With a deadline looming, the payments industry is on its way to equipping millions of Americans with new microchip-enhanced credit and debit cards.
Merchants have until Oct. 1 – a deadline first initiated by Visa in 2011 – to change their payment hardware, a switchover that essentially amounts to a liability shift from financial institutions to merchants. After that date, merchants will be considered liable for any fraudulent charges incurred, while the consumer will remain protected.
Many consumers have already received new chip cards, and industry experts think more than half of all U.S. cardholders will be carrying chip-enhanced EMV standard (Europay, MasterCard, Visa) cards by the end of the year.
The idea behind the chip card is that it will make it more difficult for cardholder information to be breached, thereby limiting opportunities for criminals to commit acts of fraud in the seemingly never-ending cat and mouse game between the payments industry and thieves.
“Unfortunately, there won’t be a way to ever totally eliminate fraud,” said Tom Morrison, director of payments, technology and operations for Intrust Bank. “What everyone needs to be aware of is that we’re not going to reduce the overall amount of fraud, it’s just going to shift.
“Criminals and bad actors will continue to do what they do until such time as they’re caught or arrested. If there is a block to one pathway, they will just shift to another pathway.”
Ultimately, the change will have little effect on consumers during point-of-sale transactions – except for the fact that they will “dip” their new card into a chip card reader instead of swiping along its magnetic strip – but it could represent potentially big savings for banks and other financial institutions in the future.
Though banks are often reluctant to offer specific estimates as to how much they could save as a result of the change, overall fraud against bank deposit accounts represented losses of about $1.7 billion for the industry in 2012, according to the most recent data accumulated by the American Bankers Association.
While financial institutions stand to potentially save money in the long run – the reissuance of cards can be expensive – it’s merchants who could be the biggest losers following the U.S. EMV card switch.
“Essentially, what this does is it will reduce costs associated with fraud that banks are responsible for,” said Mallory Duncan, senior vice president and general counsel for the National Retail Federation. “On the retail side, we expect this changeover, everything included, to cost retailers as much as $35 billion.
“The people who are really going to get slammed are the midsized operations, partly because they may not be able to purchase new equipment in bulk, and businesses like restaurants, which might have systems that handle more than one function.”
For a single small business, Duncan said replacing a terminal with a chip-enabled system could cost as little as a few hundred dollars, but that the typical per-unit cost on average is closer to $2,000.
Acumen Business Connections Inc., a Wichita-based firm that processes and installs such terminals, has so far installed about 100 new units in the city, said the company’s owner, Diane Wynn.
Morrison said that about 70 percent of Intrust’s issued credit cards now contain the chip, with the remaining 30 percent expected to be completed in the next nine months. Intrust, which started on its conversion journey in April 2013, is expected to begin reissuing chip-enhanced debit cards in October.
In many places around the world, most notably Europe, chip card technology has been in place for years. It’s standard practice for card users there to also provide a personal identification number for transactions, which, most experts agree, is the most fraud-resistant type of point-of-sale card transaction.
A number of large retailers, like Wal-Mart and Target, already have chip-ready terminals in their stores. Wal-Mart spokesman Randy Hargrove said the retail giant began installing the terminals in 2006.
One regional bank that was near the forefront of the chip revolution was Commerce Bank, which began issuing chip credit cards in 2013. Commerce’s Wichita Market Area Chairman John Clevenger said the institution will begin issuing chip debit cards in September.
“We think all involved parties really benefit from this change,” Clevenger said. “This is an important change in the fight against fraud and one that we think will result in long-term benefits for everyone.
“Europe has been on the chip standard for a while and it’s time that we are as well.”
Intrust and Commerce aren’t the only banks making the switch. All other banks and financial institutions contacted for this story said they were in the process of switching over to the chip card, though many cautioned that crooks will work to find new ways to defraud.
“We are in the process of converting cards now,” said Citizens Bank of Kansas board chairwoman and owner Jane Deterding. “I would caution users that the chip is not the end-all, be-all for card security.
“The magnetic strip remains on the card in case the chip doesn’t work. And we have already heard stories of crooks who break the chip to access the information on the strip.”
Eileen Phelps with Credit Union of America said the cost to the organization for the mass reissuance of close to 40,000 new chip cards will be in the neighborhood of $500,000. She said Credit Union of America will be ready for the October deadline.
“It’s a major capital expense,” Phelps said. “But it’s something that is important to us – the safeguarding of our customers’ information. …
“According to the FBI, financial crime represents losses of about $2 billion every year, so it’s a big deal.”
More changes to come
Consumers using pay-at-the-pump terminals at gas stations and ATMs won’t have to worry about any chip card changes for the time being – card readers for those types of purchases are set to be in place by October 2017 – but the troubling area of online fraud is basically unaffected by the chip change.
“EMV does not do anything to address card-not-present fraud,” Intrust’s Morrison said. “EMV is just a piece of the puzzle, so my hope for consumers is that they do get engaged and are monitoring their accounts and helping to detect and fight fraud in all the ways we can do that.”
Visa risk specialist Stephanie Ericksen said that in the U.S., about 63 percent of cards are expected to contain the chip by the end of 2015 and about 98 percent by the end of 2017, though she added that only about 47 percent of terminals nationwide are expected to be upgraded by the end of this year.
Most experts seem to agree that the next step after the chip changeover – assuming the industry doesn’t move to include the required use of PINs for point-of-sale transactions – will be in the form of tokenization, a process that essentially masks secure data with a set of random numbers that are useless to scheming criminals. This type of payment method is what is used for so-called near field communication options like Apple Pay.
For now, American consumers will largely be focusing on the changes related to chip cards as other technologies are tested, developed and perfected.
“The world won’t change drastically on Nov. 1,” Morrison said. “That said, every merchant should be concerned with getting on the fraudster’s list. Every fraudster will know if they’ve got a weak spot in the payment system.
“We’ve certainly seen that they find the holes that you don’t plug. They learn and they learn quickly about where those holes are.”
Chip cards over the years
1996: EMV standard is developed by Europay, MasterCard and Visa.
2006: First live EMV transaction in the U.S. is completed.
2015: (Oct. 1): Liability for point-of-sale fraud shifts from financial institutions to merchants.
2017: Deadline for ATM and gas station owners to install chip-ready terminals.
Sources: Visa, Discover