There’s no question the migration to EMV will be difficult and costly. You know the hurdles your company has to face, including the costs involved, the logistics and the potential disruption of your day-to-day operations.
As part of my job with Conexxus, my biggest message going forward is the need to add personal identification numbers (PINs) to chip cards. Doing so will drastically reduce the potential for fraud as c-store operators move as best they can toward installing EMV-certified and -tested hardware and software.
There are two indisputable facts: According to the Federal Reserve Bank, signature transactions have a 400% greater fraud risk than PINs, and consumers know that PINs are far more secure than signatures. (They can also, contrary to the card companies’ assertion, easily remember four-digit PINs!)
PINs tied to the magnetic stripe and chip cards can dramatically reduce the fraud retailers will be exposed to while migrating to EMV—and well after we are finished.
What to Expect by 2017
Many barriers exist in our channel for any retailer, large or small, to meet both in-store and forecourt deadlines, primarily the one coming up in 2017. We have 152,000 stores in our channel. That means 326,000 POS upgrades, 429,000 pump upgrades and 292,000 pump replacements—and don’t forget communication or “comm” device upgrades, about 128,000 of those. These numbers yield a lot of challenges:
- Not enough technicians. I estimate we will need 3,000 qualified technicians to do 4.5 million man-hours on site to install the retrofits and pumps needed between now and 2017. There just aren’t enough, even if they focused exclusively on EMV. So if something goes wrong with a pump nozzle, forget it. You’ll have to fi x it yourself.
- A certification bottleneck, where multiple devices and software systems have yet to achieve certification to run EMV. I count at least 300. Banks have only recently delivered full specifications, causing a ripple effect with regard to development, testing and delivery of hardware and software.
- Dispenser manufacturers would have to ramp up production 150% to keep pace with presumed demand. They assure us it’s possible, but it’s going to be a challenge.
- Many will face financial hardships. About 30% of retailers simply do not have the ability to pay for the equipment with operating profit. Unfortunately, those who lag behind may be at higher risk of fraud. Our estimates point to a potential increase of 19 basis points as fraudsters seek non-EMV victims to use for passing counterfeit cards, enough to put a retailer out of business. Believe me, we will have store closures.
Changing the Conversation
This is why we need PINs to make the best of this situation. Yes, we had a chance to fight EMV in its entirety—but that was before Target changed everything. EMV is certainly a foregone conclusion in Congress, and I don’t see card brands willing to waste a good disaster to do it right, foster innovation and offer a fighting chance for the merchant to avoid liability shift.
That said, we have an opportunity to shift the discussion beyond credit-card fraud to the real topic of data security. The truth is, data breaches are not just about retail. If you look at the top 10 breaches through 2014, only two happened with retailers. In terms of industry groups being breached, No. 2 is lodging and the No. 1 is banks. We live in a world in which criminals can get enough information on you—from stolen health records or even your own social-media accounts—to re-create your identity to the point where you’ll have a hard time convincing creditors it wasn’t you who bought that new sofa set or Caribbean cruise.
If the conversation on security can shift from the myopic view of payment cards to the societal view of national security, the special interests bent more on perpetuating closed-payment systems become less of a factor in our nation doing what is right.
So in this light, I hope you can see we need your voice, your input and real-world perspective. We’ve got a lot of folks to educate. While EMV may be a foregone conclusion, we’ve got to consider our industry’s near-term well-being and life after EMV.
I encourage you to get involved. Registration for the Conexxus 2016 Annual Conference, to be held May 1-4, 2016, is opening in December. For details, visit conexxus.org/content/2016AnnualConference
Gray Taylor is executive director of Conexxus, Arlington, Va. Reach him at gtaylor@conexxus.org.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.