Here Comes EMV

  European banks are ramping up for a fundamental change in the way card payments are handled. The implications of this change go far beyond Europe's borders. Banks across Europe are in the midst of issuing millions of smart credit and debit cards that also have personal identification numbers. These so-called chip-and-PIN cards, which are based on the EMV (Europay/MasterCard/Visa) chip card security standards (see definition, page 36), are intended to stamp out fraud both in stores and at automated teller machines.
  As of Jan. 1, Visa and MasterCard have mandated that liability for point-of-sale card fraud will be transferred to the issuer, acquirer or merchant not equipped to handle EMV transactions. The deadline is intended to pressure merchants and acquirers to deploy EMV terminals, and to force issuers to convert Western Europe's 640 million cards from the ubiquitous magnetic stripe to chip-and-PIN.
  Many banks will not meet the Jan. 1 deadline for issuing EMV chip cards, nor will tens of thousands of merchant terminals be capable of reading them. European issuers and merchants face no penalties for non-compliance other than the liability shift. Many are willing to take the fraud risk, as least for now.
  While everyone is paying lip service to it, in reality full EMV compliance may not be achieved in some countries until 2008, according to analysts. In the United Kingdom, domestic transactions are supposed to be EMV compliant Jan. 1. Elsewhere in Europe, the immediate concern centers on cross-border, intra-regional transactions, such as those generated in areas frequented by tourists. Payment cards and terminals mainly involved in domestic transactions will be upgraded later. No wonder many observers believe Jan. 1, 2005, has taken on an aura of exaggerated importance.
  Nonetheless, it's a safe bet that Europe's transition to a common smart card platform is a foretaste of what lies ahead for the rest of the world. Asia-Pacific, the Middle East, Canada, and parts of Latin America also are moving to chip-based cards. The United States is the notable exception.
  "The one major market not yet moving to EMV is the U.S., where low fraud rates make it difficult to justify the cost of converting to smart cards," Denny Jensen, Visa International senior vice president of chip implementation, told a Paris conference in November.
  But the U.S. may be forced out of its isolationism. With Europe's migration to chip, criminals could make their way across the Atlantic, where signature-based, magnetic-stripe credit and debit cards dominate, industry figures warn.
  "Card fraud always migrates to the weakest link," says Nick Mourant, group treasurer at Tesco, the United Kingdom's largest supermarket chain. "It may be that U.S. mag-stripe cards will be cloned and used fraudulently in Europe, or maybe European chip-and-PIN cards will be skimmed when tourists visit the U.S."
  Adds Campbell Fisher, head of smart cards at the Royal Bank of Scotland (RBS): "The criminals will move to wherever there is a significant volume of card transactions, but without the anti-fraud controls established in Europe. They may also move to other types of payment, for example telephone ordering or Internet payments."
  But most observers believe fraud still doesn't cut it as a business case for U.S. chip cards, though it does elsewhere. Thank a good phone system for that. CCM estimates total fraud losses on general-purpose credit cards, retail cards and debit cards of about $2 billion in 2003. That may sound like a lot, but fraud amounts to only about 1% of U.S. bank credit card issuers' expenses.
  "In the U.S., the problem with EMV is that it will cost the banks more to upgrade the country's large numbers of ATMs and POS terminals than they currently lose through fraud," says Nigel Walsh, chairman of Dunfermline, Scotland-based EMV software firm Level Four Software Ltd. "Converting Europe's ATMs and terminals to EMV has been very expensive. There is also customer re-education and the issuing of new plastic. The view in the U.S. is that 'we don't lose that much from fraud, so we will look at EMV later.'"
  With card fraud in the U.K. alone having risen from ?122 million (approximately $200 million) in 1997 to ?424 million ($680 million) in 2002, European banks are hoping that the greater security offered by chip-and-PIN will cut losses from counterfeit or stolen cards. As they store the cardholder's details on a chip, EMV cards are far harder to counterfeit or skim than mag-stripe cards. An encrypted copy of the cardholder's PIN is also stored on the chip.
  Also, because EMV cards require PIN entry rather than a signature on a receipt to authorize POS transactions, losses from theft should be minimized. The PIN entered by the customer has to match the PIN stored on the chip, or the transaction will not be authorized.
  One motivator for European banks and merchants to migrate to chip-and-PIN is the shift in liability for POS card fraud mandated by Visa and MasterCard. Beginning Jan. 1, any European merchant that has not installed chip card readers that authorize transactions through the cardholder entering a PIN will become liable for fraudulent use of chip-and-PIN cards in its stores. Until then, issuers will remain responsible for any POS fraud committed using their cards. So for issuers, migrating to chip should significantly cut their fraud losses.
  Retailers missing the deadline potentially could lay themselves open to being targeted by fraudsters, and would become liable for any resulting losses.
  "The U.K. banks have used the threat of migrating fraud to pressurize retailers to upgrade to chip-and-PIN," says a spokesperson for the British Retail Consortium, a trade group.
  Below are summaries of EMV's progress-or lack thereof-followed by what it all means for the United States:
  * Britain. Data from the Association of Payment Clearing Services (APACS), the London-based banking organization responsible for Britain's migration to EMV, indicate that Britain is leading the rest of Europe in adopting the new standard.
  By the end of October, U.K. banks and other issuers had issued a total of 65.5 million chip-and-PIN credit and debit cards. Also, 520,000 U.K. terminals had switched over to chip-and-PIN from mag-stripe-only.
  "We will see virtual saturation of chip-and-PIN debit cards in the U.K. in the second quarter of 2005," says Anthony Pickup, a consultant at British smart card specialist ConsultHyperion. "By the third quarter of 2005, we will have achieved saturation of chip-and-PIN credit cards."
  Leading U.K. supermarket chains Tesco, Asda, Morrisons and Safeway have already switched to chip-and-PIN, as has gas-station chain BP.
  "Forty-five of the largest U.K. retailers are committed to chip-and-PIN and are in the process of migrating to chip-and-PIN," says Tesco's Mourant. "In addition, most of the small retailers, whose terminals are supplied by the banks, have been upgraded to chip-and-PIN."
  Banks offered major retailers financial incentives to upgrade their terminals to chip-and-PIN. According to U.K. sources, big retailers were offered a 10-basis-points reduction in card fees for making the switch.
  In 2002, APACS estimated it would cost just over ?1 billion (approximately $1.7 billion) to upgrade the U.K.'s payment infrastructure, with retailers paying about one-third. Of course, consumers will be the ultimate payers since the costs will be reflected in the price of goods and services.
  The banks have had to pay for the cost of upgrading the terminals they lease to small U.K. retailers. But mid-tier retailers own their terminals and therefore have to pay for upgrading to EMV.
  "Of the three retailer segments, it is mid-tier retailers which are the most behind in migrating to chip-and-PIN," says an APACS spokesperson. "But they are making better progress than they were before."
  Interviews with the U.K.'s largest banks and credit card issuers, including RBS, Barclaycard and Alliance & Leicester, indicate that they are making good progress in meeting their chip-and-PIN targets. Others have not yet started issuing chip-and-PIN cards.
  "Some smaller issuers are not quite ready to get their chip-and-PIN cards out," says Chris Lomax, marketing director at London-based EMV consultancy Aconite. "For those issuers sticking with mag-stripe, they will have looked at the situation and decided it makes sense not to rush chip-and-PIN and to accept liability for any fraud involving their cards."
  Royal Bank of Scotland has so far issued 20 million EMV credit and debit cards, Fisher says.
  "We have a huge proportion of our bank-owned payment card terminals upgraded to chip-and-PIN," he adds. "Most of our big retailer customers are also upgrading their terminals to chip-and-PIN."
  A spokesperson for Barclaycard, Britain's biggest credit card issuer, said in November, "We're not saying that 100% of our cards have been upgraded to chip-and-PIN, but we have converted a reasonable number. We are on target to have issued all the chip-and-PIN cards by the end of 2004 that we set out to issue when we formulated our plans in January 2004."
  In November, Lloyd Lewis, chip program manager at Alliance & Leicester, said that by the end of 2004, "We will have reissued 80% of our 1.5 million debit cards as chip-and-PIN cards." U.S.-based MBNA Corp.'s European subsidiary issues Alliance & Leicester's credit cards.
  * France and Elsewhere in Europe. Migration to chip cards in Europe is not homogenous across the continent, says Toni Merschen, senior vice president and head of the MasterCard International Chip Center of Excellence in Waterloo, Belgium.
  "The U.K. is the most advanced country for chip, both in terms of issuing and acquiring," Merschen says. "The U.K. will see 50% of domestic transactions being chip-enabled by the end of 2004, and 100% of transactions being chip-enabled by the end of 2005.
  "France will also have achieved 100% of transactions being chip-enabled by the end of 2005, while Germany will see 80% of debit card transactions chip-enabled by then," he continues. "Belgium, the Netherlands, Austria, Switzerland, the Nordic countries and, to some extent, Spain and Italy, are all making progress."
  In Spain, banks have installed large numbers of chip-and-PIN readers in selected tourist destinations with high card fraud, says ConsultHyperion's Pickup.
  France is a special case, as it already has a proprietary chip-and-PIN card system that has virtually eradicated domestic POS card fraud. Yet it decided in 2003 to migrate to EMV.
  According to French payment card organization Groupement des Cartes Bancaires, by October 2004 only 9.3% of France's 47.6 million bank cards had been migrated to chip-and-PIN. These 4.4 million chip-and-PIN cards contain both an EMV chip and a B0' chip. B0' (pronounced B Zero Prime) is Cartes Bancaires' proprietary chip-and-PIN system, which was launched in 1992.
  "The reason France decided to have dual-chip cards is to make it easier for merchant terminals to cope with the upgrade to EMV," Pickup says. Although the French initially are using a dual-standard approach to chip-and-PIN, they eventually will abandon B0'.
  Analyst Karina Purang of London-based Datamonitor estimates the cost of France's migration to EMV at 1 billion euros ($1.3 billion).
  "There are at least three European countries that will set a later date for their domestic liability shift than Jan. 1, 2005," says Richard Korn, Visa's vice president of chip business integration. "I think that Spain, Italy and Portugal are likely to set their domestic liability shift for January 1st, 2007."
  * Canada and Latin America. North America lags Europe in EMV migration, but Canada is well ahead of the U.S. In December, Visa Canada set October 2010 as the date by which Visa members must convert to smart cards or accept liability for fraud losses. The Canadian unit of Visa in 2003 outlined a smart card roadmap, but this recent announcement for the first time fixes a date for the liability shift.
  By giving plenty of notice of the change, issuers and acquirers can make the move most efficiently, Allen Wright, director of chip initiatives and emerging technologies at the Visa Canada Association, told CCM sister publication CardLine. For instance, it allows for the upgrade of POS terminals to accept smart cards as they are being regularly replaced, typically every five to seven years.
  "It's about creating a balance between accomplishing the goal and doing it in a way that's beneficial for all the stakeholders," Wright says.
  Visa's 24 Canadian members issue 24.8 million credit cards that are accepted at 623,000 payment terminals and 19,500 ATMs.
  MasterCard Canada, however, wants the marketplace to set the timeline for chip, according to Kevin Stanton, president of MasterCard Canada. "Mandatory timeframes are illusory," he says.
  Adds Merschen of MasterCard's Chip Center of Excellence: "Worldwide, with the exception of the U.S. and Canada, MasterCard has decided on a migration to chip in respect of a liability shift and incentives for issuers and acquirers. There are no business processes in the U.S. and Canada which would incentivize issuers and acquirers to migrate to chip."
  According to analyst John Gould of Needham, Mass.-based TowerGroup, Interac, Canada's PIN-based debit network, is carrying out a major chip card migration study.
  "Interac is under pressure from the Canadian government to tackle the problem of ATM fraud and mag-stripe and PIN skimming," says Gould, whose firm MasterCard acquired in 2004.
  Walsh says Level Four "is aware of Canadian banks that have projects scheduled to commence in January 2005 to start POS conversion to EMV." He would not identify the banks.
  "Replacing terminals just for chip is very expensive, but Canadian acquirers are starting to install terminals that have EMV chip acceptance built in," says Merschen.
  In Latin America, MasterCard has mandated Jan. 1 as the liability shift deadline. Visa, however, has adopted what it terms a "trigger approach," whereby the liability shift will take place two years after 50% of regional credit card sales volume is chip-based. Visa expects chip to achieve critical mass in Latin America in 2008.
  EMV has been making inroads in Latin America over the last few years, due to the high levels of fraud.
  "Card fraud is nearly five times higher than in the U.S. market, and growing at 12% per annum," says Jan Smith Ramos of Coral Gables, Fla.-based consultancy InfoAmericas.
  In September 2003, six Mexican banks in association with Visa and MasterCard launched an EMV trial in Toluca, which is still ongoing. Some 120,000 customers have been issued chip cards, and 1,500 terminals upgraded to EMV.
  According to Smith Ramos, at the end of 2003 there were 3 million to 4 million EMV cards in issue in Brazil, a figure that is expected to double in 2005. In addition, 80% of Brazilian POS terminals could handle chip cards at the end of 2003. In Mexico, merchant acquirers plan to have more than 500,000 EMV-compliant POS terminals installed by 2008.
  Some industry executives, however, are skeptical about the EMV deadlines for Latin America.
  "When you ask the major banks in Mexico and Argentina about EMV, they shrug it off and comment that it's just another wild-goose chase, just like e-wallet schemes back in the '90s," says Level Four's Walsh.
  * United States. In the U.S., there are no worries about blowing EMV deadlines because there aren't any. Hopes that the U.S. might adopt a migration path to chip in the near future faded last March when big discount retailer Target Corp. announced it would phase out the chip on its self-issued Visa credit card. Target had issued 14 million credit cards over the preceding 2 1/2 years containing a chip designed for a loyalty application-downloading electronic coupons that could be used in Target stores. Cardholders, however, failed to use the application, leading Target to abandon its chip program despite heavy financial backing from Visa.
  Several years ago, three other Visa issuers-Fleet Bank (now owned by Bank of America Corp.), Providian Financial Corp., and First USA/Bank One (now owned by J.P. Morgan Chase & Co.)-also cranked out smart cards, an estimated 10 million in all. But all three have since dropped or downplayed their chip cards. And American Express Co. is giving scant marketing attention to the chip on its sleek Blue card.
  The only other example of U.S. banks issuing smart cards is for contactless payments, similar to the contactless smart cards commuters wave past transit turnstiles. The main purpose of this technology, however, is not security but to increase the usage of credit cards for small-value items such as fast-food purchases.
  "U.S. issuers really have no EMV chip card plans," says analyst Ariana-Michele Moore of Boston-based Celent Communications.
  In November, a spokesperson for Citigroup Inc.'s Citibank, the world's largest credit card issuer, said regarding EMV-enabled chip cards that the "U.S. has no plans for chip at this time." At the end of the month, however, CardLine disclosed that Citi will test a combination chip credit/transit card with Washington, D.C.-area commuters (box, page 35).
  Some observers question the conventional wisdom that fraud will migrate to the U.S. because it will be tougher to commit in Europe with the coming of EMV.
  "The U.S. has very sophisticated back-end card fraud detection systems," says analyst Avivah Litan at Stamford, Conn.-based Gartner Group Inc. "These systems are very effective for physical transactions."
  And MasterCard Canada's Stanton also is skeptical about fraud heading to the U.S. once Canada and Mexico have moved to chip. "It's the conventional view that fraud will migrate, but the U.S. has been very successful at tackling card fraud through the use of advanced technology and good cooperation with law enforcement," he says. "I don't see that this level of success will change once neighboring countries have moved to chip."
  According to TowerGroup's Gould, U.S. credit card fraud is running at 7 basis points of charge volume.
  Still, some executives say the ATM fraud-loss problem justifies an EMV solution. According to Level Four estimates, the real cost of ATM fraud in the U.S. is around $200 million a year, including the administrative costs of dealing with it. Experts estimate it will cost more than $366 million to upgrade the U.S. ATM fleet to EMV.
  Easy Targets
  "ATM fraud is very attractive as you don't go into a shop to use a stolen card, you just tamper with an ATM," says Jorge Fernandez, chief executive and president of Level Four's Miami-based Americas unit. "It is likely to increase in the U.S. as fraud migrates from Europe. ATMs are seen as an easier target than POS by the criminals."
  Celent's Moore agrees it makes sense for the U.S. to migrate its ATM network to EMV before upgrading POS terminals. "I think the U.S. will follow the U.K. model of EMV migration, where ATMs got upgraded before POS terminals," she says.
  Many questions about EMV and its implications remain unanswered. But what is clear is that thanks to EMV, a workable, international chip-based card payment system is taking shape. How long can the U.S. ignore it?
  Robin Arnfield is a British-born freelance writer now living in Osoyoos, British Columbia. He can be reached at robinarnfield dial.pipex.com.