Six months following the liability shift date for EMV cards, the switch to chip technology is reducing some card-present fraud.
Payments experts interviewed by Credit Union Journal say the early data look promising, especially on the card issuer side. Visa issued 212 million EMV chip cards by the end of 2015 and MasterCard said 59% of its credit cards in the United States had EMV chips. Overall, according to Visa research, seven in 10 Americans have at least one EMV card in their wallet.
The biggest obstacle appears to be slow merchant adoption of EMV-ready terminals, upgrading the software in existing terminals, or both. It is estimated only about 10% of card transactions in the U.S. are chip-on-chip transactions—meaning a consumer using a chip card at a chip-enabled terminal.
Michelle Thornton, director of product development for CO-OP Financial Services, Rancho Cucamonga, Calif., said the adoption of chip cards will reduce fraud eventually, but it will take the U.S. a "long time" to be fully EMV compliant.
"For the cards that are chip-ready, we do see less card-present fraud," Thornton said. "But there still is such a low number of EMV cards out there—especially debit because that was later than credit—and there is a small number of merchants that are EMV-ready, so there is a relatively small number of EMV transactions."
Barney Moore, director, portfolio consulting services for CSCU, Tampa, Fla., said EMV is having its intended effect at the point of sale. "If a merchant has a chip-enabled terminal and the consumer presents a chip card, there is an improvement in fraud," he said. "There is not a lot of formal data out there, but it seems the [majority] of transactions are not chip-on-chip. It is going to take some time before we see the broad-reaching benefits."
Dr. Art Harper, director, solutions consulting for payments at PSCU, St. Petersburg, Fla., said the CUSO's member credit unions are seeing the benefits already. "We started tracking in the fourth quarter of 2015. In two quarters [Q4 2015 and Q1 2016], we already see chargebacks to the merchants totaling about $2 million of transactions where a chip card was present and the terminal was not compliant. That saves our credit unions about 12% of fraud dollars, which is pretty significant savings."
Tech Ripple Effect
Jamie Topolski, director of alternative payment strategies for Fiserv said America's transition to chip cards is just one part of what he calls a "tech ripple effect."
"EMV is obviously a very big change for the industry, but it is part of two broader trends happening concurrently," he explained.
Topolski said the first trend is the push to provide greater convenience, with CUs offering instant issuance to members in branches. Also in the name of convenience, there are a growing number of CUs implementing card-free cash access with a smartphone.
The second major tech trend is trying to make transactions more secure, through tokenization or card controls.
"These two broad groupings of enhancements are a little bit of a paradox, but the industry is creating solutions to try to balance both," Topolski said. "Controls on a card serve multiple purposes at once—how and when the card is used. If someone misplaces their card they don't have to cancel and reissue, they can turn it off. This adds security and convenience in the same solution."
These technologies lack enough history to fully gauge their impact, Topolski noted. "EMV, certainly, will reduce the ability of criminals to create counterfeit cards. There has been enough of a discussion about card-not-present fraud that no one is waiting for fraud to migrate online. Tokenization and identity verification at checkout are two initiatives that can help reduce fraud online."
CO-OP's Thornton said card fraud is continuing to increase—because criminals know that is where the money is. "We are still so early in the adoption of EMV and card-not-present fraud was rising anyway. It might take a year or two to see a significant impact from EMV adoption," she assessed. "There needs to be significant numbers of cards and terminals. Low estimates are most cards will be EMV-ready, but it is hard to say how long it will take merchants."
CSCU's Moore said there has been some research on fraud attempts increasing on the Web, even before the EMV liability shift date which is consistent with what happened in other markets.
Why Are Merchants So Slow?
Opinions varied on exactly how to characterize merchant adoption of EMV terminals. CSCU's Moore cited a study that found 42% of retailers have not updated their terminals—either the hardware or the software.
"A lot of the grocery chains have been a little bit slow to upgrade," Moore said, noting the primary reason behind the delay is cost – there are hardware costs and software costs, plus a certification process. "Based on what I have seen, there is a queue for certification."
Moore said the Kroger grocery chain, along with other merchants, recently announced it will not allow debit card transactions to be run as credit. "For credit unions, that means their interchange will be reduced," he warned. "Financial institutions earn higher interchange when a debit card is used on the credit rail. This will be a bigger topic in the months ahead because it will have an impact on loyalty programs."
Fiserv's Topolski said there has been growth in the number of merchants that support EMV transactions, and that EMV adoption is "progressing along very nicely," both on the merchant side and the issuer side.
"The impact of the liability shift is starting to be felt by merchants, which is an incentive to accelerate their implementation of EMV," he assessed. "I would be shocked if merchants do not start to move more quickly. ATMs have two liability shift dates—October 2016 for MasterCard and October 2017 for Visa and most of the PIN debit networks. I expect to see similar movement when those dates get closer."
PSCU's Harper said merchant adoption needs to be seen in terms of three "tiers" of stores. He said tier one merchants such as CVS, Best Buy and Walmart, all had to deal with publicity to make sure they got EMV-certified prior to the liability shift, and most tier one stores are compliant.
In tier two are regional grocery stores, while tier three is mom-and-pop merchants, he continued. "As you look down each tier, adoption is slower. Many mom-and-pop stores think EMV will not affect them because they only have one or two terminals, but they do not realize one big breach with a large number of cards could put them out of business."
In tier two, which includes many regional merchants such as grocery stores, there are "complexities," Harper said. "Some large pharmacy chains have different setups in different states, with some using EMV and some not," he observed. "This is being blamed on the acquiring networks, but in some cases the terminals have not been upgraded, which could be due to cost or could be the company's risk tolerance level."
According to Harper, one of the biggest issues right now is consumers are confused, never quite sure whether they're supposed to swipe or insert a card.
"It makes a cloudy experience for consumers," he lamented. "At the end of the day, this is a consumer experience impact. Card holders want to use their card in a safe environment, and if their financial institution has given them a safe card they want to use it."
Harper believes statistics eventually will show EMV will reduce fraud, which is what happened in other countries as they switched to chip cards, but it could take 18 to 24 months to get a large number of merchants on board. "As we get closer to 90% compliant, that will push bad guys into other channels. We are seeing it already, as criminals move to fuel dispensers and online. Card-not-present fraud will see a spike, but tokenization should help alleviate that movement. Next, we will need to be aware of online account takeovers as the bad guys find more and more avenues closed."
CO-OP's Thornton said the EMV shift is more of a marathon than a sprint. "It was the first lap of a very long race," she said with a chuckle. "Most industry experts think it will take 10 years for everything to be in place. I don't know if it will take 10, but it will take several years because it is a lot of work. Some merchants might be looking at their fraud and their costs, and take the risk of not changing their terminals. Many did not want to make changes before the holiday shopping season, but I expected a few more to make changes this year."
Thornton said debit EMV had to resolve routing issues, which will take a significant amount of time. She noted it took two-and-a-half years for the industry to agree on the standards for debit EMV, placing it well behind credit EMV.
"The final decision was the network would license it for free to all the other networks, so two application identifiers were needed for every chip. Merchants had to develop new software to enable the solution," Thornton said.
Fiserv's Topolski said he looks forward to the day when there are more chip terminals ready. "When there are, we expect to have the same reaction as in other markets around the world, which is a great reduction in counterfeit card fraud.
"I remain upbeat and positive about the rollout," Topolski continued. "EMV is part of a broader trend that will benefit members of credit unions and limit the ability of those who commit fraud. We will see more secure payments for everyone."
