WASHINGTON—The EMV chip card technology is a great leap forward in credit card security. Many of us consumers have received our new cards with the embedded chip in recent weeks or will receive them shortly. But it will take time before these cards can protect. The majority of small businesses have not made the upgrades to new terminals to read the cards, even though the official deadline passed on Oct. 1.
While there is no government mandate that merchants have to be compliant, there is a strong incentive. As of Oct. 1, noncompliant small businesses, under certain circumstances, became liable for credit card fraud at point-of-sale card transactions.
Many merchants, like perhaps the majority of consumers, are not even aware of EMV chip cards. A Gallup/Wells Fargo survey of 600 small businesses, back in July, found that only 49 percent of small-business owners accepting both debit and credit cards were aware of the Oct. 1, 2015, deadline.
However, that data is old and Oct. 1 has passed. To get an idea of how this transition from the use of magnetic stripe credit cards to ones embedded with a chip is coming along, Chairman Steve Chabot (R-Ohio) of the House Committee on Small Business convened a hearing on Oct. 7. The invited witnesses were from those who process our financial transactions. In a few weeks, the committee will hear from small businesses and retailers.
“The transition to EMV chip technology impacts every American consumer and is of great importance to this committee,” Chabot said.
Chabot noted concerns of small retailers regarding the cost of new payment terminals, the training of staff on how to use them, and educating consumers, who will not swipe their EMV credit card as they have become accustomed to, but will “dip” it into the new payment terminal slot and wait a few seconds as it processes the transaction.
Prevents Counterfeit Card Fraud
EMV, which stands for EuroPay, Mastercard, Visa, will put some criminals out of business. Embedded in the credit card, or some other form such as a mobile phone, is a microprocessor chip. When used at a chip terminal, a unique, one-time security code is generated for each transaction. Unlike the magnetic stripe card that uses a static security code, the EMV chip card is nearly impossible to replicate.
The code number generated is used only once; it is useless to the criminal because it is not traceable back to the account. Not only are fraudulent face-to-face transactions eliminated (that is, what the industry calls “card-present”), the new EMV technology puts an end to the theft of stored payments data that we saw in recent high-profile breaches at Target, Home Depot, and Michaels.
“This type of authentication … adds a substantial layer of safety,” said Stephanie Ericksen, representing Visa. “Since chip technology makes it essentially impossible to counterfeit cards, which is approximately two-thirds of the fraud that occurs in stores today, merchants will be less attractive targets for criminals,” she said in written testimony.
Because EMV prevents the single largest type of card fraud in stores in the United States today, “EMV migration is the most important step we can make,” said Scott Talbott, from the Electronic Transactions Association (ETA). He said, “Fraud accounts for less than six cents of every hundred dollars spent on the payments system,” which represents a fraction of a tenth of a percent. Though a small number, in a time of many data breaches it’s important to stay ahead of the criminals.
“Although the United States accounts for only a quarter of the world’s payment card transactions, more than half of all fraudulent transactions happen here,” states First Data. Once chip technology is fully adopted here, that condition should change. The EMV card has been widespread in Europe for several years. In the United Kingdom, fraud dropped 27 percent between 2007 and 2012, according to First Data.
However, EMV is not a silver bullet or panacea. Talbott said the chip cards do not stop data breaches.
“The EMV can protect against fraudulent cards but cannot eliminate fraud if the card is lost or stolen,” said Ranking Member of the Small Business Committee Nydia Velázquez (D-N.Y.) in her opening remarks.
Further, EMV does not combat online identity theft, or online or mobile fraud, stated Jan Roche, testifying on behalf of the National Association of Federal Credit Unions.
Online and mobile fraud is expected to rise significantly after the EMV transition, Roche said.
“In the United Kingdom, online fraud rose 79 percent after their EMV transition. In Canada, while card-present fraud declined after the switch to EMV, card-not-present fraud more than doubled,” wrote Roche. She cited the Aite Group, which conducts analysis and research on the financial services industry, that found that online or mobile fraud is already 45 percent of card fraud in the United States.
Liability
It should be made clear in this discussion about preventing credit card fraud and counterfeit cards, consumers legally have zero liability, although “having to replace a credit or debit card is inconvenient at best,” said Paul Weston of TCM Bank, N.A., Tampa, Fla.
Whether or not a bank or retailer implements the EMV technology, consumers are never liable for fraud losses for credit cards and their liability for any fraud on debit cards is limited, said several of the witnesses.
So, who is liable after the new rules in the card industry took effect on Oct. 1? In the case where the bank doesn’t offer chip cards and the merchant doesn’t have a card reader, the bank will continue to be held responsible for covering the cost of the fraud. When both the bank and the merchant are chip compliant, the bank will continue as pre-Oct. 1 to be responsible for losses incurred from fraudulent transactions. The importance of the Oct. 1 rule in the industry is when the merchant is not chip compliant and the issuer of the card is. Then liability shifts for in-store, point-of-sale environments to the merchant.
Exceptions to the rule of Oct. 1 are the fuel dispensers at gas stations and ATMs. The new rule doesn’t take effect for these until Oct. 1, 2017, said Ericksen.
Small Businesses Less Eager to Convert
The small-business merchant has less of an incentive to accept the EMV cards and convert to EMV terminals, especially when the small business is the type where the likelihood of the use of a fraudulent card is low due to the low dollars involved such as a dry cleaner or a car wash, Talbott said.
We should expect some businesses that may experience at most small losses from counterfeit fraud, such as dry cleaners, restaurants, or hair salons, will not be in a rush to make the upgrade, Ericksen said. But Visa was not worried about noncompliance on Oct. 1. She expected businesses to make the transition on a timetable that meets their needs, and that ultimately, adoption of the chip technology will become “near-universal.”
“The speed of shifting to EMV is essentially a business decision that is dependent on risk-tolerance,” Roche said.
The reason for the lack of compliance by small-business merchants to make the conversion on or before Oct. 1 is not limited to unconcern about the liability shift or the lack of awareness about the transition. Some object to the cost of the conversion of terminals, which for the average small-business merchant ranges from $50 to $500, according to Talbott, who said at the hearing that the average cost to a small business is about $100.
Ericksen said that Visa has been working with terminal providers to make transitioning to chip technology easier. “Low-cost terminal options are available for less than $100 and, in many cases, the terminal is included in the cost of the service,” she said.
There is also the cost of deployment and activation of EMV chip card readers. Training costs are also required for both the card issuer and the merchant, stated Weston. Retail personnel must be trained to assist cardholders, he said.
US Chip Market Growth
While the United States has been slow to adopt the new technology, the pace has picked up over the last year. “Today, there are more than 150 million Visa chip cards in the U.S., an increase of over 655 percent in the last year alone. That number eclipses the roughly 129 million Visa chip cards in Brazil and 124 million Visa chip cards in the United Kingdom, making the U.S. the largest chip market in the world,” Ericksen stated in her written testimony.
The EMV card is not effective unless there is the terminal able to read it. As of Sep. 15, Ericksen said that chip-enabled devices are in use at more than 314,000 merchant locations, which is a 470 percent increase over last year.
