Visa Inc.’s announcement that old, static PINs will be “eliminated entirely” in favor of dynamic authentication is facing resistance because many are not convinced that the PIN is past its prime.
In general, Visa has broad industry support for promoting mobile payments with its U.S. EMV chip card push, including many in the acquiring industry who consider the initiative an opportunity to supply merchants with new terminals. ISOs and agents who become familiar with the details of the transition may also use that knowledge to cement relationships with merchants looking for advice.
But it may be difficult to get card issuers and merchants to go along with Visa’s goal of ceasing to rely on signatures and PINs as primary methods of authenticating most point-of-sale card transactions, observers say.
With its series of incentives urging merchants to adopt EMV technology to accept contact and contactless chip cards, Visa is aiming to lay the groundwork for Near Field Communication-based mobile payment. But in a departure from every other global market that has switched to so-called chip-and-PIN cards, the plan does not call for tying those chip transactions to PINs.
Visa has set Oct. 1, 2015, as the date when liability will shift from issuers to merchant acquirers if fraud occurs in a transaction when the crime could have been prevented with a chip-enabled payment terminal.
No other card networks have yet signaled plans to follow Visa’s lead in setting a liability-shift deadline for conversion to chip-based payments, although they eventually did so when Visa set similar deadlines in most other markets around the world.
Visa is betting that with its dominant card market share, the other networks will fall in line with similar policies, but it is uncertain that they will do so, analysts say.
And because Visa is de-emphasizing PINs in its push for dynamic authorization, it raises questions about how quickly other payment-industry players heavily invested in PIN-based technology may follow its lead.
“It will depend on whether Visa has the market power to effect this widespread market change to chip transactions in the U.S.,” Mike Kutsch, a manager with the Charlotte, N.C.-based consulting firm Carlisle & Gallagher, tells ISO&Agent Weekly.
Indeed, Visa may own one of the nation’s largest PIN-based point-of-sale networks in Interlink and ATM networks in Plus, but it has done relatively little to promote them, preferring instead to tout its branded signature-based Visa check card, which earns issuers more interchange revenue. That price differential ends Oct. 1, when new Federal Reserve Board interchange rates take effect.
Discover Financial Services, which owns the Pulse PIN-debit network, is one major credit card network that may not be eager to see PINs disappear. It also may not be eager to follow Visa’s lead in supporting a liability shift on chip cards, analysts suggest. Riverwoods, Ill.-based Discover declined to comment on Visa’s initiatives.
Increasingly, signatures and “static” PINs, previously viewed as an additional layer of security, pose a security threat when they fall into criminals’ hands, enabling widespread card fraud, observers say.
One such example is Michaels Stores Inc., which in May announced the discovery of a major debit PIN-pad breach that affected 90 payment terminals across 20 states where criminals stole debit card numbers plus PINs and extracted cash through ATMs from at least 100 customers’ bank accounts.
Dynamic authentication provides more security for card transactions because, unlike magnetic stripe cards, each chip card transaction contains a unique or dynamic identifier that would block the biggest portion of point-of-sale card fraud, analysts agree.
Visa plans to continue to support PINs and will “be flexible” in supporting transaction verification through a variety of methods. But Eduardo Perez, head of Visa’s global payments risk group, tells ISO&Agent Weekly that “the real focus of our (chip initiative) is to move toward dynamic authentication.”
Certain industry observers believe Visa is moving too quickly in trying to drive chip card acceptance while encouraging a phase-out of authentications made with signatures and PINs.
“I think merchants are going to resist moving away from PIN transactions for a variety of reasons,” Dave Lott, senior vice president with Atlanta-based Speer & Associates Inc., tells ISO&Agent Weekly. “PINs are widely viewed by merchants, issuers and consumers as important security factors, and clearly PINs are still essential to card security everywhere else, including in Mexico and Canada, which quite recently adopted chip-and-PIN cards.”
