BOSTON-Credit unions that wait too long to convert members' mag-stripe plastic cards to the new EMV standard could find their payments cards hot sellers on the black market, several analysts are warning.
Payments experts told Credit Union Journal they have concerns about fraud rising significantly on non-EMV cards once the October 2015 Visa and MasterCard liability shift deadline arrives and a big chunk of large issuers convert their plastic to EMV. The experts say that criminals quickly shift to target cards that are less secure, as has been the case overseas in countries that have already migrated from mag-stripe to chip cards.
"Fraudsters do their homework; if they see institutions on mag-stripe-only, those cards will be worth a premium on the black market," said Julie Conroy, research director, retail banking, for the Aite Group, who just completed a study on EMV migration in the U.S. "You can go into these underground online forums and see the cards that are for sale. The card BINS [bank identification numbers] that are EMV-enabled and more secure go for less money than the mag-stripe cards that can be used anywhere."
A Big Bullseye
Conroy emphasized the bullseye on non-EMV plastic will be big, as her recent study indicates, and the majority of the large card issuers will convert to EMV by October 2015. Conroy interviewed 15 of the top 40 issuers, including six of the top 10. "The big ones say they will be ready. The 15 banks I spoke with represent about 55% of the outstanding cardholder population. That will be a lot of EMV cards on the market come October 2015."
The October 2015 liability shift is not a mandate for issuers. However, there is incentive for issuers to move. At that point Visa and MasterCard shift fraud liability to merchants. But if fraud occurs on a non-EMV card via an EMV-capable payment terminal, the issuer covers the loss.
Criminals' sharp, rapid focus on less-secure payments cards is real, experts say. Conroy pointed out that in Canada, where EMV migration has been completed for years, debit cards lagged behind credit cards in converting to chips by two years. "In that period debit cards saw a 37% year-over-year spike in fraud."
The bad guys "figure it out fast," said Ann Davidson, senior consultant, risk management at CUNA Mutual Group, Madison, Wis. "Look at the historical data around the move by the card associations in the early '90s to have card issuers implement CVV/CVC embedded in the magnetic stripe of the card. This helped prevent magnetic stripe counterfeit fraud."
Davidson explained that the CVV/CVC code was not a mandate until the late '90s, but a lot of banks made the change starting in 1993 and many credit unions lagged behind. "When the fraud really hit in '97 to 2000, card loss ratios at credit unions jumped by more than 300%."
Fraudsters have also increased their focus on the U.S., the last of the G-20 countries to switch to EMV. "The U.S. has already become the favorite of payments criminals," said Conroy. "Counterfeit card fraud in the U.S. has increased by 30% to 50% in the last few years. We are getting hammered."
Effective Critical Mass
Aite Group senior analyst Rick Oglesby, who just completed a companion study to Conroy's work that assessed U.S. merchant and acquirer readiness for EMV, said by October 2015 the EMV infrastructure stateside will be in place-enough to generate a critical mass of EMV payments.
"Not 100% of the merchants will be ready, but you will have enough that you will see significant EMV transaction volume. You will see movement." Oglesby said that the majority of acquirers are ready today, most having been certified for readiness via the payments networks.
Oglesby surveyed a large number of acquirers, merchants and cash register solution providers. He learned that of those merchants that are aware of the October 2015 liability shift, a large majority are moving now to make the deadline and have EMV-capable payment terminals.
"There still are a significant number of merchants that are unaware of the liability shift," said Oglesby. "But the acquirers are moving quickly to educate the merchants, and we have seen that once merchants know about the shift they take action. I expect many merchants will have EMV-capable terminals by October 2015."
New payment terminals equipped with EMV capability are also helping merchants prepare for the liability shift, noted Oglesby. In the last two years, most of the payment terminals sold were EMV capable, he said. By the end of 2013, all POS machines sold will have EMV. "So as merchants refreshed their POS machines, they picked up EMV capability."
Due to EMV cards costing more than mag-stripe, there has been a great deal of debate among payments experts about the FI moving soon to convert to the card base to EMV, or taking a wait-and-see approach to see how the technology will play out in the U.S.
There has been discussion, too, that mobile could skip over EMV, but most analysts now see that as unlikely. All-in costs for EMV, including postage, run about $4 per card for large issuers and about $10 for small FIs, noted Conroy, who said prices are coming down.
Experts have stressed that the credit union should at minimum begin planning now, assessing their membership's need for EMV-for example, if the CU has a large contingent of members who live or travel outside the U.S.
Migrating an FI's card base to EMV takes about nine months (from the start of planning to card issue), sources have stated-longer if the institution waits too long and gets caught in a backlog with processors. Being late to the market with EMV also risks the credit union's card gets shoved down in the wallet, below a competitor's chip card.
But Oglesby contends waiting to see what shakes out with EMV is not a real option, not if the CU is concerned about fraud.
"The financial institution's mag-stripe card becomes a bigger fraud target post October 2015. Evidence from the international markets that have already migrated to EMV show that fraud will migrate to the weakest link. I would not want to be that weakest link."
