of debit cards in the United States will be EMV-enabled by the end of 2015. (Aite Group is an advisory and consulting firm for the financial industry, based in Boston, Mass.)
While the United States has lagged behind other countries for decades with this new technology, everyone will benefit from the switch. Having a chip card will also make traveling outside the country easier for consumers.
“I know [the chip cards] have been in use in Europe and Canada for a few years. When we travel there, the reaction from vendors is one of shock and amazement that the United States hasn’t followed suit,” says Jacobs, who’s originally from Canada and sometimes travels abroad on business. “I believe the chipped cards will reduce fraud significantly. I understand it will cost U.S. merchants and banks $8.5 billion to switch the cards, vendor machines and ATMs. However, the nation has $10 billion in card fraud each year, so the costs will soon be recouped.”
“It’s important to stay up-to-date,” says Scott. “Cyberhacking is a multibillion dollar business. We need to put controls in place so customers can be confident that payment systems protect their privacy and identities.”
What kinds of feedback are banks getting from customers?
“We’ve provided a great deal of content and communication about the chip card and its benefits to our members,” says Felder. “The feedback we’re getting is very positive. Members appreciate the additional level of security. And long term, fraud is expected to decrease significantly, based on the experience of other countries that have already adopted the chip card standard” says Felder. “It won’t happen overnight but, over time as everyone converts, it will be a big benefit.”
“Customers have been requesting the chip credit cards frequently in recent months and are very pleased Umpqua Bank is making them available,” says Strange. “The need for EMV chip card migration has increased with the number and frequency of data breaches. The conversion will benefit U.S. cardholders by cutting down on counterfeit fraud and making international travel easier.”
Did You Know?
Approximately 120 million Americans have already received an EMV chip card and that number is projected to reach nearly 600 million by the end of 2015, according to Smart Card Alliance estimates.
How Do You Use A Chip Card?
Here are a few tips for using a new chip card, according to Redwood Credit Union.
• If a payment terminal is not chip card-enabled, the transaction will be processed using the magnetic stripe, the same as your old card.
• If the terminal is chip-card enabled, it will prompt you to insert the chip card into the terminal.
• Insert your card.
• Your chip card will be kept safely inside the terminal unit until the transaction is complete.
• You will either be asked to enter a PIN or provide your signature for verification.
• Remove your card; your secure transaction is complete.
By the Numbers
The average cost for issuing a new EMV card is $3.50, and the average cost of an EMV compliant, point-of-sale terminal is $500. Making the switch to the new chip will cause some major changes across the United States. The numbers tells the story.
• 575 million EMV cards will be issued by the end of 2015.
• 59 percent of retailers will be EMV-compliant by the end of 2015.
• 78,800 EMV-chip activated merchant locations are currently running.
• 41 percent of U.S. debit cards will be issued as EMV cards by the end of 2015.
• 70 percent of U.S credit cards will be issued as EMV cards by the end of 2015.
• 86 percent of financial institutions plan on issuing EMV cards by the end of 2015.
Sources: Javelin Research & Strategy; Aite Group; and 2014 PULSE Debit Issuer Survey.
