We are constantly bombarded in the news with reports of fraud involving massive breaches of customer information through the use of debit and credit cards. The Identify Theft Resource Center reported over 600 breaches in 2013, a more than 30 percent increase from 2012. And financial indusry research firm Aite Group LLC reports card fraud in the United States already costs the card payment industry – primarily banks – $8.6 billion a year.
To date, the majority of losses from the data breaches are incurred by the nation’s banks, not by the retailer that suffered the breach. Banks have worked for decades to prevent or quickly detect fraud in all its forms, from counterfeit checks to unauthorized credit and debit card transactions, and in 2013, the American Bankers Association reports banks were successful in stopping $13 billion in fraud attempts. When fraud occurs, or is likely to, banks will close the account, reimburse the customer for any unauthorized transactions and reissue the card.
Magnetic stripe technology is reaching the end of its life cycle. It is more than four decades old and is inherently insecure. It’s far too easy for thieves to produce counterfeit cards using cardholder data stolen in scores of data breaches or skimmed from individual cards. But another option exsits: chip-enabled cards.
The United States has been slow to adapt chip-enabled cards that should offer more security than the current commonplace magnetic stripe cards. A chip-enabled card has an embedded microprocessor chip that stores and protects cardholder data. If the card is lost, stolen or compromised in a data breach, the embedded microchip makes the card extremely difficult to counterfeit or copy.
The global standard is known as EMV – short for Europay, MasterCard, Visa – and there currently are more than 1.5 billion chip-enabled cards issued worldwide. However, the United States is one of the last countries to implement this technology because of the size and complexity of its economy. The U.S. has by far the most cards and point-of-sale terminals in circulation.
Technically, EMV adoption is not mandatory. However, any business that does not comply might run the risk of lost sales due to not being able to process transactions through an outdated POS terminal unable to read chip cards.
Visa and MasterCard have issued upcoming rules and guidelines for processors and merchants to support EMV chip technology. Possibly the most notable rule is the shift in liability over card fraud. Once this rule goes into effect in October 2015, merchants that have not made their equipment EMV-compatible may be held financially liable for card-present fraud that could have been prevented with the use of a chip-enabled POS system. Gas station owners have until October 2017.
With the liability shift, if a contact chip card is presented to a merchant that has not adopted, at minimum, contact chip terminals, liability for counterfeit fraud may shift to the merchant’s acquirer. The liability shift encourages chip adoption since any chip-on-chip transaction – chip card read by a chip terminal – provides the dynamic authentication data that helps to better protect all parties.
It’s obvious to most the adoption of a chip-based payment standard holds many benefits, but it doesn’t come without downsides. Issuers, acquirers and merchants will have decisions, costs and efforts in enabling EMV within their systems.
The biggest issue when implementing EMV is the time and cost required for full implementation. Just what would it take to replace more than 15 million POS devices, 360,000 ATMs, 610 million credit cards and 520 million debit cards nationwide? Javelin Strategy & Research estimated the total cost at $6.75 billion to replace the POS terminals, an additional $1.4 billion to issue smart chip-compliant cards and about $500 million for ATM upgrades.
Banks will need to issue cards that are both chip-enabled and magstripe at least for a while in order to provide the consumer with acceptance in the U.S. and elsewhere.
The implementation costs may be a worthwhile investment in order to reap the long-term benefits such as vastly reducing payment fraud, further enabling mobile and future emerging commerce technologies, and bringing compatibility with other EMV-enabled countries. The ultimate decisions will be made by individual merchants and issuers based on implications specific to their businesses.
Now is the time for merchants to prepare the implementation of EMV chip technology. Merchants should:
- Engage a POS provider and begin assessing what a smart chip enablement plan would look like for upgrading all consumer-facing POS devices.
- Speak to third-party POS software providers to understand their strategy to become EMV compliant.
- Discuss with a processor when it will likely be ready for smart card processing and discuss other ways that a company can reduce fraud and data theft risks as part of a comprehensive payments security plan.
The upfront costs of converting to a new POS system may be costly depending on the merchant. However, the liability of fraud resulting from your failure to do so may far outweigh any implementation costs.
John Everett is president and CEO of Legacy Bank and Trust. He can be reached at jeverett@legacybankandtrust.com.[[In-content Ad]]
