Cost of U.S. Chip-and-PIN Would Far Outweigh the Benefit: Report

Retailers insist that the EMV migration in the U.S. is weak because there is no PIN requirement to verify chip-card transactions, a process that is standard practice in other nations.

The merchants’ case for adding PIN security intensified early this year when they were forced to foot the bill for a wave of chargebacks on contested transactions they say PINs would have prevented. But a recent study by Aite Group suggests the cost of mandating chip-and-PIN in the U.S. would far exceed the losses endured on lost and stolen EMV cards.

EMV’s primary purpose is to block counterfeit card fraud use, which accounts for 45% of all card fraud; PIN authentication protects against lost and stolen card fraud, which amounts to about 9% of all losses, Aite said in a July 28 report.

Aite projects that if the payment card industry were to begin requiring PINs for all U.S. chip card transactions, over five years the cost of lost and stolen payment cards would fall by $850 million, but the total cost to merchants and issuers would exceed $6 billion.

Counterfeit fraud rates are already leveling off after issuers introduced a counterfeit card fraud liability shift for merchants on Oct. 1, 2015, Aite said in an earlier report.

Online card fraud rates, in turn, are rising in the wake of many ongoing data breaches that exposed consumers’ card data to thieves. Aite earlier forecast that card-not-present fraud is on track to soar to $7.5 billion by 2020.

Merchants are liable for the cost of counterfeit card fraud, but they have no liability for lost and stolen card losses. Lost and stolen card fraud peaked in 2014 at 14% of total fraud losses, Aite said.

The majority of chip-equipped credit cards and some debit cards in the U.S. currently are used at EMV terminals with no PIN, whereas many EMV debit card transactions and all cash withdrawals at major retailers and banks require a PIN.

While the cost to implement PIN verification at terminals that already have a PIN pad is insignificant, thousands of terminals have no PIN pad, Aite said, projecting that it would cost issuers about $4 billion to upgrade to fully support PINs. U.S. issuers also would have to reissue many cards and establish programs to support PIN management, modifying many ATMs, at an estimated cost of $2.6 billion, according to Aite.

“With very little incremental risk for merchants and significant expense and implementation challenge for the payment ecosystem, it is difficult to justify a mandate to implement PIN as a credit card verification method,” said Thad Peterson, a senior analyst with Aite Group, who produced the report.

Aite based its 34-page report on interviews with about 400 retailers, processors and banks between April and June 2016.