A large number of card-fraud arrests in October — related to what some have called the biggest counterfeit credit card scheme in U.S. history — prompted some observers to predict that chip-card technology could soon put an end to such crimes.
Not so fast.
Even in the best-case scenario, it would be several years before EMV chip-and-PIN technology, which is designed to block most counterfeit card crime, could make a meaningful dent in skimming fraud in the U.S., card-security experts say.
The U.S. remains the only major market in the world that has not adopted EMV card technology, which requires a unique authorization factor for all transactions.
In part to deter counterfeit card crime, Visa Inc. in August announced a program to encourage U.S. merchants and issuers to adopt contact and contactless EMV technology through a set of incentives and deadlines for shifting liability for card fraud.
While observers generally have applauded Visa’s move, it likely will take from five to nine years before enough chip transactions are conducted to result in a measurable drop in counterfeit card crime, George Peabody, Mercator Advisory Group, says.
“We would need to see the percentage of chip-to-chip transactions rise to about 75% of all transactions in order to see a drop in counterfeit card crime,” Peabody says. And that level of change “is a massive undertaking that’s going to take some time.”
With its EMV initiative, Visa intends to shift U.S. liability to merchant acquirers from issuers for domestic and cross-border counterfeit card-present point-of-sale transactions if merchants do not have EMV-compliant terminals, effective Oct. 1, 2015.
Peabody calls that timeline “aggressive,” given the U.S. payment market’s scale.
In other markets that previously adopted chip card technology, including Canada, card networks were forced to extend deadlines for EMV compliance because of the complexity of changing point-of-sale and back-office systems to the new technology.
MasterCard Inc., American Express Co. and Discover Financial Services so far have remained mum about plans to follow Visa’s lead in setting deadlines for a liability shift, which has occurred in nearly every major market around the world.
Widespread use of EMV card technology certainly would have prevented the massive New York-based counterfeit card scheme, Peabody says.
Law-enforcement authorities in Queens, N.Y., in October arrested 111 individuals accused of using stolen credit card numbers from magnetic stripe cards to create counterfeit cards used to initiate some $13 million in fraudulent transactions. The defendants include bank employees and store and restaurant workers accused of “enterprise corruption” and burglary in the theft and mass-production of counterfeit credit cards.
Card-skimming crimes, including those where criminals use cameras to capture and link consumers’ PINs and debit cards to extract funds directly from bank accounts, are on the rise in other markets as criminals become more brazen about stealing card data at unattended payment terminals, such as gas station pumps and bank ATM lobbies.
EMV has proven to reduce counterfeit card fraud in most markets abroad, but mobile-payments technology may supplant the technology in the long run, one analyst says.
“Some argue that that card-based EMV may be skipped altogether as the industry moves directly to mobile and leverages the capabilities in smartphones, which clearly offer more horsepower than card-based chip platforms,” Mike Kutsch, a manager with the Charlotte, N.C., consulting firm of Carlisle & Gallagher, says.
PayPal Inc., a unit of eBay Inc., also may come up with its own secure mobile-payment offering that could catch on widely, he says.
However, the lack of broad availability of consumer phones using Near Field Communication technology, which most experts consider essential to conduct secure mobile payments, “increases the probability that EMV card technology may be a reasonable interim step,” Kutsch says.
But even as an interim step, EMV adoption will likely be slow.
“It will take at least a decade before we see widespread usage of EMV cards in the U.S.,” predicts Wasim Ahmad, vice president of data encryption at Voltage Security of Cupertino, Calif.
EMV technology probably will develop in tandem with mobile payments because merchants can relatively easily adapt most NFC payment-acceptance platforms for EMV card acceptance, Ahmad says.
Smaller merchants in the U.S. may be among the first to adopt NFC-based contactless payment, which could help spur penetration of payment terminals equipped to process both mobile and chip card-based transactions, he says.
Also, others might follow the example of large merchants such as Wal-Mart Stores Inc., which has publicly pushed for better point-of-sale card-technology standards, Ahmad says.
“Wal-Mart has said they are ready for EMV. If Wal-Mart were to announce a compelling sort of incentive of its own for consumers to use EMV cards, that might spark a reaction and get the marketplace moving to EMV faster,” he says.
Banks typically issue new payment cards about every three years, Mercator’s Peabody says. Within three to five years, most banks routinely will begin to issue chip-equipped cards to replace mag-stripe cards, he says.
Various U.S. financial institutions, including JPMorgan Chase & Co., Citigroup Inc., Wells Fargo & Co., U.S. Bancorp and the United Nations Federal Credit Union, have announced the availability of EMV credit cards for U.S. customers who travel abroad, where use of mag-stripe cards increasingly is becoming increasingly difficult.
Merchants in the U.S. often wait five to seven years to replace payment terminals, but most new hardware will be EMV-compliant. So most merchants gradually will phase it in, Peabody says.
“As more merchants call for contactless and EMV payment terminals over the next few years, the price of the EMV hardware will drop,” Peabody says. However, the industry shift to EMV technology “will not be cheap,” he says.
Meantime, the only bulwark against common counterfeit and card-skimming crimes will be merchant and issuer diligence, experts say.
“I have no doubt that network-based security and other systems will continue to do an increasingly good job at blocking much card fraud, … but as long as magnetic-stripe cards are the dominant platform, we will continue to see counterfeit card crime,” Peabody says.
American Banker: By Kate Fitzgerald
