Many of Canada’s merchants and financial institutions are on track to meet a key deadline less than three months from now for converting to EMV chip-and-PIN card technology. And that means certain fraudsters likely will begin looking southward for new crime opportunities, experts in payment processing and terminal manufacturing say.
“The window of opportunity for committing magnetic (stripe) card fraud in North America is narrowing, and thieves know it,” says Jim Hackett, vice president of sales and marketing at Markham, Ont.-based Everlink Payment Services Inc., which handles processing for many midsize Canadian banks, credit unions and merchants. “Criminals are getting ready to concentrate on any cards in Canada that have not converted to EMV and, of course, the U.S., which is all mag-stripe cards.”
Beginning in October, Canadian merchants that have not converted to the more-secure EMV technology will be in a position to become liable for fraudulent card transactions that a chip-enabled card could have prevented. Visa Inc.’s deadline for meeting the requirement is Oct. 1; MasterCard Worldwide’s deadline is Oct. 15. American Express Co. has not yet set a similar date.
The liability-shift deadline, especially for those accepting credit cards, has been “a strong motivator” for merchants to ensure they comply with the EMV standard within the next three months, Hackett says.
Another key deadline hits on Dec. 31 of this year, when 90% of Canada’s deposit-taking ATMs must be EMV-compliant, under rules Interac, Canada’s debit network, established. All ATMs must be EMV-compliant by Dec. 31, 2012.
Everlink has “nearly” completed the migration of all of its customers’ ATMs, Hackett says. And Everlink is poised to begin switching its merchants’ point-of-sale operations to EMV next month.
“It’s a huge effort, but we expect to be substantially finished with converting most of our merchant clients by the end of the year,” he says.
Canada’s payment systems agreed in 2005 on a phased-in approach to EMV adoption, determining that 35% of Canada’s point-of-sale devices and 65% of PIN-debit cards must be EMV-compliant by Dec. 31 of this year. At the end of 2012, 60% of POS devices and 100% of PIN-debit cards must be EMV-compliant. All POS devices must meet the EMV standard by Dec. 31, 2015.
(Canadian merchants and ATMs will continue to accept foreign-issued mag-stripe cards; fraud liability for such cards likely will fall on the card issuer, observers say.)
Merchants, issuers and acquirers that fail to comply will face fines from Interac.
Catherine Johnston, president and CEO of a Act Canada, a nonprofit payments industry association, predicts that 55% of Canada’s 800,000 merchant-acceptance points will be EMV-compliant by the end of this year, while 70% of the country’s 105 million credit and debit cards also will be chip-enabled by then.
“Small and mid-sized merchants were first. It’s the largest retailers, with complex software systems requiring a lot of testing and certification, that are taking longer to switch to EMV,” Johnston tells PaymentsSource. She expects the majority of Canadian merchants to be EMV-compliant sometime next year.
It is too early to estimate the extent of new fraud that might migrate to the U.S. as Canada phases out mag-stripe card technology in favor of chip-equipped EMV cards, Christopher Justice, president for North America at payment-terminal maker Ingenico S.A., tells PaymentsSource. “We can’t say how much card fraud will increase and exactly when we will begin to see it, but it’s nearly certain that fraudsters specializing in magnetic stripes will begin to focus more heavily on the U.S. as Canada moves away from mag-stripe,” he says.
Mexico also is in the process of converting to EMV cards, Justice notes.
Mag-stripe cards are relatively easy to counterfeit compared with EMV cards that require a password, Justice notes. And while card fraud in the U.S. is still “relatively low” compared with parts of Europe before they switched to EMV technology in recent years, the U.S. is “probably becoming the most vulnerable area in the world now for magnetic stripe card fraud,” Justice says.
Most large U.S.-based merchants’ payment terminals are equipped to accept EMV cards, but the back-office and software requirements to switch away from mag-stripe cards would cost billions, Justice says. “There is no driving force yet that would make merchants or banks want to spend so much to adopt EMV, but if fraud levels spike to really high levels in the next few years, that may change,” he says.
Even if the U.S. decides to move to EMV, the effort likely would take years to accomplish, Hackett says. “In Canada we have a smaller market, and it has been a really huge effort,” he says.
What do you think about this? Send us your feedback.
