Chip-card rollout drama peaks day before deadline
The battle pitting banks and card companies against retailers reached a low point on the day before Thursday’s deadline that requires merchants to install new card readers that can process payments with the new chip-embedded cards. After the deadline, retailers will incur financial liability for counterfeit card fraud if they haven’t updated their payment terminals.
Both sides in the debate issued statements and held conference calls with reporters to defend their point of view.
“Banks have failed to meet their own deadline for converting chip cards, but America's retailers are open for business either way,” said Mallory Duncan, general counsel for the National Retail Federation in a statement. Banks haven't rolled out chip cards to all consumers, he said, and stores will still accept magnetic stripe cards.
On Tuesday, Duncan said that it was unfair for the nation’s retailers to bear the bulk of the financial burden in the transition to chip cards and terminals, which he estimated will cost up to $35 billion over several years.
The concerns of retailers have garnered the sympathy of some analysts. “I can understand retailers’ frustration,” said Jordan McKee, an analyst at 451 Research. “Despite most card issuers' struggling to convert 50% of their portfolios to chip by year end, merchants are being held liable for fraud on Day 1 [tomorrow]. There’s a bit of a disconnect.”
Visa, MasterCard and a group called the Payments Security Task (PST) Force, which represents eight major banks, boasted Wednesday about the early success of the multi-year chip card rollout and offered a variety of statistics.
At Visa, executives claimed that 57% of U.S. consumers now have at least one chip card in their wallet, but conceded it will take two to five years for card adoption to top 90%. Visa said it had issued 151 million chip-embedded debit and credit cards as of Sept. 15, about 21% of Visa’s total.
“That makes the U.S. the largest chip card market in the world. It’s really good progress,” said Stephanie Ericksen, Visa’s vice president of risk products, in a call with reporters.
Separately, MasterCard said 40% of its credit cards in the U.S. are now chip-enabled, but the company would not reveal how many cards that totals.
“The shift to chip in the U.S. is a reality,” said Chris McWilton, president of North America Markets for MasterCard, in a statement.
The PST’s eight banks said that 30% of their customers’ credit and debit cards were chip-enabled as of the end of June, a number expected to grow to 60% by the end of the year and 98% by the end of 2017.
The PST companies that accept payments on behalf of banks also estimated that about 40% of payment terminals will be ready to accept chip cards by the end of 2015. Visa said about 314,000 store locations are ready to accept chip cards. One location, it said, could have between one and 50 or more payment terminals.
Given that there are an estimated 6 million to 8 million retail locations in the U.S. with an estimated 12 million payment terminals, the upgrade to enable chip-embedded cards has been massive. Retailers have had four years’ notice to meet the Oct. 1 deadline, but many are unprepared, as retailers have openly conceded.
Retailers in the 94-member Merchant Advisory Group, on Tuesday blamed credit card companies for a six-month backlog in getting new equipment certified. Asked to respond to that concern, Visa's Ericksen said, “It does take time for the ecosystem to get built out … We’re doing as much as possible to streamline and provide clarity. When you look at an infrastructure as large as the U.S., it will take several years.”
The NRF has also complained that terminals can cost upwards of $600 apiece, which puts an unfair burden on retailers to make the conversion. Ericksen responded that costs for terminals have dropped in recent years, with some as low as $49 apiece.
“The incremental cost for terminals is negligible now compared to early costs in other countries,” she said.
The NRF has also argued for the financial services industry to push for chip cards with the added security of a PIN (personal identification number), which would provide greater fraud protection than a chip card with a signature, or no signature or PIN on sales below $25 at many stores.
Ericksen said there’s a movement in both Canada and Europe away from requiring a PIN with a chip card. Part of the reason there’s no consistent industry rule on requiring a PIN for a purchase is competition between banks and card companies, she said.
“From an industry perspective, we don’t collaborate on rules, but we have similar rules,” she explained. “We have to compete and don’t collaborate on policy.”
The NRF, which has 18,000 members, favors requiring a PIN to provide added protections if a chip card is lost or stolen. Even with the computer chip in a card, a thief could present a stolen card at a store and make a purchase, which is something retailers hope to avoid.
But banks and credit card companies are less concerned about lost and stolen cards, which make up about 10% of in-store card fraud, than they are about counterfeit cards, which make up 65% of in-store card fraud, according to Visa officials.
The chief security advantage with a chip card is to protect in-store payment from counterfeit cards, which thieves can manufacture after hacking a store’s financial database to find credit card numbers. The chip in a card uses cryptography to generate a one-time use code for every transaction, which thwarts the creation of counterfeits, bank officials explained.
The financial service industry has long conceded that chip cards are just one tool to protect the entire payment ecosystem from fraud. Efforts are underway to expand beyond chip cards to include tokenization and point-to-point encryption. The PST has even posted a payment security technology roadmap online.
Retailers are aware of the need for security beyond chip cards, the NRF said. “Nearly all major retailers are working to implement data encryption and tokenization, which many experts believe will do more to protect shoppers’ financial data than U.S.-style [chip] cards,” the NRF said.