HARTFORD, Conn. -- Eight state attorneys general joined Connecticut Attorney General George Jepsen in urging leadership of the nation’s largest credit-card issuers to speed up implementation of chip-and-PIN (personal identification number) technology, which is widely considered a more secure means of processing credit-card transactions than traditional magnetic-stripe payment cards and the Europay MasterCard and Visa (EMV) chip chip-and-signature card process they are now rolling out.
In a letter, the AGs asked leaders at companies including MasterCard, Visa, Discover Financial Services, Bank of America, Capital One, Citigroup, American Express and JP Morgan Chase--who have collectively begun the nationwide transition to a chip-and-signature card--to move to full chip-and-PIN technology as soon as possible.
The AGs said that doing so would be in the best interest of consumers, who are now routinely impacted by breaches involving credit and debit cards, and of local businesses, which are at risk of increased financial risks as well as harm to their reputations and loss of consumer trust if they experience a breach.
“Over the last few years, breaches at major retailers that involved credit and debit card information have really shown a giant spotlight at the inherent weakness and vulnerability of magnetic-stripe cards even when the cards are lost or stolen,” said Jepsen. “We know, based on experiences in other countries, that chip and PIN cards offer greater security to consumers--security that I believe far outweighs any initial burden or confusion that always comes when we need to get used to a new way of doing things, like using a credit card. Consumers in Connecticut and across the country deserve access to the absolute best that the industry has to offer. Right now, that is chip and PIN, and I believe it’s my responsibility to advocate on their behalf for it.”
The AGs said that while the ongoing implementation of chip-enabled cards in the United States is “imperative in order to provide stronger payment security and assurance to consumers,” most chip cards currently being issued in the country rely on a signature, rather than a PIN, as the secondary form of verification.
“There can be no doubt that this is a less-secure standard, since signatures can easily be forged or copied or even ignored at the point of sale,” the AGs wrote. “In order to better protect consumers, the chip-enabled cards issued in this country must be reinforced with the requirement that consumers enter a PIN to verify the transaction. … Absent this additional protection, your customers and our citizens will be more vulnerable to damaging data breaches. This is something we cannot accept, and nor should you.”
“I am not calling for chip and PIN or any other particular technology to be codified in federal or state law as a legal mandate on card issuers,” Jepsen said. “Rather, I am urging credit-card issuers, as good corporate citizens, to voluntarily expedite the implementation of a technology that exists now and offers substantial security benefits and to continue to adapt and improve security as quickly as possible as newer and even better technology arises in the future. No technology will prevent all credit card fraud, but chip and PIN promises to substantially curtail lost and stolen card fraud and the disruptions it causes to consumers and businesses. I recognize that issuers should consider and minimize disruptions to consumers and retailers as they implement new technology to improve security, but I believe they can and should do more to expedite implementation of chip-and-PIN technology.”
In addition to Connecticut, AGs from Illinois, Maine, Massachusetts, New York, Rhode Island, Vermont, Washington and the District of Columbia joined in signing the letter.
“This is further proof that top law enforcement officials and security experts agree that continued reliance on an illegible scrawl isn’t good enough to protect American consumers when the technology of a secret, secure PIN is readily available,” said Mallory Duncan, senior vice president and general counsel of the National Retail Federation (NRF). “Banks and credit-card companies should heed the advice being given them and immediately implement chip-and-PIN. That’s the standard used around the world, and U.S. consumers deserve nothing less.”
The U.S. Federal Bureau of Investigation (FBI) has issued a warning to law enforcement, merchants and consumers that credit cards with the new chip can still be the target of fraud. When using the new cards at a point-of-sale (POS) terminal, consumers should use the PIN instead of a signature to verify the transaction.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.