Card manufacturer Oberthur Technologies is offering issuers facing a shortage of EMV chip cards an option to receive as many as 25,000 in five days, rather than waiting the standard three to four weeks.
Of greater long-term concern might be the security issue raised last week when
For now and into the foreseeable future, EMV cards will continue to also have an accompanying magnetic stripe as a backup technology and also for consumers to use for swipe payments at merchant locations not yet accepting chip cards that are inserted into readers. EMV, a global standard, secures card-present transactions through unique cryptograms that deter counterfeiting.
Typically, attacks such as the one demonstrated by NCR take place in a lab setting, but are not easily launched in scale throughout the industry, said Julie Conroy, research director and fraud expert with Boston-based Aite Group.
"But criminals had very little incentive to try to compromise EMV because the U.S. was such easy pickings until it went to EMV," Conroy said. "As we get further along in our migration, we will see more concerted attacks in the wild and attempts to break EMV."
While it is true that the magstripe on an EMV card presents some vulnerabilities, the NCR finding in particular should be easy for an issuer to fix, said Martin Ferenczi, president of North America region for Oberthur Technologies.
"Issuers going through the authorization process should be able to detect something like this," Ferenczi said. "We don't see any backlash coming from this, and we know people are trying to be smarter than the system and create [bad] situations."
Overall, issuers have been "extremely satisfied" with the progress of the EMV migration in the U.S., Ferenczi said. "We have to tighten the security at the merchant level, and it is a lot of work for merchants, but when we speak to issuers or read network reports, the merchant adoption continues to grow."
Still, the lingering effects of past data breaches create a need for banks to quickly re-issue cards, and Oberthur's new X-Press service is designed to address those needs. It provides full product support for Visa, Mastercard, American Express and Discover chip cards.
Ferenczi can't forecast when those Oberthur cards might be coming without a magstripe, mainly because most issuers don't want to drop it from the EMV scheme.
"Very few institutions are willing to eliminate the magstripe," Ferenczi added. "That is sad, in my opinion, but it is fully understandable because their first purpose is to provide consumer choice in whatever environment in which they are making a payment."
But when Ferenczi suggests to issuers they consider allowing the consumer to choose whether they want a card without a magstripe, "they are not very interested," he said.
"It would be a possibility for a security-conscious consumer to get a card without a magstripe, but that consumer might be upset when going into a store that doesn't take chip transactions," Ferenczi added.
Globally, Oberthur says it has shipped more than 2 billion EMV credit and debit cards from its network of four regional secure manufacturing hubs and 39 card personalization centers.
