In October, merchants took on additional liability on card transactions.
Previously, card issuers carried that liability alone. Now, in the event of a
fraudulent transaction, whichever party hasn't upgraded to EuroPay, MasterCard
and Visa chip technology, whether a merchant upgrading its credit card terminal
or a card issuer upgrading to chip cards, bears the cost. The change is the
first step in transitioning United States payment practices, which rely on
magnetic swipe cards, to the chip cards that predominate elsewhere.
In 2014, U.S. issuers accounted for $3.9 billion in
counterfeit fraud, representing 24 percent of global fraud losses, according to
a July Nilson Report. Counterfeit card fraud occurs when card details are
skimmed to make new cards for illegal sale and use.
Chip cards, regardless of whether they’re authorized with a
signature or a personal identification number, or PIN, are said to reduce such fraud.
“The chip creates a unique transaction code for every purchase that can’t be
replicated by counterfeit cards,” according to the PCI Security Standards
Council. If someone skims a card and tries to use the unique code a second
time, it’ll be flagged as a questionable purchase, explained a MasterCard
spokesperson.
Signature Vs. PIN
Debate
The American Consumer Institute Center for Citizen Research
has long protested chip-and-signature cards, contending that signature
authentication is not as safe as entering a PIN to authenticate a transaction.
In a statement released in October, president Steve Pociask cited U.S. retail
banks’ reliance on PINs to conduct transactions as an argument for avoiding
chip-and-signature cards. “If financial institutions believe PINs are secure
enough to protect American bank accounts, they should agree to couple them with
chip-equipped cards to ensure consumer credit transactions are more secure,” he
argued. “Credit card issuers, the big banks and the card processing networks …
essentially argue that we should ignore the documented benefits of chip-and-PIN
payment cards across the world and adopt a half measure here at home instead.”
Both a MasterCard spokesperson and U.S. Bank head of commercial
card product and marketing Mary Miklethun acknowledged that chip-and-PIN cards
protect lost and stolen cards, while signature cards do not. Both also noted,
however, that counterfeit fraud is a bigger problem than fraud on lost and
stolen cards. It accounts for 37 percent of all U.S. card fraud, compared with
14 percent for lost and stolen credit card fraud, according to a report for
which Aite Group interviewed executives from 18 of the top 40 U.S. card issuers
and payment networks in April and May 2014.
The MasterCard spokesperson added, “Right now, the biggest
problem in the U.S. is counterfeit fraud. [Lost and stolen card fraud] is a
concern—we don’t want any fraud in the system—but it’s not as big of a problem.
Getting the U.S. economy to chip was the first priority.” Miklethun added,
“Just implementing chip alone would solve [a large percent] of the problem.”
Still, as long as the industry is taking the trouble, why not
roll out PIN cards universally?
Deciding Factors
For starters, the networks have allowed card issuers to decide,
and those banks take into account the impact on their cardholders' experience
and convenience. “If [the bank’s] portfolio tends to be a lot of debit cards,
people are used to entering pins. If [the bank] has a lot of credit cards,
maybe people are more comfortable signing," the MasterCard spokesperson
said.
Payment industry players also were concerned users might
forget their PINs, especially while traveling, resulting in declined cards and
further inconvenience, Miklethun said. That's even more likely than in the
consumer sector, in which cardholders more typically choose their own PINs, she
noted.
"The recommendation from MasterCard, and all the card
networks, was to take a look at your business and your risk for fraud, think
about the experience you want the cardholders to have, then you decide,” the
spokesperson said. “It’s not up to us to mandate what’s the best thing for
cardholders, but it’s up to us to keep the U.S. ecosystem secure.”
Visa also had cautioned that U.S. credit card infrastructure
was not built for PINs, according to Miklethun. While Visa can carry and
process PIN transactions, “the nodes or connections in between the merchant,
the merchant’s processor and acquirer may not yet have the infrastructure in
place to carry PIN,” according to a Visa spokesperson.
“We didn’t want to take the risk that the credit card system
wasn’t ready for PINs and we would potentially impact our cardholders’ ability
to complete a transaction,” Miklethun said. “At the end of the day, that was
the most compelling argument for us.”
Still, she suspects the market will migrate entirely to PINs
eventually, and U.S. Bank cards offer both PIN and signature authentication
options. “A more accurate term for a chip-and-signature card is that it’s
signature preferring,” Mikelthun explained. “We do issue PINs, as well, because
we have PIN authentication in our list of verification methods. It’s just not
first on the list.” That means most U.S. merchants will ask U.S. Bank cardholders
to sign, but the PIN capability enables the cardholder to use payment terminals
that require a PIN.
Status Check
Even when chip cards and chip-enabled terminals are present,
some merchants have trouble processing the cards and then resort to swiping them
or entering numbers manually. Based on Visa’s experience during other
countries’ migrations to chip cards, it could be five years before 90 percent
of transactions are processed using a chip card and a chip terminal, according
to Visa’s website.
The Payments Security Task Force, a payments industry
coalition, estimated that all U.S. payment cards will have chip technology by
2017. Here's how the U.S. payment industry is faring now.
By Nov. 1, U.S. Bank had replaced all Travel
Cards with chip cards, a spokesperson told BTN
through email. It'll exchange other commercial cards, including Purchasing and
One cards, as they expire.
Bank of America Merrill Lynch automatically issues
chip-and-PIN cards to new clients and will issue them as cards are lost or stolen
or as they expire, a spokesperson told BTN
through email.
JPMorgan Chase has issued more than 66 million chip-and-signature
credit and commercial cards and chip-and-PIN debit cards and expects more than
70 percent of its cardholders to have chip cards by the end of 2015, a
spokesperson told BTN in an email.
And as of January 2015, more than 50 percent of U.S. BMO
cards and all U.S. ATMs were chip certified, BMO vice president of North
American corporate card products Steve Pedersen previously told BTN.
For American Express, all U.S. corporate, consumer and small
business card products are available with chip-and-signature security upon
request, a spokesperson told BTN in
an email. Otherwise, Amex will issue chip-and-signature cards upon renewal or replacement.
The card network expects the “great majority” of its cards to be
chip-and-signature by the end of 2015. It has offered chip-and-PIN cards for
more than 10 years in countries like Australia, Canada, France, Germany, New
Zealand, Spain and the United Kingdom.
As of Sept. 30, nearly 40 percent of U.S. MasterCard branded
consumer credit cards were chip enabled, and 32 percent of Visa's credits cards
in the United States were chip enabled.