WASHINGTON -- Advising lawmakers that new chip cards need to have personal identification numbers (PINs) to be more effective, officials with the National Retail Federation (NRF) told Congress that chip-and-signature cards without PINs will not stop the high-profile data breaches that have plagued corporations, banks and institutions in recent years.
The October 1 date for a shift in liability to retailers without Europay MasterCard and Visa (EMV)-enabled, in-store terminals passed last week, with many retailers still scrambling to avoid the fraudulent chargebacks. Association officials representing retailers in recent days have been advocating for measures such as PINs to help smaller business cope with the migration to EMV.
“The new EMV equipment does not stop breaches,” said David French, senior vice president of government relations for NRF. “Indeed, in many cases it provides no significant benefits either to the business or to the business’ regular customers. It is merely an additional expense small businesses are being told to bear.”
Cards that U.S. banks now issue feature a computer microchip that will eventually replace easily copied magnetic-stripe data. But French said the cards also need a secure PIN, which would eventually replace easily forged signatures. While the chips make the cards more difficult to counterfeit, they do nothing to protect lost or stolen cards, while a PIN alone could prevent both types of fraud, he said.
Speaking to CSP Daily News, Carolyn Balfany, senior vice president of product delivery for EMV at MasterCard, Purchase, N.Y., said banks and merchants need all types of authorization and authentication methods today, including signature cards. “I don’t think there’s a one size fits all,” Balfany said. “When we look ahead … there are other ways we can reach the same level of authentication without PINs by better means like biometrics or facial recognition. And for those banks [or merchants] where it makes sense, those [options] will have applicability.”
“Card networks like Visa and MasterCard have chosen to push chip-without-PIN technology, which is the most expensive for retailers and the least effective at preventing fraud,” said Paige Anderson, director of government relations for the National Association of Convenience Stores (NACS). “That makes no sense, but is consistent with the way the networks have repeatedly used their dominant position in the marketplace to advantage themselves and financial institutions at the expense of retailers and consumers.”
Historically, NACS has spoken out on the challenges and costs EMV has imposed on the channel, but has found legislative solutions elusive. Anderson said the liability shift is not a mandate and doesn’t stop merchants from conducting business because stores without EMV can still take mag-stripe cards. “It’s a liability shift on an arbitrary deadline created by card companies,” she told CSP Daily News. “It’s difficult to [initiate] legislative [remedies over] a private company.”
Those difficulties have undoubtedly forced retailer groups to look beyond the recently passed October 1 deadline for in-store point-of-sale (POS) upgrades or even the Oct. 1, 2017, liability shift date for fuel-dispenser POS—which Balfany says probably won’t budge—and focus on chip-and-PIN advocacy.
NACS has currently prioritized educating legislators, the business community and the general public on the need for PINs for all chip-card transactions, Anderson said.
“Right now, there’s a misleading narrative on the part of credit-card companies and banks that the chip-enabled cards will stop data breaches and payment-card information theft,” Anderson of NACS said, noting how online fraud will probably increase as EMV moves forward. “The reality is chip alone only resolves a small part of fraud. We still need a way to make it more difficult for thieves to use [stolen] information.”
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.