EMV chip technology ARE COMPANIES AND CONSUMERS REALLY READY?

Transcription

1 EMV chip technology ARE COMPANIES AND CONSUMERS REALLY READY?

2 2

3 If you own a credit or debit card and have yet to hear of EMV chip technology, listen up. On October 1, 2015, MasterCard, Visa, Discover, and American Express will be issuing policy changes that will shift credit and debit card fraud liability to the merchant or financial institution issuing the card. This means your favorite stores will likely no longer accept non-emv capable cards in order to relinquish liability of fraudulent activities in their stores. In other words, that traditional debit or credit card in your wallet the one with the black strip on the back will no longer work and will likely be replaced with an EMV chip card. WHAT S EMV, AND HOW DOES IT WORK? EMV stands for the technology s creators: Europay, MasterCard, and Visa. The EMV micro-processing chip itself is embedded into the card, as displayed in Figure 1. In order to understand exactly what this chip does, you first need to understand how a traditional credit card works. When a customer or employee swipes a traditional card, the point-of-sales (POS) system reads and interprets a static number that s been assigned to the black magnetic strip on the back of the card. This number doesn t change and, if stolen, can be replicated in purchases time and time again by hackers and identity thieves. The EMV chip, on the other hand, creates a unique identifier for each transaction. Every time the EMV chip is read, that transaction code is scrapped, and a new one is generated. Therefore, if a hacker tries to make purchases using a stolen EMV code, it will be too late; the transaction code will have changed, rendering it useless. The United Kingdom adopted chip technology in 2004, and by 2009, retail losses from card fraud had fallen 58 percent. Just how useful are these little chips? The United Kingdom adopted chip technology in 2004, and by 2009, retail losses from card fraud had fallen 58 percent. When Canada rolled out the EMV cards in 2008, losses from debit skimming decreased 73 percent in three years. Such results, in conjunction with the recent outburst of data breaches at major retailers, have provided the motivation for EMV migration to the United States. In fact, many U.S. consumers have FIGURE 1 FIGURE 3 PLANTE MORAN 3

4 already switched over to EMV chip cards and presumably believe in the additional security these cards should provide. BUT IS IT A FALSE SENSE OF SECURITY? At this point, you may be thinking, I need to update my card, or My card has a chip; I m secure. If you re in the former group, you re right. If it hasn t already, your card provider will likely replace your current card with EMV technology soon enough. If you said, I m secure, then you re partly correct. Think back to purchases made with your EMV card this past month has your card ever been swiped, like pictured in Figure 2? FIGURE 2 If yes, then your card s information is in the same boat as traditional cards. Swiping, whether with a traditional or EMV-capable card, will read that static number from the magnetic strip on the back of your card. The simple presence of a chip in a card doesn t mean it will be used in each transaction. For an EMV-capable card to work, it has to be dipped into an EMV-capable machine. This concept of dipping, pictured in Figure 3, allows the POS device to read the EMV chip instead of the traditional magnetic strip. This process usually takes a few seconds, as opposed to the split-second swipe most card users are used to. After surveying 33 debit and credit card holders, we found that 88 percent of respondents who owned EMV-enabled cards had swiped their cards in the past month. But who s at fault for the lack of proper use of EMV capable cards? It s tough to blame consumers if they haven t been 88 percent of respondents who owned EMV-enabled cards had swiped their cards in the past month. FIGURE 3 instructed on how to properly scan an EMV card at a pay-station. Retailers must be prepared to accept EMV capable cards as much as consumers should be prepared to use them. Yet, in the United States, that s not currently the case. According to an ACI Worldwide survey sent to 200 retail industry professionals in January 2015, only 31 4

5 percent claimed they d be ready for EMV chip technology by the October 1 deadline. Of that 31 percent, only 12 percent claimed to be compliant at the time the survey was conducted. Moreover, according to surveys performed by The Strawhecker Group, 53 percent of respondents believed they wouldn t be ready until 2017, two years after the liability deadline. The point is this: simply being aware of the proper usage of EMV technology isn t enough. Until retailers properly implement changes, EMV technology cannot reach its full potential. So what about physical theft of one s EMV-enabled credit or debit cards? The chip provides no additional protection to transactions made on a physically stolen card. In other words, if you lose your card, you re out of luck. Granted, if your card is chip-and-pin (pin code required for additional security), the thief would need to know your pin code to make transactions. Yet, this feature is commonly available on traditional magnetic strip cards: the chip plays no factor here. CONCLUSION: THE FUTURE IN THE U.S. Although this technology truly is revolutionary, it s creating a false sense of security among EMV-enabled purchasers. In due time, we ll realize the benefits of reduced fraud and, as in England and Canada, the effect will be tremendous. For now, however, the benefits of EMV technology are but a fraction of their potential. PLANTE MORAN 5

6 CONTACT RAJ PATEL Partner, Management Consulting LISA MANETTA Senior Associate, Assurance plantemoran.com