Visa Inc.’s announcement that it expects old, static PINs to eventually be “eliminated entirely” in favor of dynamic authentication is facing resistance–in particular because many are not convinced that the PIN is past its prime.
Indeed, Visa has broad industry support for promoting mobile payments with its U.S. EMV chip card initiative, but it may be difficult to get card issuers and merchants to go along with its goal of ceasing to rely on signatures and PINs as primary methods of authenticating most point-of-sale card transactions, observers say.
With its series of incentives urging merchants to adopt EMV technology to accept contact and contactless chip cards, Visa is aiming to lay the groundwork for Near Field Communication-based mobile payment. But in a departure from every other global market that has switched to so-called chip-and-PIN cards, the plan does not call for implementing those chip transactions with PINs.
Visa has set Oct. 1, 2015, as the date when liability will shift from issuers to merchant acquirers if fraud occurs in a transaction that could have been prevented with a chip-enabled payment terminal (
No other card networks have yet signaled plans to follow Visa’s lead in setting a liability-shift deadline for conversion to chip-based payments, although they eventually did so when Visa set similar deadlines in most other markets around the world.
Visa is betting that with its dominant card market share, the other networks will fall in with similar policies, but it is not absolutely certain that they will do so, analysts say.
And because Visa is de-emphasizing PINs in its push for dynamic authorization, it raises questions about how quickly other payment-industry players heavily invested in PIN-based technology may follow its lead.
“It will depend on whether Visa has the market power to effect this widespread market change to chip transactions in the U.S.,” Mike Kutsch, a manager with the Charlotte, N.C.-based consulting firm Carlisle & Gallagher, tells PaymentsSource.
Indeed, Visa may own one of the nation’s largest PIN-based point-of-sale networks in Interlink and ATM networks in Plus, but it has done relatively little to promote them, preferring instead to tout its branded signature-based Visa check card, which earns issuers more interchange revenue.
That price differential ends Oct. 1, when new Federal Reserve Board interchange rates take effect (
Discover Financial Services, which owns the Pulse PIN-debit network, is one major credit card network that may not be eager to see PINs disappear. It also may not be eager to follow Visa’s lead in supporting a liability shift on chip cards, analysts suggest.
Riverwoods, Ill.-based Discover declined to comment on Visa’s initiatives.
Increasingly, “static” PINs and signatures, previously viewed as an additional layer of security, pose a security threat when they fall into criminals’ hands, enabling widespread card fraud, observers say.
One such example is Michaels Stores Inc., which in May announced the discovery of a major debit PIN-pad breach that affected 90 payment terminals across 20 states where criminals stole debit card numbers plus PINs and extracted cash through ATMs from at least 100 customers’ bank accounts (
Dynamic authentication provides more security for card transactions because, unlike magnetic stripe cards, each chip card transaction contains a unique or dynamic identifier that would block the biggest portion of point-of-sale card fraud, analysts agree.
Visa plans to continue to support PINs and will “be flexible” in supporting transaction verification through a variety of methods, but Eduardo Perez, head of Visa’s global payments risk group, tells PaymentsSource that “the real focus of our (chip initiative) is to move toward dynamic authentication.”
Certain industry observers believe Visa is moving too quickly in trying to drive chip card acceptance while encouraging a phase-out of authentications made with signatures and PINs.
“I think merchants are going to resist moving away from PIN transactions for a variety of reasons,” Dave Lott, senior vice president with Atlanta-based Speer & Associates, tells PaymentsSource. “PINs are widely viewed by merchants, issuers and consumers as important security factors, and clearly PINs are still essential to card security everywhere else, including in Mexico and Canada, which quite recently adopted chip-and-PIN cards.”
Another reason retailers may balk is because many U.S. merchants recently have added new, tamper-resistant PIN-pad payment terminals, and making that technology obsolete in less than five years may spark resistance, Lott suggests.
Hardware makers typically design payment terminals to last five to seven years, and a mass shift to chip-accepting terminals slightly more than four years from now will cause many merchants with newer hardware to incur unexpected expenses, he says.
On the authentication side, signatures do little to improve security, Lott concedes. But PINs serve a key role in helping to prevent first-party fraud, which occurs when a customer disputes a transaction, he says.
“Most merchants prefer PIN-based debit transactions over signatures because it is very effective in minimizing charge-backs at the point of sale, and even issuers are likely to want to stick with PINs as a way of preventing fraud on lost debit cards,” he says.
While the dynamic authentication factor prevents most counterfeit fraud, it does not block fraud on individual lost or stolen cards, confirms Julie Conroy McNelley, a senior risk and fraud analyst at Aite Group LLC.
“The challenge to eliminating PINs on chip cards, and why PINs are still useful, is the fact that if someone takes your wallet and gets your signature-only chip card, a criminal can use that card until the cardholder notices it’s gone and calls it in,” McNelley says.
Merchants are supportive of a movement away from reliance on mag-stripes and signature authentications, and “are hopeful that Visa’s progressive announcement will begin a concerted move in that direction for the United States,” Dodd Roberts, president of the Merchant Advisory Group, which counts the nation’s largest merchants among its members, tells PaymentsSource via an emailed statement. “However, we feel that the use of PIN, as in the rest of the world, completes the security of EMV chip technology,” he said.
PIN-debit networks generally also are not likely to be eager to eliminate PINs, analysts say.
“We think that securing cardholder information with a PIN, whether it’s on chip or magnetic stripe cards, is the most secure method of authenticating a transaction, period,” Dan Kramer, senior vice president of marketing and merchant services for Johnston, Iowa-based Shazam, an electronic funds transfer network, tells PaymentsSource.
But Visa executives say the signature- and PIN-based authentication methods largely have outlived their usefulness in point-of-sale payment security, underscored by the fact that for several years Visa has encouraged the proliferation of “no signature required” for debit and credit card transactions less than $25.
“Over time, we want to use our smart network to help facilitate authenticity at the point of sale or in e-commerce transactions, so we’re not creating any additional friction, burden or risk by providing an identifiable variable,” Perez says. “The online platform allows us to use our network, with strong alerts–in real time if customers request it–to monitor and prevent fraud.”
Chip-and-PIN systems evolved to authorize transactions more securely offline, but for years “virtually all” U.S. point-of-sale card-network transactions are authorized through online channels, he notes, referring to terminals that always are connected to the network through a robust communications infrastructure.
Around the world, “more (chip-and-PIN card) markets that were offline are moving online,” Perez says.
Moreover, transitioning away from PINs may not be dramatic because only 25% of U.S. merchant locations are equipped with PIN-debit terminals, undercutting the notion that PIN-based terminals are ubiquitous, Visa says.
Lott disagrees, putting the estimate of U.S. merchants with PIN-based terminals at “about 30%.” But even that figure “is a bit misleading” because by some measures 70% to 80% of all U.S. debit transactions flow through large merchants that tend to be equipped with PIN-debit transactions, he says.
Analysts say the Fed’s universal pricing mandate likely will equalize the cost of signature and PIN-debit transactions, thereby reducing the pricing benefits PIN-debit offered and demand for PIN-debit terminals.
But PINs are not going away anytime soon, warns Guy Berg, a consultant with Datacard Group, a division of global card manufacturer Datacard Corp., calling the PIN discussion “highly controversial at this time.”
Moreover, “there are networks that strongly advocate PIN verification at the terminal. As long as they continue to advocate PINs, ... [the authentication method] will be around for a long time,” Berg says.
Visa’s Perez does not dispute that PINs may continue to serve a limited role at the point of sale. For higher-balance and higher-risk transactions, “we may invoke the use of a one-time password sent via email or text or other methods,” he says.
But Visa “has a lot of work to do before it convinces the entire card industry to walk away from PINs, but it’s unlikely Visa will gain a direct advantage in the fallout from the routing rules by eliminating PINs,” Lott says.
Visa has taken the lead in encouraging U.S. merchants to abandon mag-stripe payment terminals and has set an ambitious goal to move the industry toward dynamic authentication for most card transactions. Whether it succeeds in persuading the payments industry as a whole to embrace its initiative, and get diverse players to abandon reliance on PIN-debit transactions, remains to be seen.
What do you think about this? Send us your feedback.
