New credit card chips help prevent fraud

Many more stores and their customers will be swapping the swipe for the dip, by next month, in a new routine expected to put a significant dent in credit card and debit card fraud.

Technology behind the process (known in the industry as EMV, named for Europay, MasterCard and Visa, the card associations that developed it) has long been used in Europe and other modern economies around the world, including Canada.

To bring this more sophisticated technology to the United States, credit card associations and issuing banks are phasing out cards that rely on a magnetic strip alone to store information.

Information on those magnetic strips can easily be “copied” by a savvy criminal using an inexpensive card reader. With the copied information a criminal can duplicate the credit or debit card and go on to make fraudulent charges by swiping a copy of the card or submitting card number information online or by telephone.

To curb such fraud, card issuers are replacing the easy-to-duplicate magnetic strip cards with cards that feature an embedded microchip to enable more secure data storage and transmission.

The microchip in chip cards generates a one-time transaction code for each payment. A stolen transaction code would be denied because it can only be used once and depending on the chip to generate a new code makes fraudulent use through copying infeasible.

However, to tap the advantages of these “chip cards” merchants must install and use terminals that can read the embedded microchips.

“The majority of consumers are not going to see a big difference,” and are most likely to encounter the new technology first at major retailers, said Kim Mangrum, senior vice president and chief member services officer of Point Breeze Credit Union.

Those terminals may offer both chip and magnetic strip readers (to accommodate cards that contain only a magnetic strip) and direct chip cards away from the magnetic strip reader to the chip reader.

The terminals require a chip card to remain in a chip reader slot throughout the transaction.

The dip process will take a bit longer than a swipe and chip cards may or may not require cardholder verification by signing or entering a PIN (personal identification number).

Signatures, rather than PINs, are also expected to be used most often for verification, Mangrum, and others, said.

“It’s up to the merchant whether they require a signature or PIN with purchase,” M&T Bank retail product manager Leanne Hughes said.

Although the switch will be mostly painless for shoppers, it is not so painless for merchants.

As of Oct. 1 — a deadline set in contracts by Visa, MasterCard, American Express and Discover —merchants who accept an (EMV) chip card through a terminal that is not EMV-compliant will shoulder liability if the transaction is fraudulent.

Automated fuel dispensers used in pay-at-the-pump operations have until Oct. 2017 to become EMV-compliant.

Likewise, banks contracting with merchants to accept cards and maintain accounts must be EMV-compliant or risk liability when they accept a fraudulently used chip card.

Consumers still are expected to report lost, stolen or compromised cards, but remain shielded from liability.

Most of the impact is really behind the scenes between banks and merchants, said Wade Barnes, director of retail banking at 1st Mariner Bank.

“It’s important for customers to know that even if they don’t have a chip card, they can continue to use the card,” Barnes said.

The chip cards are more expensive for banks to issue, and they are issuing them as or before old cards expire and by request.

Also, for merchants, “it’s not a cheap endeavor,” Barnes said.

Deciding what EMV-compliant equipment to install and when to do it is not simple for many merchants either.

Smaller merchants tend to adopt new technology after larger merchants have used it for period, said David Shorten, general manager of PNC Merchant Services.

PNC Merchant Services, a joint venture between PNC Bank and First Data Corporation, is one of several concerns offering EMV-compliant solutions that can add value by integrating with business management systems.

Some merchants are not rushing to install the EMV-compliant terminals because their businesses have not been prone to accepting many fraudulent transactions, and the risk seems not to warrant the expense.

Some merchants have found it difficult to evaluate what solution would best address their needs and be worth the cost.

“It really depends on the complexity of their set-up — it could be as easy as adding a PIN pad,” Shorten said.

Liquor, jewelry and electronics stores — and other sellers of high cost, portable goods that are easy to resell — would have a high risk of being on the hook for fraudulent purchases, experts noted.

But for many retailers their approach to investing in EMV-compliant terminals is “wait and see,” said Joseph R. Whitford of SunTrust Merchant Services, another joint venture with First Data offering EMV-compliant solutions.

For restaurants, the switch to EMV-compliant terminals (which can be portable) for wait staff to use can be very expensive, particularly if they want to integrate it with other systems.

The office administrator for a 125-seat restaurant in Annapolis agreed.

“The biggest issue seems to be finding a solution that is compatible with our point-of-sale system,” said the administrator who asked that she and the restaurant not be named for security reasons.

She said she is waiting for a solution that can be integrated with the restaurant’s seven workstations. And that will be weighed with costs of between $400 to $650 per terminal plus additional ongoing fees.

Meanwhile, industry analysts say that making it hard to commit fraud by swiping a copied card will move criminals to make more fraud attempts online or over the telephone.

So experts are advising merchants who accept those “card-not-present” charges to use more fraud prevention tools than the traditional address and security code validation checks.