A growing number of payments-industry players are concerned that card-fraud rates may begin to rise sharply next year in the United States, one of the only remaining industrialized nations relying solely on magnetic stripe card technology while neighboring nations adopt more-secure EMV chip-and-PIN cards.
Canada’s merchants and financial institutions this fall will reach significant milestones in a national conversion to EMV technology that began several years ago, while Mexico continues its own steady adoption of chip-and-PIN technology.
As both countries rapidly eliminate mag-stripe card technology, card security experts say criminals are poised to step up certain types of mag-stripe card fraud in the U.S.
Recent reports suggest that card-skimming fraud, which EMV is designed to prevent, already is on the rise in certain U.S. regions.
EMV is an international standard for chip-based payment card transactions that requires a PIN to authenticate the cardholder, and it provides some security advantages over signature-based mag-stripe cards.
A U.S. conversion to the EMV standard would be costly and time-consuming, experts say. Merchants would be required to replace or adapt payment terminal hardware to accept chip cards, processors would have to adapt back-office systems to process payments with the additional authorization layer, and banks would need to reissue cards with chips.
Some large U.S. merchants say they already have payment-terminal hardware that they easily could adapt to the EMV standard, but spokespersons for Scottsdale, Ariz.-based terminal maker Hypercom Corp. and San Jose, Calif.-based VeriFone Systems Inc. say the majority of small and midsize merchants do not.
Though no plans are yet afoot for the U.S. payment card market to begin the costly process of switching to EMV, certain large merchants and other payments-industry participants are growing restless, suggesting it is time for the United States to get serious about adopting chip- and-PIN technology before fraud spikes.
“It’s obvious that as criminals run into obstacles conducting crime in surrounding countries, they will focus their efforts more on the U.S. So logic says we will begin to see an increase in signature-based card fraud here,” Jamie Henry, director of payment services at Wal-Mart Stores Inc., tells ISO&Agent. “Right now, the U.S. payment system is the weakest link in the world when it comes to in-store, face-to-face card fraud, and moving to EMV would fix that problem.”
The Home Depot Inc. also is concerned about the potential for U.S. signature-based credit and debit card fraud to rise in the near future.
“We absolutely see a rise in organized U.S. retail crime networks that are concentrated on signature-based credit and debit cards for committing point-of-sale fraud,” Mario de Armas, Home Depot director of international and interchange financial services, tells ISO&Agent. He declined to provide Home Depot’s fraud figures. “Moving to EMV would eliminate most point-of-sale fraud on signature-based transactions, which would eliminate a huge area of losses,” de Armas says.
Foreign card issuers also could begin to see an increase soon in losses from card fraud committed in the U.S., says Mike Urban, director of fraud solutions for FICO, an analytics and decision management technology company.
“Because foreign-issued EMV cards also have a magnetic stripe, those cards can be used in U.S. payment terminals, and they can also be counterfeited fairly easily for fraudulent point-of-sale transactions,” he explains. “As EMV compliance spreads and gradually cuts off fraud opportunities for criminals outside the U.S., we may see a rise in cross-border fraud where criminals are stealing cards in foreign countries and shipping them to criminals in the U.S.”
Many international observers believe it is only a matter of time before the United States is forced to adopt EMV technology, whether from rising fraud levels or competitive market pressure, says Ian Kerr, CEO of Scotland-based Level 4 Software Ltd., which has assisted banks around the world in converting ATMs to EMV technology.
At least one U.S.-based bank so far has moved to accommodate U.S.-based international travelers with an EMV card. United Nations Federal Credit Union in May announced what is believed to be the first U.S.-issued EMV-compliant card for its members who travel abroad frequently. Like other EMV cards, the card’s mag-stripe enables transactions that take place in the U.S. to be processed like other mag-stripe cards, with no PIN required.
“We see it as a question of if, not when, the U.S. will migrate to EMV because history shows that fraud is going to find its way to the area of least resistance, and that is clearly is the U.S.,” Kerr says, adding “other U.S. banks no doubt will eventually want to satisfy customer demand” by providing overseas-traveling customers with EMV-capable cards.
Switching to chip-and-PIN technology would not prevent fraud from data breaches, nor would it block card-not-present fraud in e-commerce, which is on the rise around the world. But EMV technology blocks most fraud at the point of sale, according to the Princeton Junction, N.J.-based nonprofit Smart Card Alliance.
The most common type of fraud EMV prevents is the skimming of cardholder data from magnetic stripes, which thieves can replicate to conduct fraudulent signature-based credit and debit transactions and to create counterfeit cards, the alliance says.
In the United Kingdom, fraud losses from point-of-sale transactions declined 67% between 2004 and 2007 when chip-and-PIN technology was phased in, according to payments industry trade group Financial Fraud Action UK, formerly APACS.
Although Canada’s conversion to EMV is not yet complete, the Canadian Bankers Association says overall credit card fraud declined 20.4% last year, to C$358.4 million (US$340 million) from C$450.3 million in 2008. Interac, Canada’s debit network, says debit card fraud increased in 2009, to C$142.3 million from C$104.5 million in 2008.
Estimates of U.S. payment-fraud levels vary widely. The Smart Card Alliance in 2007 estimated total U.S. card fraud reached about $1.7 billion, while Maynard, Mass.-based Mercator Advisory Group last year pegged it at about $16 billion, including the broad costs to all parties from losses, including data breaches.
Specific figures for POS fraud in the U.S. are difficult to pinpoint, but recent reports suggest it is on the rise.
Arizona government officials in July warned the state’s petroleum-station operators and consumers of an increase in reports of card-skimming crimes at payment terminals of unattended fuel pumps. Reports centered on a rash of card-skimming devices that were found planted within payment terminals.
The state directed its Department of Weights and Measures to increase gas-pump payment-terminal inspections and stepped up training of its personnel to spot suspicious devices.
Colorado law-enforcement agencies also reported a rise in card-skimming incidents at gas stations around the state beginning last June, according to a spokesperson for the Colorado Springs Police Department. And police in Gainesville, Fla., in July and August reported dozens of card-skimming schemes at local gas stations.
Despite these examples, point-of-sale card fraud has not reached the point yet where the entire industry agrees it is worth the massive expense and hassle of a national shift to EMV, says FICO’s Urban.
“The U.S. is a bigger, more fragmented market than most (countries), and it will take a lot of money and momentum to move to EMV,” Urban says. “Unfortunately, coming out of a recession, many players are not in the mood to make major investments, so we will have to wait for something to come along that will force action.”
A report earlier this year in CIO magazine pegged the cost of U.S. conversion to EMV at $14 billion, but some observers say those costs are overblown.
“Most major U.S. merchants are already equipped with payment terminals that are built to handle EMV; the only thing they lack is the software and back-office connections,” says Christopher Justice, president of North America operations at payment-terminal maker Ingenico S.A. “The entire world is going to EMV. So for an international payment-terminal manufacturer like us, chip-and-PIN equipment is standard; the hardware is ready for the U.S.”
Wal-Mart five years began ago to install EMV-compliant payment-terminal hardware in all of its U.S. stores, Henry says. Although the company would need to invest in additional software and information-technology changes to accept EMV cards throughout its stores, “it would not be an insurmountable cost; … we’ve done it already in Mexico, Canada and the UK,” Henry says.
Other benefits for the U.S. switching to EMV exist, including chip cards’ greater data-storage capabilities and the ability for U.S. travelers to use their cards abroad, Justice notes. Given the world’s steady migration to EMV, every year it becomes more difficult for holders of mag-stripe cards to attain card acceptance in foreign countries, especially at self-service payment terminals.
U.S. banks so far have resisted moving to EMV because of the cost, but competitive pressure may force them to change their minds, some analysts suggest.
“U.S. cardholders who travel abroad eventually are going to insist on cards they can use everywhere overseas, and certain issuers may realize they will lose a lot of profitable customers by continuing to resist EMV,” says Jose Diaz, director of technical and strategic business development for data-security firm Thales e-Security Inc.
Recent government intervention into U.S. interchange rates may give banks a new rationale for switching to EMV, as regulators put more downward pressure on interchange, some merchants believe.
The Dodd-Frank Wall Street Reform and Consumer Protection Act President Obama signed into law July 21 requires the Federal Reserve Board to determine new “reasonable and proportional” debit-interchange rates that will go into effect next year, while merchants vow to continue to push for credit card interchange reform.
“Right now banks are passing the cost of card fraud EMV could prevent on to merchants by charging us higher signature-debit interchange rates,” contends Wal-Mart’s Henry. “If signature-debit interchange rates are cut due to recent legislation and all transactions become PIN-based, we may see more reason for banks to eventually get on board with EMV.”
The cost to U.S. merchants of switching to EMV may not be prohibitive, while the cost to banks remains less clear, Diaz says. “U.S. banks still need a business case for adopting EMV, and they will probably end up swallowing some costs,” he says.
The most-compelling business case would be new card-network requirements forcing merchants and banks to adopt EMV or risk fees and the direct cost of fraud. Visa Inc.’s mandates in most other countries over the past decade compelled payments-industry players to switch to EMV, but so far neither Visa nor MasterCard Worldwide has moved to adopt such mandates in the U.S.
Some observers suggest that if U.S. card fraud spiked dramatically, the U.S. government might get involved in the question of whether the nation should adopt higher-security credit card technology.
“A big spike in offshore-fraud losses or evidence of international money-laundering related to the U.S. dependence on magnetic-stripe card technology could possibly provoke the government to take action,” Justice suggests, noting so far no evidence suggests fraud could spike that high. “Fraud in the U.S. is relatively low, given its size. But as the number of countries that are non-EMV-compliant begins to decline, there is a very strong chance we will see sharp increases in international card fraud here.”
Even if U.S. payments-industry players were motivated to adopt EMV technology immediately, Canada’s experience suggests conversion in the U.S., a much larger market, could be a somewhat long and arduous process.
Canada’s conversion began in late 2004, when Visa announced their intention to migrate Canadians’ credit cards to EMV.
Interac in 2005 announced its commitment to adopt EMV, with the long-term goal of phasing out point-of-sale acceptance of domestic-issued mag-stripe debit cards by 2015.
Since then, payments-industry players have been working steadily to migrate to EMV cards, with the pace picking up considerably in recent months, based on card-network rules that will shift liability to the party that has not upgraded to chip-and-PIN technology, says Catherine Johnston, president and CEO of ACT Canada, a payments-industry association based in Ontario.
Beginning in Oct. 1, Canada’s Visa merchants, acquirers and issuers that have not converted to chip-and-PIN technology may become liable for fraudulent transactions that EMV could have prevented; MasterCard’s deadline is Oct. 15 and American Express Co. recently announced a date of Oct. 31, 2012 for its liability shift.
By the end of this year, more than half of Canada’s 800,000 merchant-acceptance points will be EMV-compliant, and approximately 70% of the country’s estimated 105 million credit and debit cards will be equipped with chips, according to ACT. The shift in Canada has been easiest for smaller merchants, while conversion has been a time-consuming and costlier task for the largest retailers, Johnston says.
“For smaller merchants, the shift to EMV is primarily a matter of swapping out one terminal for another. But for large merchants with national operations, it has called for a lot of software changes, testing and certification,” she says.
The largest Canadian banks began planning for the shift several years ago, and most gradually reissued cards equipped with chips in time for the conversion, Johnston says. “Credit unions and regional banks are still working at getting chip-equipped cards out, but we expect all of them will meet the deadline,” Johnston says.
The U.S. rapidly is becoming the only major country where criminals specializing in point-of-sale card fraud based on replicating data from magnetic stripes can operate. Many observers believe U.S. card fraud may spike, but a variety of other forces, including competitive pressure or government intervention, may be needed before merchants and banks finally commit to a national shift to EMV.
