- Digital Identity Summit 2017: Brian Krebs Named as Keynote as Call for Speakers and Award Nominations Open
- Top 5 Reasons to Vote ThreatMetrix for the MRC People’s Choice Technology Award!
- Organized Fraud Rings Target Online Lenders and Emerging Financial Services, Reveals New ThreatMetrix Report
- ThreatMetrix Momentum Accelerates for Full Year 2016
- Digital Identity Summit 2017 Expands into Hong Kong, London and San Francisco
By the end of 2015, microchips will be embedded in most U.S. credit cards as issuers go full-speed ahead to EMV standard
EMV chips are on the horizon. By the end of 2015, they’ll be in the hands of the majority of Americans. The Aite Group, an independent research and advisory firm that focuses on business, technology and regulatory issues, projects that 70 percent of all U.S. credit cards, and roughly 41 percent of debit cards (1.1 billion total) will be EMV-enabled by the end of 2015.
As reported by Jaikumar Vijayan, who covers data security and privacy issues; security legislation and regulations; online, mobile and wireless security and more for Computerworld, 18 of the top 40 credit and debit card issuers, including 7 of the top 10 banks, are going ahead with EMV implementation plans.
The Aite Group’s research director, Julie Conroy, observes that “A majority of Americans will have EMV cards in their wallets by the end of 2015.”
While replacing striped credit and debit cards with new EMV credit and debit cards on the surface appears straightforward, there’s a lot more to it. In his story on computerworld.com, Vijayan looks at the factors and actors involved in implementing the new technology. The following has been edited to fit our format. You may find the full article by clicking on this link.
Americans will simply sign
[Unlike] many other countries where EMV cardholders are required to enter a Personal Identification Number (PIN) for in-person transactions, just a signature will be required in the U.S.
In fact, 13 of the 18 banks reviewed by Aite plan to issue EMV cards that require only a signature. Just one bank currently plans to issue EMV cards with a PIN requirement, while four have not decided what route to take, Conroy said.
Visa and MasterCard currently require U.S. retailers to implement technology for supporting EMV transactions no later than October 2015. However, they do not require card issuers or merchants to require PINs.
After the October 2015 deadline, merchants that do not have EMV infrastructure in place will face greater liability exposure in the event of a data breach.
The price of EMV
The move to EMV is expected to cost U.S. retailers and banks several billion dollars. An estimated 13 million point-of-sale systems around the country have to be upgraded or replaced to support EMV transactions.
Conroy expects that big banks will spend around $1.30 for each EMV card while smaller banks could pay between $3 and $5 per card. Banks and financial companies will also need to replace or upgrade ATM machines to support EMV.
To PIN or not to PIN
Some retail groups have expressed concern over the lack of a PIN requirement. The National Retail Federation, for instance, argues that the true security benefits of EMV technology can only be realized with a PIN. They have noted that while a signature-based EMV card will help address some kinds of fraud, such as that involving cloned cards, it can’t stop crooks using card-not-present tactics in online or phone transactions.
Not everybody’s onboard
The NRF suggests that instead of spending billions on the current U.S. EMV plan, credit card companies require other approaches, such as end-to-end encryption of card data or a PIN requirement for all transactions.
Migration is well underway
“Aite’s projections provide another important data point that the migration from magnetic stripe to chip technology is well underway,” said Ellen Richey, Visa’s chief enterprise risk officer.
“By the end of next year, chip cards should be very real for consumers, and when widely adopted will have a dramatic impact on counterfeit fraud rates,” she said in an email.