For years, UK banks and their customers have had a leg up on Americans when it comes to avoiding certain common types of payment card fraud.
Credit and debit cards with embedded microchips, standard in the UK and several other European countries, significantly enhance fraud prevention over traditional magnetic stripe cards—at least for domestic point-of-sale retail transactions where the combination of the microchip card and the enabling point-of-sale hardware put the brakes on counterfeit card fraud. The embedded chip is authenticated in a merchant’s reader and must match a customer’s PIN (punched into a keypad), otherwise the transaction is rejected. The chip technology is known as E.M.V. (for Europay, MasterCard and Visa), and has substantially reduced counterfeit card fraud in those regions where it has been broadly adopted.
In the US, the magnetic stripe system only requires a signature to authenticate a purchase (and as you have likely experienced yourself, many merchants have opted to forego the signature for transactions under a certain value, choosing to absorb the fraud risk rather than carry the cost of procuring and storing the signature). For that reason, US banking customers are easier targets for fraudsters from abroad who have targeted US-issued mag stripe cards as a better way to make a quick buck.
In the past 18 months, FICO has seen an increased interest in fraud management as struggling banks look to avoid losses and stay ahead of the fraudsters by preventing and identifying fraud more effectively. There has also been increased interest from European banks, who have seen fraud losses shift from traditional counterfeiting schemes to cross-border or card-not-present transactions, where the protection offered by the microchip does not currently extend.
Since conversion to a chip-and-PIN system is a daunting infrastructure challenge, US banks, retailers and the large card brands (MasterCard and Visa) have not yet found the collective willpower to undertake a large-scale switch. Changing out millions of point-of-sale devices to accommodate chip-and-PIN technology requires not only consensus, but a serious investment. Additionally, the cost to produce and distribute a chip card can be 10X that of a traditional card.
However, there is growing interest in the more secure cards. Wells Fargo and Chase announced test roll-outs of chip cards earlier this year. Banks are issuing the cards to select customers, particularly those who travel abroad frequently. And Visa has recently added to the momentum, calling for accelerated adoption of chip-and-PIN technology, as well as rule changes that would shift liability for fraud as an “incentive” to secure the needed investment.
Radio-frequency identification (RFID) technology, not the same as chip and PIN, has been embedded in some payment cards in the US. The American Express Blue card, for example, allows customers to pay by waving their cards in front of a scanner. But most merchants do not have scanners, and without the twofold PIN protocol, the security status is really no better than that of a mag stripe transaction.
That said, the promise of RFID technology, and the ability to pay through devices such as your mobile phone, may also serve as the catalyst for chip-and-PIN investment. If the banks, retailers, and other interested parties find the economic incentive to invest in RFID technologies, it provides an opportunity for chip and PIN to “piggy back” on the new point-of-sale infrastructure required to enable it.
Currently, those US banks issuing chip cards are doing so mainly to provide a convenience to customers who are frustrated by not having their mag stripe cards accepted abroad. Wide-scale US adoption of chip and PIN will certainly take a while, but as fraudsters continue to increase their activity here, US banks and their payment industry counterparts are moving closer to seriously considering it.