Warming to EMV Serves As Warning to Non-EMV

WASHINGTON — With some major banks now considering chip-card technology, fraud is expected to gravitate to less-secure cards.

JPMorgan Chase & Co. and Wells Fargo & Co. said in April that they would offer high-security cards adhering to the EMV Integrated Circuit Card Specifications to travelers who visit countries where such cards are prevalent. If and when that happens, U.S. issuers of non-EMV cards might want to brace themselves.

Mauricio Icaza, director of operations for Banco Bradesco SA in Sao Paulo, said Brazil learned the hard way that a slow transition to EMV cards, commonly called chip-and-PIN cards, creates a rapid shift in fraud for the banks that are lagging in their conversions.

"Card losses became huge, and a business case got built up [for EMV] as the fraudsters got smarter," Icaza said. As Brazil moved to EMV in the mid-1990s, "cards without chips were mercilessly attacked."

EMV cards typically use a PIN that is verified against the chip in the card to authenticate transactions. This process is more secure than relying purely on the magnetic stripe.

Brazil's transition to EMV began after a period of explosive growth in credit card use, said Icaza, who spoke on a panel April 27 at the Visa 2011 Global Security Summit in Washington.

According to data from a 2010 survey of top Brazilian card issuers by the Smart Card Alliance, the number of credit cards in Brazil grew 24%, to 124 million, from 2004 to 2008, while debit cards grew 12%, to 217 million. Transactions rose more than 40%, to 4.5 billion, for both payments.

The Smart Card Alliance estimates that by 2009, 60% of Brazil's cards had chips, and likewise 60% of transactions had migrated to EMV.

Industry observers cautioned that the U.S. payment market is extremely diverse, making it difficult for issuers, acquirers, processors and merchants to move in tandem. But they said fraud must still be dealt with.

"The same networks have the same vulnerabilities for the next attack, and not doing anything to reduce the threat of those losses is just kicking the can down the road," said Randy Vanderhoof, executive director of the Smart Card Alliance in Princeton Junction, N.J.

One of the strongest voices in support of chip and PIN came from the merchant community.

"Signature is not an appropriate form of authorization," said Mike Cook, vice president and assistant treasurer at Wal-Mart Stores Inc. of Bentonville, Ark. "Why do you want a system with the potential for fraud in it?"

Though these cards are not currently intended to be used in the U.S., Wal-Mart is already equipped to accept them. The company began testing such cards in three states for recipients under the federal Women, Infants, and Children nutritional grant program. Two more states will follow next year.

As the largest retailer in the world, Wal-Mart has a vested global interest in using EMV cards, and it wants to push liability for fraud costs back to the issuers, Julie Conroy McNelley, senior risk and fraud analyst at Aite Group LLC, said in a phone interview Friday.

Cook argued for the complete elimination of magnetic stripe cards. "We are at a tipping point where it will be a competitive advantage for U.S. issuers who can issue chip and PIN."

Not everyone agreed that fraud alone would create the path toward EMV.

"The U.S. has for 20 years looked at this problem from a fraud-driver perspective, and [the industry] has been unable to make the business case," Vanderhoof said.

Instead, the U.S. has relied on sophisticated secondary levels of fraud detection that include neural networks and behavioral analysis.

"We are, by far, light-years ahead in terms of real-time analysis, and our detection capabilities compensate" for a lacking in other areas, said Bob Shiflet, a fraud prevention executive at Bank of America Corp., who also spoke on the panel. Bank of America does not offer EMV cards to U.S. consumers.

Shiflet said there would have to be multiple forces behind a migration to EMV, such as an issuer's larger payment strategy, a desire to enrich the customer experience and efforts to head off legislation.

The panel discussed at length the idea of using legislation to drive adoption of EMV cards. While the panel's consensus was against government regulation to mandate use of any particular technology, many contended that the Durbin amendment, which caps the debit interchange rate that issuers use in part to cover fraud costs, could be an effective lever to adopt EMV.

Aaron McPherson, a practice director with IDC Financial Insights in Framingham, Mass., pressed the panel on this topic during the conference (he was not on the panel). In answer to his own question, McPherson wrote in a blog post Thursday, "By allowing card issuers to recover some of the costs of issuing smart cards in the form of higher interchange, it could make it profitable for banks to issue smart cards."

"At the same time," McPherson wrote, "card networks such as Visa and MasterCard could then impose a liability shift policy, similar to that deployed in other regions, where any merchant who chooses not to upgrade their terminal to read the chip bears all responsibility for any fraud that results," McPherson wrote.

McNelley concurred. She said the Durbin rule might force issuers to scrutinize their fraud costs, and they would inevitably shift costs to merchants. Just as issuers require merchants today to eat most of the costs associated with fraud in card-not-present transactions, a similar move might be made against merchants who don't upgrade to chip-and-PIN terminals.

"Merchants will then have the business case to implement EMV," McNelley said.