EMV chip cards have delivered on their promise to halt counterfeit fraud at the physical point of sale. But for a technology developed long before the invention of e-commerce, mobile wallets and the word "omnichannel," delivering on its promise still feels like falling short.
October marks the anniversary of the U.S. card networks' fraud liability shift -- the closest thing the payments industry had to a deadline. After that date, the party not adopting EMV was on the hook for fraud. This incentive proved insufficient to convince every issuer, merchant and processor in the country to agree to the upgrade.
And if even one of those parties chose to ignore the EMV migration, the security of the system as a whole suffered.
"I think things are going about as well as could be expected given the relatively chaotic implementation process we established for EMV in this market," said Thad Peterson, senior analyst with Boston-based Aite Group.
EMV adds a chip to plastic payment cards to thwart the counterfeiting methods that became so prevalent with older magstripe cards. EMV improves security only at the point of sale, and implementing it is not as simple as plugging in a new card reader.
"There is still a backlog in implementations for mid-size merchants who are working with third parties for implementation," said Peterson, who recently concluded an EMV study for Aite. "The networks and processors are implementing programs to accelerate the process and, while that will help, there are a lot of merchants who have yet to light up EMV."
Visa first introduced the country's
This decision may have made it easier for issuers to get EMV cards in the hands of their customers, but it angered the merchants who felt that PIN authentication was necessary to get the full benefit of the investments they were making in card security.
As the U.S. progressed toward the deadline, unforeseen issues arose. Debit issuers had no way to comply with both the EMV standard and the Durbin amendment's routing requirements until very late in the migration process. Consumers were annoyed by the amount of time they had to leave their cards in a reader to complete a transaction. And even the merchants that were most eager to start using EMV security found themselves delayed by backlogs in the certification and testing process.
Still, EMV has made significant headway. EMV hardware is now commonplace at national retailers, and is even a component of Apple Pay and other mobile wallets. As of last month, Visa says nearly 1.5 million merchants are accepting chip cards and, citing the Aite Group research, that 84% of non-chip merchants say they are planning to upgrade or have the implementation process started.
Now, it is just a matter of having everyone use and embrace a technology that has been in place in most parts of the world for the better part of the last decade. In addition to stopping counterfeit fraud, proponents view EMV as a needed technology to establish infrastructure for the advancement of security and of mobile wallets.
Merchants who have completed the chip upgrade reported counterfeit fraud losses dropped 47% in May, compared to the same time last year, Visa says. The card brand said 630 million chip transactions took place with Visa cards in July of this year.
Mastercard reports 88% of its cardholders have chip cards, and two million chip-active merchants, or 33% of all U.S. merchants, on its network.
But many merchants, even if they have successfully and smoothly converted to chip acceptance, remain uneasy about how the EMV migration has played out.
On the front lines
The Merchant Advisory Group sent letters to Visa and Mastercard CEOs last month, citing challenges with in-store deployment, backlogs for necessary hardware and software, programming delays and challenges, and complications with debit card technology because of card brand decisions to segregate other networks from their own.
As a point of emphasis, the MAG is asking the card brands to rethink the October 2017 liability shift timeline for EMV acceptance at the fuel pumps -- an extension granted due to the cost and complexity of ripping out pump hardware -- until many of the current hangups can be resolved.
"The in-store transition to EMV has been handled poorly by numerous stakeholders in the payments chain at the expense of both consumers and small-business owners," said Liz Garner, vice president of MAG. "The industry needs to be prepared for even more delays and implementation problems as they look to roll out the fuel pump EMV transition."
Many of the same developers, programmers and technicians currently backlogged with implementing, managing and troubleshooting in-store EMV systems are responsible for providing the same services to gas stations, Garner said. "These resources are already stretched well beyond their capacity and have very limited time and resources to focus on EMV fuel pump deployments."
For various reasons, many merchants did not start the EMV migration process early enough, and it created certification bottlenecks and some difficulties in software coding, said Julie Conroy, research director and fraud expert with Boston-based Aite Group.
"There were a number of cases in which coding was done improperly, resulting in negative customer experiences at the point of sale," Conroy said. "When I was researching this topic earlier this year, I had a few issuers tell me that they'd delayed some of their debit card issuance because around 70 sizable merchants were having so many problems processing debit transactions properly."
The debit card dilemma
Of all the issues facing EMV, debit coding and routing may have been the most contentious.
After nearly two years of work, the major card brands developed a
This legal requirement does not exist outside the U.S., so it was never a part of any previous EMV implementation. The payments industry came to a solution ahead of last year's liability shift, but the problem is still blamed for many delays.
“From Visa’s perspective, we finished with our common AID specification in April 2013 and the next step was for testing and certification to take place between acquirer-processors and merchants," said Stephanie Ericksen, vice president of risk products at Visa Inc.
"I don’t have a specific reason for what’s holding back those merchants from implementing EMV acceptance who cite issues around the implementing of a common AID," Ericksen said. "We know that many supermarkets process a high proportion of debit transactions and some of those may have had some complications in implementing EMV to accommodate cash-back and debit-routing issues."
The more complex a merchant's payment environment, the longer it can take to migrate that environment to EMV, Ericksen added.
Despite a solution being available for debit routing, some merchants still felt it was too difficult for them to establish independent networks as routing options. As such, the MAG requested the Federal Financial Institution Examination Council examine the process to assure
Further, EMV terminal software as it relates to
Visa has worked to streamline the process for merchants to test EMV solutions with their acquirers, including pre-testing modules, Ericksen added. "Some merchants have to test with multiple acquirers, which may take longer."
It took Europe two to three years for the majority of merchants to migrate from magstripe to EMV acceptance, and already in the U.S., after one year, 30% of card volume is processed as chip-on-chip (i.e., all parties in the process, from merchant to issuer, support EMV).
Ericksen calls that good progress. "In other countries, it’s taken years to fully transition to EMV, and we’re a large country with a very diverse merchant marketplace," she said.
The last mile
Even after the issuers, merchants, processors and acquirers got through the complexities of EMV migration, the process encountered new snags at the consumer level. In particular, shoppers who were accustomed to quickly swiping their older magstripe cards hated the new practice of leaving their chip-enabled cards in a reader for upwards of 10 seconds.
To address this concern, all four card networks announced versions of what Visa calls
The moves were clearly the card brands' response to feedback from merchant clients, but also a signal that they realized the need to adjust their expectations on the fly.
The new Quick Chip software allows shoppers to remove EMV cards from a reader after about two seconds. It accomplished this by eliminating some steps that EMV originally required for authentication in overseas markets where merchants were not expected to have an online connection to verify a chip-card's authenticity. In the U.S., this is less of a concern, so those steps were deemed unnecessary in certain environments.
The first two merchants converted to Quick Chip two months ago, but other merchants have been slow to follow. Still, the card brands look at this development as a way for merchants who have yet to migrate to chip to be able to do so without concerns about transaction speeds.
Despite the problems encountered at the merchant and consumer level, the EMV migration has gone much more smoothly for the banks that had to convert entire debit and credit card portfolios to the new security standard.
"From the issuing side of things, I think the process has gone as well or better than expected," Aite's Conroy said.
By the end of the year Aite expects to see 81% of credit cards and 57% of debit cards upgraded, representing 94% and 72% of spend respectively, Conroy said. Fiserv has reported that banks are moving to "
"That’s great progress, especially considering the vast number of financial institutions in our market, far more than any other country that’s made the move to EMV," Conroy said.
However, that doesn't mean consumers fully understand what they are doing with a chip card at the point of sale, according to payments technology provider Cayan.
In a survey of 1,000 consumers, Cayan found that more than 80% remain confused about at least some facets of their new cards.
Most are confused about where the cards are accepted, Cayan's report said. That feedback points to poor signage at merchant locations.
As many as 63% of consumers say they experience a level of frustration with the cards, either from not working properly, not understanding the process or having to wait so long for a transaction to authorize.
Even though EMV security has no bearing on e-commerce, as many as 71% say they will shop online to avoid having to use a chip card in a store.
Still, 42% of consumers said they use a chip card three or more times a week while shopping, but 91% said they had, in the past six months, encountered stores that did not accept chip cards.
"It's no small undertaking to change the way people pay for things," said Chiro Aikat, Mastercard's senior vice president of product delivery and EMV. "The only reason to start this big of a task it to make people's lives better, and chips have the potential to do just that."
EMV's story is only beginning. If we consider last year's liability shift to be its starting point, then we are just one year into what many predicted would be at least a three-year process. Whatever problems we have faced so far, this is still significant progress for a technology which some predicted would meet the same fate as the U.S.'s adoption of the
Kate Fitzgerald contributed to this story.
