With the recent increased focus on credit and debit card data security, U.S. retailers are looking more closely at protective measures, including new cards that would replace the current magnetic stripe with an embedded microchip. Deadlines imposed by the card industry are looming despite a debate over whether the cards should also replace easy-to-forge signatures with more-secure Personal Identification Numbers. But as that debate continues, one thing is becoming clear — many U.S. retailers don’t have a plan in place for migrating to “smart cards.”
One place to look for guidance might be Canada, where cards that both use a chip and require consumers to enter a PIN rather than a signature were rolled out in 2008. Many retailers operate in both countries, and there are more similarities between payment systems in the United States and Canada than European or Asian countries that have moved to chip-and-PIN.
There are several lessons U.S. retailers can learn from the Canadian experience. For one, Canadian retailers have seen a 30 percent drop in fraud involving counterfeit or stolen cards, according to a report prepared for the U.S. Federal Reserve.
The new Canadian chip-and-PIN cards operate under the Europay MasterCard Visa system. As in Canada, EMV is configured to require a PIN in most countries where it is used. But with the EMV cards planned for the United States, it would be up to each card-issuing bank to decide whether to require a PIN or still allow signatures.
That has U.S. retailers concerned because they’re being asked to spend $30 billion to replace current equipment and want both chip and PIN to be sure they are offering customers maximum protection before investing that much.
“Signatures are a virtually worthless form of authentication,” says National Retail Federation senior vice president and general counsel Mallory Duncan. “Insisting on chip-and-signature cards is like installing an alarm on the front door of a home while leaving the back door wide open.”
Regardless of whether U.S. banks go with chip-and-PIN or chip-and-signature, much remains to be done. Some U.S. retailers have already installed card readers that will work with either type of card, but many others have yet to do so.
Implementation requires more than just switching out payment terminals. Retailers need to look at every step of their payment process and determine what changes are required. This is also a good time to look at other changes they may want to make in areas like mobile payments, loyalty programs and proprietary gift cards.
“EMV provides an opportunity for retailers to modernize the process of payments,” says Randy Vanderhoof, executive director of the Smart Card Alliance, where card industry companies dominate the membership, and director of its EMV Migration Forum, which includes both financial companies and retailers. “They can look at other changes that bring additional efficiencies and reduce costs.”
Still, “As the U.S. moves forward, let’s not be focused just on EMV,” cautions Bohdan Myroniw, director of business development for AJB Software Design, a company that has worked with a number of U.S.-based retail chains on chip-and-PIN conversion for their Canadian stores. “Let’s take our compliance glasses off and look at what else we can do to improve the customer experience at the same time.”
Canadian retailers “have seen the benefit of fraud reduction and they are taking advantage of the opportunity to improve their operations,” Myroniw says. Among the features retailers in Canada have coordinated with their conversions are implementation of radio frequency identification, displaying special offers on PIN pads, adding video and audio promotions through point of sale systems and accommodating mobile payments.
But retailers have also learned that converting can be more complex than imagined and take longer to implement, Myroniw says.
“In some cases, it is taking three to four times as long to make the conversion,” he says. “Many of the North American top-tier chains have told us that they wished they had started earlier with their Canadian stores, and that the learning curve is longer than expected.”
‘Make things right’
The big incentive for retailers to make the switch is an October 2015 deadline set by Visa and MasterCard. Beginning then, Visa and MasterCard will require retailers to assume the cost of fraud made on EMV-enabled cards if they do not have the equipment to read the cards, regardless of whether they are PIN cards or signature cards.
That deadline, coupled with attention focused on card security following recent criminal thefts of card data, is forcing both retailers and banks to look more closely at chip-and-PIN and other fraud prevention.
Last year’s card data breaches “have created a major wakeup call for the industry,” Vanderhoof says. “Existing security measures are not effective. And the problem is beyond the cost of cleaning up the fraud. This type of fraud could affect customer relations for years to come. Both banks and retailers need to move as quickly as possible to improve security measures.”
Myroniw agrees. “The challenge for retailers is that as consumers become aware of the situation and read or hear about it in the news, they are going to be concerned and they will pressure retailers to make things right.”
Although chip-and-PIN does not prevent criminals from hacking into databases, it does limit what they can do with the data. Currently, mag-stripe cards can be duplicated using data from breaches and then used to make purchases or obtain funds. It is much harder to duplicate chip cards, and a PIN makes them useless in situations where thieves can get past the chip. NRF says keeping criminals from making money off stolen data will remove the incentive to steal it.
Consumer pressure could also force card issuers to speed up their plans. Vanderhoof says 15 million chip cards were issued in the United States last year, and he expects a much bigger increase this year and next.
“Issuers can respond much quicker to EMV than retailers,” he says. “It is safe to say the conversion is much more complex for merchants than card issuers, so retailers need to develop a plan now.”