America’s switch to chip-based credit and debit cards (called EMV cards) is moving forward, but at a slower pace than some had expected. Industry experts blame technical issues and resistance by some merchants to upgrade their checkout equipment.
Even so, with more than a half billion of these counterfeit-resistant chip cards now in use and millions of merchants able to accept them, EMV is working.
“We’ve already seen the positive impact that this chip technology has had on driving down counterfeit fraud at the merchant locations that have moved to it,” said Stephanie Ericksen, vice president of risk and authentication products at Visa. “At the same time, some of the non-chip merchants have started to experience a slight increase in counterfeit fraud.”
Visa reports that U.S. retailers who upgraded to EMV card terminals saw a 47 percent decline in counterfeit card fraud in May of 2016 compared to the same month a year earlier. Mastercard says merchants who completed or are close to adopting EMV technology saw counterfeit card fraud drop 54 percent in April 2016 compared to April 2015.
Related: More Stores Still Aren't Using Chip Cards
The nation’s banks have been busy cranking out new EMV cards and getting them into people’s wallets. American Express reports that 95 percent of its cards in the U.S. market are now EMV. For Mastercard it’s 88 percent, and 64 percent for Visa. Discover told NBC News it’s not releasing any figures on its chip cards.
While the credit card companies would like to see more stores install chip readers, they say they’re encouraged by the progress being made.
“We’re seeing more and more merchants line up for EMV and more and more transactions going to chip,” said Chiro Aikat, senior vice president for EMV at Mastercard. “Looking at how big, how complicated, and how fragmented the U.S. market is, I think the progress the industry is making is very promising. If you look at the 33 percent of merchants who accept chip cards today, that’s a 400 percent increase from October of last year.”
Not everybody thinks the change is coming fast enough. The U.S. Payments Forum, a trade group that represents banks, merchants and technology companies, had expected half the retailers — not one-third — to be chip enabled by now.
“The merchants are definitely behind where we projected they would be at this time, but we recognize that they’ve had some unexpected complexities due to the unique requirements in the U.S. that didn’t exist in other markets,” Randy Vanderhoof, director of the U.S. Payments Forum, told NBC News.
“We’ve also had such an enormous rush of merchants trying to get their hardware and software solutions through the testing and certification process that we’ve got quite a backlog that is making that conversion rate even slower than it would normally be,” he said.
Some merchants resist the changeover
Last October, in an effort to persuade reluctant retailers to install EMV card readers, the major credit card companies shifted the liability for point-of-sale counterfeit credit card fraud to the merchant. If someone is able to “swipe” a counterfeit card at checkout because the store doesn’t have a chip card reader, the merchant now eats the loss. Previously, the credit card issuer would always take the hit.
Because of that, many small merchants who haven’t upgraded to EMV terminals are seeing their fraud losses skyrocket — and they feel they’re being bullied by the big credit card companies. Earlier this year, four small stores in New York, California and Florida sued American Express, Discover, Mastercard, and Visa in federal court.
Their lawsuit claims the card companies violated fair trade practices by conspiring to force them to upgrade their checkout systems.
Last week, a federal judge allowed the case to move forward. The store owners, who want to be reimbursed for the cost of upgrading to the new equipment, hope to have their lawsuit granted class action status.
“In the end, our hope is to secure some relief for the millions of merchants — many of them small business — who have suffered and continue to suffer enormous losses from this conspiracy,” Patrick Coughlin, an attorney for the stores, said in a statement.
Visa, American Express and Discover told NBC News they had no comment on the lawsuit. Mastercard said it is “disappointed” by the court decision. In a statement, Mastercard said: “As we move into the next phase of the process, we believe we have a strong case that will allow us to put this matter behind us and focus on driving our business and relationships with our customers.”
Fraudsters know how to beat EMV
No one expected EMV to be a silver bullet that would eliminate all card fraud — professional criminals are very innovative. While crooks can’t use stolen credit and debit card account information to make counterfeit chip cards, they can still use those numbers to shop online. It’s called card-not-present (CNP) fraud and it’s becoming a bigger problem.
CNP fraud jumped by almost 50 percent in the last year, according to a study by Vesta Corporation, a company that authenticates and guarantees online shopping transactions.
“It’s basically a path of least resistance,” said Tom Byrnes, Vesta’s chief marketing officer. “It’s not the physical theft of cards that’s the real risk anymore. It’s the massive data breaches where they’re getting millions of card numbers and then all the crook has to do is go online and buy things; there’s no chip required.” The biggest spike in CNP fraud is for digital goods that are transmitted electronically, such as airline tickets, concert tickets and digital gift cards, Byrnes said.
“You buy a $250 concert ticket online with a fake credit card number, you only have to provide an email address, there’s nothing to verify,” he explained. “And the minute you press send, you’ve got that ticket. You print it out and you fence it.”
Fraud experts are not surprised by this. Other countries that made the switch to chip cards years ago saw a dramatic increase in online fraud.
The shift to EMV has also created a spike in new account fraud
“Criminals are having a harder time doing what they’ve always done, but they still need cards to commit fraud. So they’re going to take a stolen identity, go online and apply for a new card in that person’s name, get it and then go to town using it,” said Al Pascual, research director for Javelin Strategy & Research. “You can buy a stolen identity for five dollars, everything you need to open a new credit card account in someone else’s name.”
Randy Vanderhoof at the U.S. Payment Forum told NBC News both the financial and retail industries know fraudsters will change their tactics to adapt to EMV. And he said, as fraud migrates online, they’ll adjust, too.
“We can’t fight all of the battles equally at the same time,” Vanderhoof said. “Right now, we’re making progress by closing the biggest hole in the system: counterfeit cards being used in physical stores.”
Working to reduce customer frustration
Change is always difficult and using a chip card is different than what we’ve always done at the checkout counter. You don’t swipe it, you “dip” it — leave it in the terminal until the transaction is complete. Pull it out too early and the transaction won’t go through.
The lack of consistency has slowed the checkout process and created customer frustration. People want a consistent shopping experience. But during this transition phase, it’s hard to know whether to dip or swipe, so many of us wait for instructions from the cashier.
Even so, most people seem to be taking the shift to EMV in stride, according to a new survey of 2,000 U.S. adults by NerdWallet, the personal finance website. Seventy-eight percent said they like EMV cards, nearly half (47 percent) believe the cards make transactions more secure, and 48 percent said it’s their preferred way to pay at the store.
Visa and Mastercard hope new technology, now in pilot testing at several small grocery store chains, will speed things up and improve customer satisfaction,
With Mastercard’s M/Chip Fast and Visa’s Quick Chip, you insert the chip card, a one-time authentication code is generated and then you remove it and put it back in your wallet while the transaction continues. With M/Chip Fast and Quick Chip, the entire process should take less than 3 seconds, down from the current 12 to 15 seconds.
Both Visa and Mastercard report positive feedback from their tests and say they’re working aggressively with merchants to roll this out at more stores.
More to come
The full deployment of EMV security will eventually include ATMs and self-service gas pumps. Starting October 21st, Mastercard shifts fraud liability to financial institutions without EMV-enabled ATMs. Visa's deadline is October 2017.
As of October next year gas stations must accept chip cards at the pump or cover the cost of some fraudulent charges. The conversion won’t be cheap and there could be complicated technical problems to overcome. But gas stations are a major target of credit card thieves and a weak spot in the system that clearly needs to be hardened.
Herb Weisbaum is The ConsumerMan. Follow him on Facebook and Twitter or visit The ConsumerMan website.