The card networks recently admitted what consumers have long suspected—card signatures have become worthless for authentication at the point of sale. But that's not the end of this story.
Even though the card networks will stop requiring signatures on purchases this month, merchants are unlikely to make immediate changes in their routines.
For some, no change will be necessary — the majority of lower-value store transactions already get automatic card network authorization without a signature, as the networks had gradually relaxed the signature requirement over the years. For others, it's easier to keep collecting signatures than to overhaul the technology that prompts for them.
Why merchants drag their heels
Merchants can't simply instruct cashiers to stop asking for signatures. They must also reconfigure the software and card-prompting commands for payment terminals, a process that takes time and money — two things many merchants lack, particularly when it comes to card acceptance.
“It may be several months or quarters before we see any tangible changes at the point of sale from the elimination of merchants’ requirement to collect a signature at the checkout,” said Jason Bohrer, senior vice president and general manager of secure card solutions at CPI Card Group.
Bohrer points to the fact that 30% to 40% of U.S. merchant payment terminals are still using the older, less secure magnetic stripe technology to process cards at the point of sale, despite an October 2015 liability shift putting the burden of counterfeit card fraud on the party that hasn't upgraded to EMV-chip card technology.
“You can expect to see a similar pace of change with the no-signature shift,” Bohrer said.
But other merchants are still exhausted by the last few years of upgrade investments, alongside the shocks of a steady stream of card data breaches. By comparison, they have little interest in the elimination of signature for a dwindling number of their sales.
“The no-signature rule for smaller transactions has been in place for a long time, but plenty of merchants still ask for a signature for a $5 purchase, which shows you how unlikely merchants are to react just because the rules are changing April 15, and consumers aren't likely to care either way," said Rodman Reef, an analyst with Reef Karson Consulting.
Of course, larger merchants have the resources to implement the change — even if they don't have an immediate timeline.
Walmart said a majority of its sales already flow through the checkout with no signature required, but higher-value transactions still require a signature. The retailer plans to reconfigure its systems to bypass signatures altogether but no date has been set yet, said spokesman Randy Hargrove.
Shoppers never know what to expect at the checkout, anyway. "Consumers don't understand why one merchant requires a signature for a $10 purchase while another does not, and I predict this change will be viewed as more of the same," said Shirley Inscoe, an analyst at Aite Group.
Didn't merchants want this?
The irony is that merchants for years have been asking the card networks to clarify their stance on signatures and the role they played in assigning liability in case of lost or stolen cards.
“Merchants have been pressing the brands to remove signature capture from rules or else provide more transparency about how issuers were using signature as a fraud tool,” said Randy Vanderhoof, executive director of the Secure Technology Allliance, a cross-industry organization.
Not only do signatures take up time and resources at the POS and give issuers another reason to shift fraud to merchants, but they also give consumers a false sense of security, said Mark Horwedel, CEO of the Merchant Advisory Group.
Horwedel's group unsuccessfully advocated for the U.S. to adopt the more-secure chip-and-PIN approach used in most major markets outside the U.S. when EMV was introduced.
But the networks decided not to mandate chip-and-PIN, claiming modern online authorization methods made PINs superfluous for blocking counterfeit card fraud—the biggest category—even in Europe.
Meanwhile, PIN use has dramatically declined worldwide in recent years as contactless and mobile payments took hold. In the U.K. and Australia, the majority of transactions under $100 are contactless—requiring no PIN—and card security experts agree PINs aren’t necessary except for larger transactions.
“Chip and signature is effectively as good as chip alone,” said Al Pascual, senior vice president of research and head of fraud and security at Javelin Strategy & Research, noting that EMV chip technology makes counterfeiting nearly impossible.
The Merchant Advisory Group and individual U.S. merchants continue to insist on the value of PINs for in-store transactions—a method that effectively blocks losses from stolen or counterfeit cards—but support for PINs is collapsing globally, according to Pascual.
“We’re unlikely to see a proliferation of chip-and-PIN here and in fact we’re likely to see a loosening of the limits for PIN transactions as has occurred in other markets like Australia,” Pascual said.
What's replacing PINs is a combination of mobile location methods, plus biometrics and real-time behavioral analysis from the card networks and banks, according to Pascual.
Are contactless cards inbound?
While eliminating the signature requirement carries little risk for the card networks or banks, there’s a significant upside in further streamlining the checkout process, card industry experts say.
“Getting rid of the signature requirement takes card payments a step closer to the contactless experience, which U.S. issuers are very interested in,” CPI Card Group’s Bohrer said, noting that the rapid growth of contactless card volume in the U.K. and Australia makes a compelling case for banks evaluating whether to stick with contact-only or add contactless cards to the mix.
Though only about a third of U.S. merchants’ payment terminals are NFC-enabled, several midsize U.S. card issuers have asked CPI Card Group about the cost of shifting all or part of their portfolios to contactless cards within the next couple of years, Bohrer said.
“We’re getting lots of questions and we expect to see more active pilots for contactless cards taking place starting next year,” he said.
And when contactless cards make an impact, certain merchants will quickly update their terminals.
“[Some] merchants who are EMV-compliant will fairly quickly change their routines and skip prompting consumers for a signature,” said Sarah Grotta, director of debit and alternative products at Mercator Advisory Group, adding that the change won’t affect merchants’ risk liability and it could speed up checkout times, which is always a plus.
