BankThink

Chip-and-PIN Is Not the Next Step to Secure Credit Cards

The October 2015 “liability shift” date has come and gone. For years leading up to it finance and payments pundits (and eventually the general population) discussed the impact of this date to force merchants to migrate to EMV-enabled credit cards, from the decades old magnetic stripe standard.

Looking at the situation a month in, we have a decidedly mixed atmosphere. While credit card issuers have been shipping millions EMV-capable chip cards for months many consumers have at least one card in their wallet without a chip. Some issuers haven’t started shipments at all. Beyond credit cards, many consumers have a debit card with no chip (and no hope of one) as federal legislation around debit card networks caused a complex technical solution to be required (which is still in its early stages).

From the merchant standpoint, many more retailers than ever have EMV-capable terminals. Some of them even have the software in them turned on and their staff trained to use them. This means, that for the first time, meaningful numbers of consumers are using EMV cards.

Amidst of this complexity and confusion about who has what cards and where they can use them is the reality of the EMV process. Using an EMV card is slow compared to swiping. Despite the need to sometimes swipe a card twice, etc., it’s pretty obvious how to do it and consumers are very well trained. EMV transactions are a completely different animal. Cards can be inserted four ways to a terminal (three of them wrong). The transaction takes up to 10 seconds that the card must be inserted. The card must be inserted when the amount is totaled at the end, which is a big change from the swipe-at-any-time procedures of many terminals.

This has retailers frustrated. Slow lines cost money. With just a few weeks before the busiest shopping time of the year retailers are anxious about the tradeoff from fraud limitation to lost profit from speed. With so few consumers ready to use EMV the problem is exacerbated.

While some retail leaders have publicly regretted the roll-out, many are pushing for an additional push for EMV beyond the current standard of chip-and-signature to chip-and-PIN. The argument goes that PIN requirements will increase security and certainly won’t further degrade the time experience. Just a few issuers have chip-and-PIN cards today, such as First Niagara and the United Nations Federal Credit Union. In addition, major retailers such as Walmart and Target are using chip-and-PIN for their store-branded cards.

Retailers have it wrong, though. PINs will not increase security for consumers and will add to delayed transaction times. While many point to the European experience, which is chip-and-PIN, we must remember that we quite simply are not Europe (or Canada or insert nation here). According to the Federal Reserve, the average American carries 3.7 credit cards, plus a debit card and one other payment card such as a private label store card.

With up to 6 cards for an average American that would either mean people have to remember six PINs, or, more likely, one.  PINs do little to enhance security because consumers select obvious PINs and use the same PINs across multiple services. This is really their only choice as remembering many PINs is hard. This is the same problem from which traditional passwords suffer.

If a user does use bank-provided random PINs they will end up standing in line trying multiple PINs and failing to get the right one. This will lead to an even more substantial delay than what is seen with signature cards.

In addition to all of this, major retailers such as Walmart and Target are pushing QR-code based payments via the CurrentC app (MCX) and now Chase Pay.  It’s far too much for consumers. In the long run smartphone-based payment delivered NFC will likely win (or perhaps QR), but regardless, asking consumers to do more is not the answer.

Matthew Goldman is CEO of Wallaby Financial. 

 

For reprint and licensing requests for this article, click here.
Retailers Analytics Data security
MORE FROM AMERICAN BANKER