If you've traveled overseas recently, you may have had a
moment when your magnetic stripe credit card didn't work. In places where most
credit cards are identified by microchip -- Europe, Asia, Canada, Mexico,
Brazil, to name a few -- relying on standard American magnetic-stripe cards can
be inconvenient. It can also make you
more vulnerable to fraud.
Instead of swiping a chip card, you insert it into a payment
terminal. Identifying information is encrypted on an embedded microchip, which
is more difficult to counterfeit than a magnetic stripe.
More than 80 countries around the world use chip technology. Yet less than 1 percent of credit cards issued in the U.S. have chips. That's
about to change.
Europe began the migration to chip cards soon after 2002,
when EuroPay, MasterCard and Visa collaborated on EMV, the leading global standard for chip
technology. While magnetic stripes offer the same data every time you make a
purchase, chip cards encrypt different data for each transaction, making them
harder to clone or use fraudulently.
Boosting security at
home and abroad
Convenience while traveling seems to be the primary
motivation for U.S. consumers to request chip cards now, but frequent overseas
travelers also appreciate the added security, says Sisy Vicente, general
manager of Chase Card Services. "Having a microchip makes it a more secure
transaction for our card members as they go abroad because it makes it more
difficult to counterfeit their cards," says Vicente.
Several years ago, this reporter had a credit card cloned
while traveling in Bali. The card never left my possession, so I had no idea my
account was vulnerable. Within a week, someone had already traveled to Thailand
and charged more than $1,300 worth of jewelry to my account using a counterfeit
card bearing a different name. Luckily, Citi's fraud department caught and
resolved the problem early.
That kind of cloning would have been impossible with a
chip card. "If a microchip is used instead of a magnetic stripe at point of
sale, the data copied becomes useless for creating a cloned card," says Guy
Berg, now senior managing consultant for MasterCard, but speaking as an EMV
expert who has helped many countries migrate to chip cards. "If someone were to
steal data from a single transaction and make a card from it, that card would be
identified as data used before and not authorized." The counterfeiter would be
caught in the act.
Increasingly, card counterfeiting is finding its way to the
U.S., especially now that both Mexico and Canada have adopted EMV. Fraudsters
look for the low-hanging fruit and with tougher standards elsewhere, they're
concentrating their efforts in the States.
"Given that the United States is one of the last economies, and
definitely the largest, to migrate to EMV, it's attracting a lot of focus from
organized crime elements," says Berg. "This is becoming one of the easiest
places to commit counterfeit fraud, and the problem is expected to grow at a
Chips are coming
Concern about the upswing in credit card fraud is one reason
U.S.-based card issuers, financial institutions and retailers have set a
deadline of October 2015 to put an EMV payment system in place. That's when
liability for counterfeit fraud shifts from the issuers to merchants and their
acquirers if their equipment does not support EMV.
This is becoming one of the easiest places to commit counterfeit fraud, and the problem is expected to grow at a faster pace.
Credit card consultant
Industry experts say we can expect a large-scale rollout of
chip cards in the U.S. later this year and into 2014. By October 2015, major
retailers will likely have terminals in place to read chip cards. Without terminals
to support EMV, retailers rely on the mag stripe -- even when the card contains
Don't expect to use chip cards at the gas pump until at
least 2017, however. "Installing that equipment requires specially certified
personnel working in a highly combustible environment," Berg says.
Bank of America offers chip-and-signature technology for a
dozen cards, including its Travel Rewards, AAA Member Rewards, Virgin Atlantic
and Asiana Airlines cards. Citi has EMV chips in some AAdvantage and Thank You
Premier cards. Chase offers them in J.P. Morgan cards and cards co-branded with
Hyatt, Marriott, Ritz-Carlton and British Airways. American Express Platinum
and Centurion cards also come with chip-and-signature technology.
Ask and you may (or
may not) receive
If you're planning a trip overseas, you should do what a Salt Lake City retired auditor, John Levanger, did to prepare for his trip to Europe in
August: Try to trade in at least one of your mag-stripe credit cards for an EMV
version. As Levanger will attest, however, that may not be possible. He and his
wife hold six credit cards between them -- issued by American Express, Citi,
Chase and a credit union -- but when he contacted American Express and the
credit union, he was told EMV was not yet available for those particular cards.
Getting poll results. Please wait...
Adding an EMV chip to a card is complicated, so issuers are
doing it one category at a time. So far they tend to be concentrating their
efforts on cards aimed at big spenders and corporations, or on those that are co-branded
with airlines and international hotel chains.
Like most issuers, Chase began with cards showing the most
international purchases, according to Vicente. "We knew those customers would
value this new innovation the most," says Vicente. "The response has been
fantastic, especially for folks who no longer have to line up to pay cash to
get their tickets at the airport or the rails system. There are a lot of kiosks
in those places."
Why are we getting
While chip-and-PIN cards are prevalent in Europe and Asia,
the U.S. market offers a PIN option on only a dozen cards, mainly issued by credit
unions. PenFed offers four credit cards with both signature and PIN capability,
and a $20 donation will get you into the credit union. PenFed declined to speak
on record. Wells Fargo has a high-end PIN option as well, but also turned down
a request for an interview.
Representatives of Chase and American Express say
chip-and-signature is all they offer to U.S. cardholders and it's not
an issue. However, overseas travelers occasionally report problems using
chip-and-signature cards at unmanned kiosks.
Is signature-only enough to prevent card fraud, especially
traveling outside the U.S.? Not entirely, says Randy Vanderhoof, executive
director of the Smart
Card Alliance. "Chip-and-signature cards solve the problem of counterfeit
card fraud, but they don't solve for lost and stolen card fraud," says Vanderhoof.
"Having a PIN would add an additional level of protection."
Chip-and-signature cards solve the problem of counterfeit card fraud, but they don't solve for lost and stolen card fraud.
Smart Card Alliance
The standard argument to that has been that financial
institutions issue millions of credit cards that don't support PINs, so there's
a significant learning curve for consumers and merchants to change how they use
their cards. Berg points out that Americans carry more credit cards than is
typical in other countries -- four or five on average. To memorize that many PINs
is a point of resistance, and the first time a customer enters one wrong and a
card is rejected, that registers as a card that didn't work.
MasterCard and Visa have taken slightly different stands on the
PIN vs. signature issue. MasterCard publically announced to issuers that it
will support either signature or PIN. Visa advised its issuers that it
recommends chip-and-signature, but will support financial institutions that want
to issue a PIN. "It's not that the entire industry has decided on one method,"
Vanderhoof says. "It's still being left up to financial institutions whether they want to take that risk associated with issues of consumer learning and
"Everyone agrees -- merchants, consumers and financial
institutions -- that in moving to the more secure platform of EMV, we don't want
to create headaches that cause consumers not to want to use this," Vanderhoof
Will we get a PIN
Berg predicts a PIN option will be added to chip cards
eventually, based on his experience helping other countries -- including Japan,
Brazil and Taiwan -- make the transition to EMV. "Many issuers may start off
not supporting PIN in their first round, but then in a couple years, once they
have all the functionality to support offline PIN for the chip, we may see more
cards going to PIN support," Berg says. "Chip-and-signature is easier to
implement in the credit card environment."
Employing the chip, even without the PIN, will alleviate what he
sees as the real problem: counterfeiting. "PIN does add an additional element
of security, but PIN is not a panacea for security," Berg says. ATM fraud is on
the rise and ATM cards have always used PINs, he points out. Seven people were
arrested in the U.S. in May after criminals stole $45 million in a matter of
hours by hacking into a database of prepaid debit cards and draining cash
machines around the globe. "There are a lot of instances where organized crime
elements have been able to capture the PIN and the information, clone cards and
hit ATM networks," says Berg.
Altering the U.S. payment system to acknowledge microchips
is no small task. "We have one of the most complicated payment ecosystems in
the world," says Vanderhoof. Other countries made the transition to EMV at a
fraction of the time and cost, he points out. "Canada, for example, one of most
recent to adopt EMV, has five primary financial institutions. They only needed
those five to agree and the entire card market could change."
By contrast, the U.S. has more than 10,000 card issuers, a
million merchants and 8 million POS devices that accept cards, Vanderhoof notes.
All have to change. "Businesses only make investments on that scale if there's
a demonstrated return," says Vanderhoof. "They had to see that fraud was bad
and getting worse. They're making the investment as insurance on future losses."
At this point, it's difficult to predict how quickly the
transition to PIN will happen -- if it happens at all. But it's safe to say
we'll soon be inserting, instead of swiping.
If you are commenting using a Facebook account, your profile information may be displayed with your comment depending on your privacy settings. By leaving the 'Post to Facebook' box selected, your comment will be published to your Facebook profile in addition to the space below.
Did you like this story? Then sign up for CreditCards.com’s weekly e-newsletter for the latest news, advice, articles and tips. It's FREE. Once a week you will receive the top credit card industry news in your inbox. Sign up now!