POUGHKEEPSIE, N.Y.-EMV chip cards have slowed fraudsters in their tracks in Western Europe, but as the security technology debuts in the U.S. payments market, not all credit unions are convinced that chip-and-PIN will pay off.
"I don't see EMV providing the security you need until a significant number of merchant machines and ATMs accept EMV in the U.S.," said John Brozycki, information security officer at $3-billion Hudson Valley FCU here. "Until that happens, the encryption chips can't be read and you have to fall back on the magnetic strip. There's been talk about implementing EMV for years, but it hasn't happened yet."
EMV cards are embedded with a micro-processing chip that supports encryption and dynamic data. Some European financial institutions have been issuing EMV cards for 15 years now.
"The best source for data on how this technology affected counterfeit activity is Europe, where chip and PIN is now fully implemented," agreed Leanne Phelps, SVP-card services at SECU in Raleigh, N.C. The $24-billion SECU migrated to EMV last year, issuing 750,000 chip cards.
But SECU can't yet demonstrate that the technology is reducing fraud, Phelps said. "It's too early to have definitive data on benefits from deploying EMV cards at SECU."
That's because the entire U.S. payment channel-payments processors, card issuers, merchants, terminals and ATMs-doesn't have EMV technology at this point, she explained. "As we see more issuers and merchants go with EMV, we hope to begin seeing some improvements" in fraud reduction.
Four-Year Timeline
Among processors, VISA has taken the lead with EMV in the United States, recently announcing a four-year timeline for merchants to either get on board with chip cards or accept liability for counterfeit transactions.
"I'm very confident that VISA will have the EMV channel in place in four years"-though "MasterCard is going to have to catch up," said Merrill Halpern, AVP-card service at $3.6-billion United Nations FCU in Long Island City, N.Y., which was the first U.S. financial institution to offer EMV cards.
"Look at Canada," where chip-card migration has advanced quickly, Halpern continued. "Nobody wants to be responsible for a charge-back. If the consumer has an EMV card, and merchant can accept it, then the issuer is going to eat it."
Kyle Welsh, VP-technology services at $9.6-billion BECU in Seattle, said he thinks that a four-year timeframe is wishful thinking for widespread EMV deployment. "It's going to take forever until both VISA and MasterCard decide on a strategy. People don't like change. And who's going to step up to pay for the infrastructure?"
Even if the entire payment channel gets on board, EMV will slow fraudsters only temporarily, Welsh suggested. "Once we close down the magnetic strip vulnerabilities, it won't take long for thieves to find other avenues."
Observe & Report
The chip technology could introduce different types of fraud threats that credit unions don't know how to combat, he continued. Even though magnetic strip technology is weaker, "we know what the mag strip vulnerability is, we've had mechanisms in place to deal with it for years, and we're good at dealing with it."
The normally tech-forward BECU is currently taking an "observe and report" approach to EMV deployment, Welsh said. "It's not worth it to be a fast follower with this technology."
UNFCU was initially motivated to issue EMV cards to increase the rate of merchant acceptance among the large portion of its membership that lives in Western Europe, where EMV is the standard, Halpern said.
Only the most profitable, frequent-traveler members are issued EMV at UNFCU, he said.
