The first deadlines for Canadian banks and merchants to shift to the EMV Integrated Circuit Card Specifications will hit in October, and security experts are warning that U.S. payments companies should expect a surge in fraud as criminals target more porous systems.
"The window of opportunity for committing magnetic [stripe] card fraud in North America is narrowing, and thieves know it," said Jim Hackett, the vice president of sales and marketing at Everlink Payment Services Inc., a Markham, Ontario, processor that serves midsize Canadian banks, credit unions and merchants. "Criminals are getting ready to concentrate on any cards in Canada that have not converted to EMV and, of course, the U.S., which is all mag-stripe cards."
Beginning in October, Canadian merchants that have not converted to the EMV technology will be liable for fraudulent card transactions that a chip-enabled card could have prevented.
Visa Inc.'s deadline for meeting the requirement is Oct. 1; MasterCard Inc.'s deadline is Oct. 15. American Express Co. has not yet set a similar date. These deadlines have been "a strong motivator" for merchants to ensure their compliance with the EMV standard within the next three months, Hackett said.
With EMV, consumers typically enter a PIN to authorize transactions at the point of sale, and the format is generally considered to offer stronger security than purchases made with magnetic-stripe cards and authorized with a signature.
Payments executives predict that fraud will increase in the U.S. once security improves in neighboring countries; Mexico is also converting to EMV.
"We can't say how much card fraud will increase and exactly when we will begin to see it, but it's nearly certain that fraudsters specializing in magnetic stripes will begin to focus more heavily on the U.S. as Canada moves away from mag-stripe," said Christopher Justice, the president for North America at the French payment terminal maker Ingenico S.A.
Mag-stripe cards are easy to counterfeit compared with EMV cards that require a password, Justice said. And while card fraud is still low compared with parts of Europe before they switched to EMV technology in recent years, the U.S. is "probably becoming the most vulnerable area in the world now for magnetic-stripe card fraud," Justice said.
The terminals at most large U.S. merchants are equipped to accept EMV cards, but the back-office and software requirements to switch from mag-stripe cards would cost billions, Justice said. "There is no driving force yet that would make merchants or banks want to spend so much to adopt EMV" in the U.S., "but if fraud levels spike to really high levels in the next few years, that may change."
And if the U.S. ever does decides to move to EMV, the effort likely would take years to accomplish, Hackett said. "In Canada we have a smaller market, and it has been a really huge effort," he said.
Another key deadline in Canada is Dec. 31, when 90% of the country's deposit-taking automated teller machines must be EMV-compliant, under rules set by Interac Association, which operates Canada's debit network. All ATMs must be EMV-compliant by the end of 2012.
Everlink has "nearly" completed the migration of all of its customers' ATMs and is to begin switching its merchants' point of sale operations to EMV next month, Hackett said. "It's a huge effort, but we expect to be substantially finished with converting most of our merchant clients" by yearend.
Canada's payment systems operators agreed in 2005 on a phased-in approach to EMV, determining that 35% of Canada's point of sale devices and 65% of its debit cards must be EMV-compliant by the end of this year. At the end of 2012, 60% of POS devices and 100% of debit cards must be EMV-compliant. All POS devices must meet the EMV standard by Dec. 31, 2015.
(Canadian merchants and ATMs will continue to accept foreign-issued mag-stripe cards; observers say that fraud liability for such cards likely will fall on the card issuer.)
Merchants, issuers and acquirers that fail to comply will face fines from Interac.
Catherine Johnston, the president and chief executive of Act Canada, a nonprofit payments industry association, predicts that 55% of Canada's 800,000 merchant-acceptance points will be EMV-compliant by yearend and that 70% of the country's 105 million credit and debit cards also will be chip-enabled by then. "Small and midsize merchants were first. It's the largest retailers, with complex software systems requiring a lot of testing and certification, that are taking longer to switch to EMV," Johnston said. She expects the majority of Canadian merchants to be EMV-compliant sometime next year.