IMGCAP(1)]
This story appears in the November 2009 issue of Cards&Payments.
A few years ago, asking whether the United States ever would move to the EMV antifraud standard for chip cards was all but certain to bring a roll of the eyes, a smirk or even a sigh from bankers, card-network executives, terminal vendors and others involved in the U.S. payments market.
EMV-enabled cards, though, have landed in wallets and purses around the world, including in neighboring Mexico and Canada, both of which are mounting efforts to replace magnetic stripe cards with chip cards. With fraud typically traveling the path of least resistance, which usually is toward countries that support mag-stripe cards, the U.S. would seem vulnerable, producing slivers of optimism that the standard will make its way to the country.
"Three years ago, if I was saying there was going to be a million EMV cards issued to U.S. cardholders, everyone would have laughed at me," says Jack Jania, vice president and general manager, secure transactions for the North American arm of France-based Gemalto, one of the world's largest smart card vendors.
This increasingly serious discussion of EMV in the U.S. represents one of the recent developments for the standard, which was introduced in the mid-1990s and resides on more than 730 million cards used for retail purchases and transit fares around the world, according to various estimates.
Driven largely by government and card-network pressure, the standard now is spreading to such places as Central and Eastern Europe, Russia, Australia, Vietnam, Indonesia, Thailand, the Middle East and Latin America. Moreover, the standard, or a domestic standard that replicates EMV, could start reaching deeper into China, especially as the 2010 World Expo in Shanghai promises to attract foreign visitors just as the 2008 Summer Olympics did.
"In China, all terminals shipments in the last couple of years were EMV," with the high growth of card payments in the country expected to keep that trend alive, says Pete Bartolik, a spokesperson for U.S.-based terminal vendor VeriFone Holdings Inc.
In fact, Argentina, Iran and Burma, along with many African countries, are among the only nations besides the U.S. that have yet to see commercial EMV rollouts, according to an April report from U.S.-based Mercator Advisory Group.
According to Jania and others, the U.S. soon could drop off that list. "Several U.S. issuers" are looking "very closely" at issuing EMV cards, he says. Though Jania would not identify the issuers, he says 2010 could bring the first of some 1 million to 5 million EMV chip cards issued to U.S. consumers, especially to those who often travel to Europe or other EMV regions. Already, U.S. travelers are finding it difficult if not impossible to use their mag-stripe cards at self-service ticket kiosks, ATMs and smaller merchants in Europe, especially in the UK and France. Demand from those consumers appears likely to drive any U.S. EMV push.
"I do think [EMV in the U.S.] will happen," says Nick Holland, senior analyst at Aite Group, a Boston-based research firm. EMV cards will come in a trickle, not a flow, he says, citing the expense for terminals and for the cards themselves, each of which can cost $1 or so more than a mag-stripe card. "Once Canada goes to EMV, that's going to be very game-changing for the U.S." because of the risk of fraud moving south across the border.
By 2012, all of Canada's approximately 58,000 ATMs must be able to accept chip cards, part of one of the largest ongoing EMV migration efforts, which observers around the world are watching closely because the country represents one of the biggest markets to move toward the standard since the first wave in Western Europe and Malaysia. Though the migration will continue through 2015, most Canadian debit cards will be EMV-compliant within the next year, Mercator analyst Terry Xie writes in the April report.
Meanwhile, issuers in Mexico continue to distribute EMV cards as merchant acquirers work toward the deployment of at least 500,000 EMV-enabled point-of-sale terminals, Xie writes.
Pressure Mounts
For those optimistic about EMV coming to the U.S., the efforts in Mexico and Canada promise to send more fraud from those countries to the U.S. as criminals exploit the weaknesses of the country's mag-stripe payment infrastructure. And that could lead to U.S. financial institutions to feel more pressure to issue EMV cards.
The theory is supported by data from the UK, where most of the more than 168 million payment cards circulating comply with EMV. The UK Cards Association, an issuer trade group, says fraud committed outside the UK with UK-issued cards increased to 230.1 million pounds (US$368.3 million or 252.8 million euros) last year, up 10.8% from 207.6 million pounds in 2007. Criminals can copy the mag-stripe data still on chip cards to produce cloned cards, which they then use in countries with weaker or nonexistent EMV protections.
"What I sense has changed in the last year has been this greater [awareness] of the prospects of fraud migrating to the U.S.," says Randy Vanderhoof, executive director of the U.S.-based Smart Card Alliance, an advocacy group. The worries about fraud involve not so much criminals from abroad setting up shop in the U.S. "but a sophisticated type of network-based technology that can be launched from basically everywhere," he says.
Two factors could help bring EMV to the U.S., Vanderhoof says. For one, the same general forces that pushed the passage earlier this year of credit card reforms under the Credit Card Accountability, Responsibility and Disclosure Act could propel a legislative mandate. Moreover, the natural replacement cycle for payment terminals could make it simpler to bring EMV-compliant devices to the U.S. market, he says.
U.S. merchant demand for such terminals, however, barely exists, says Bartolik, of VeriFone, which over the past 18 to 24 months has seen significant growth in Canadian demand for EMV-capable terminals. In the U.S., though, where the market is more "complex," technology such as "end-to-end encryption has a better chance of full market adoption," he says. Unlike other parts of the world, the U.S. focuses on back-end fraud protection instead of front-end protections found on cards. And despite U.S. bank card fraud increasing to $1.05 billion in 2007 from $717.5 million in 1996, according to estimates based on data from Visa Inc. and MasterCard Worldwide, the U.S. payments industry has shown little public interest toward adopting the EMV standard.
Hypercom Corp., another U.S.-based terminal vendor, also reports scant demand in the U.S. for EMV terminals. "It's going to be a huge undertaking" not only to produce and issue cards, but to deploy terminal hardware and establish back-office technology, says TK Cheung, the vendor's vice president of global quality and security. A study from U.S.-based Javelin Strategy and Research puts the cost of the U.S. converting to EMV at $5.5 billion, with much of the expense going toward
payment terminals.
American Express Co., which issues EMV cards in some 40 markets, has the back-office technology in place to support an EMV card launch in the United States, says Pati Partelow, the card brand's vice president in charge of EMV. Bank and merchant interest, though, remains unclear. "I'm not sure fraud issues have been high enough for them," Partelow says. "I just don't think the U.S. has felt that tipping point."
Wait For Mobile?
Instead, Partelow would prefer the U.S. "hold off" on EMV until mobile payments take a firmer hold. "It would be much simpler to do it in a mobile environment" because that would spare financial institutions the hassle and cost of reissuing cards to consumers, she says. Consumers also could load new payment applications to their phones over the air, which would be more efficient for conversion to EMV than would mailing cards or visiting bank branches.
Partelow acknowledges this tactic carries its own difficulties, mainly the larger number of organizations, such as banks, mobile operators and merchants, involved in nearly every mobile-payment scheme. However, "mobile [payments] will inherently have to be very secure, … and mobile would give you more flexibility" than cards, she adds.
Another possible path for EMV in the U.S. is through dual-interface cards, which combine contactless and contact chips, observers say. But that path also would require new terminals.
Even if EMV comes to the U.S., fraudsters likely would find a way around it, exploiting trends card-security officials might fail to anticipate.
In the UK, for example, losses from card-not-present fraud increased 243% between 2001 and 2008, including a 13% increase in 2008, to 328.4 million UK pounds from 290.5 million pounds in 2007, according to the UK Cards Association. Between 2001 and 2008, the value of online shopping in the UK increased 524%, to 41.2 billion pounds from 6.6 billion pounds.
"We knew fraudsters would not give up and that there would be a migration to other types of card fraud where we don't use chip-and-PIN security," says Mark Bowerman, a spokesperson for the group. "What I don't think anyone predicted is the massive take-up by consumers of online shopping, plus the huge increase in the numbers of online shops."
Meanwhile, some banks in advanced EMV countries such as the UK are boosting the protections offered by the standard. They are embracing a technology called dynamic data authentication, which involves an encryption key stored on the card that provides a unique digital signature for each transaction. The cards are more secure, and more expensive, than static data authentication. Gemalto has supplied such cards to Poland-based ING Bank Slaski SA, an arm of Netherlands-based ING Group. According to Bowerman, some UK financial institutions have begun to issue the cards, though no British issuer contacted by Cards&Payments would confirm this.
With Canada and Mexico embracing EMV, and nearly every other major country adopting the standard, pressure to follow suit will build even if the expectations continue to outpace the reality. CP
