Time to Reshuffle the Card Deck?

A fraudster walks into a store intent on stealing merchandise or committing credit card fraud. The store has technology and best practices in place that make it too difficult or dangerous to carry out the plan, however, so the thief moves on to an easier target.

Every LP professional has seen some variation of this event. Now, a similar scenario is playing out on a global level as more countries are converting from mag-swipe credit cards to EMV standard “smart” chip-and-PIN-based payment cards. If a fraudster finds the going tough trying to steal from retailers in countries that have converted to EMV “smart cards,” it’s very likely that, like a thief on the street, he’ll search elsewhere looking for easy pickings, says Jamie Henry, Walmart’s director of payment service.

“Those fraudsters are professionals and they are going to find a way to continue their business, which is committing fraud,” Henry says. “They will naturally flow toward and through the path of least resistance, and that will be U.S. retailers. Committing fraud with mag-swipe cards is simply easier than committing fraud with chip-and-PIN cards.”

EMV is the global standard for chip-based payment cards that are tested and governed by EMVCo, founded by Europay, MasterCard and Visa. EMV “smart” chip-based payment cards have been around since 1994, when they were first deployed in Europe. They are called “smart cards” because they contain embedded microprocessor chips with security credentials that are encoded by the card issuer at personalization. These credentials are then encrypted to prevent card cloning, one of the common ways mag-swipe cards are compromised.

“For a mere $100, fraudsters can steal personal information off a mag-swipe card and import it onto a counterfeit card,” says Chris Justice, president of Ingenico North America, a leading global provider of retail electronic payment hardware and software solutions. “The chip, on the other hand, is more technologically complex, and the ability for someone to duplicate that chip — and tie it to a four-digit PIN that only the cardholder knows, and then synch that data perfectly back to the card issuer — is nearly impossible.”

Nearly a billion EMV cards have been issued worldwide, according to Brian Byrne, a Visa executive and the chair of the EMVCo board of managers. Ingenico, which has a 55 percent share of the secure retail electronic payments market, has more than 15 million terminals deployed across 125 countries. It is working with a number of large U.S. retailers with a global presence (including Walmart) to help them upgrade to EMV in markets outside the United States and to prepare for the likely increase in U.S. bricks-and-mortar fraud in the wake of Canada’s recent conversion to EMV.

Walmart, says Henry, is a “strong advocate of chip-and-PIN for payment.” It is already processing transactions with EMV smart cards outside the United States, has 100 percent of its domestic payment system hardware equipped to accept EMV smart cards and is finalizing software programs for those devices.

In addition to making it harder for thieves to use fraudulent or stolen credit cards, Walmart believes that adopting EMV cards in the United States will make shopping much easier for international visitors.

“We want to provide a consistent consumer shopping experience,” he says. “When customers from the U.K., France, Canada, etc., come to our stores carrying EMV cards, we want them to be able to use their payment cards in the same fashion they would use them in their home countries.”

Obstacles to conversion
With all the security and convenience benefits EMV cards have to offer, you might think U.S. retailers would be gearing up to convert en masse. That isn’t the case, however — and there are two primary theories as to why. One holds that it would be quite expensive for retailers to convert to smart cards; the other is that card issuers make so much more money from the higher interchange rates on mag-swipe cards in non-EMV markets that they have no profit-based incentive to convert.

“There is a lower interchange rate for chip-and-PIN-based payment cards because there is less risk associated with the transaction,” Henry says.

Results from EMV markets like France and the U.K. “clearly show that bricks-and-mortar or face-to-face fraud plummets when EMV is installed,” Justice says. “That’s because both the cardholder and the card are validated, which confirms to merchants that they have a legitimate consumer trying to make a legitimate purchase.” Research done by CardWatch shows that the U.K. fraud loss rate declined 48 percent — from 18 basis points to 12 – between 2001 and 2008, even as overall card spending nearly doubled.