Ayear after the decision by the United Kingdom's banking industry to implement chip- and personal identification number-based credit and debit card payments at the point of sale, banks and retailers have about 550 days to go until the Dec. 31, 2004 deadline. While a lot has been done, there remains a daunting amount to do-and retailers are adopting a variety of strategies regarding roll out and POS equipment.
The overall objective, says Steven Sinclair, communications director of the 20-man chip and PIN program at the U.K.'s Project Management Office (PMO), is "to achieve maturity of chip and PIN by the end of 2004."
The main reason for the change is the dramatic rise in card fraud. Fraud levels are estimated to have tripled in just six years, according to the London-based Association for Payment Clearing Services (APACS), the British banking industry trade group (chart, page 24). And some observers believe they could nearly double again in about three years. Experts attribute the higher losses to more Internet fraud, application fraud, and counterfeiting.
Among the key performance indicators of chip and PIN migration will be:
* Over 80% of the 110 million credit and debit cards in circulation;
* Over 50% of card transactions-three billion out of more than six billion;
* Over 99.5% of transactions successfully completed;
* Over 90% awareness of chip and PIN among 42 million cardholders;
* Over 90% availability of PIN-management services at automated teller machines.
"We have to create a customer expectation that their next transaction will be chip and PIN," Sinclair says.
"This chip and PIN thing really is going to happen," agrees Peter Forbes, manager of store financial operations and systems at London-based Marks & Spencer p.l.c., a major clothing, furnishings and food retailer. "The real issue for all of us is to change the habit of 42 million card-holding members of the great British public-including the one-in-10 of the population who happen to work for a retailer."
The scale of staff training required by the biggest U.K. retailers is monumental. Among the supermarket groups, for example, J Sainsbury plc has 145,000 staff, many of whom work on its 20,000 checkout lanes. Marks & Spencer has 60,000 employees. While checkout staff are in the front line, many of the others will need some chip and PIN training as well.
"Why are we going to get them to change, why are we putting through this aggravation," asks Forbes. "The answer is that they don't like fraud-and please don't confuse this message."
Marks & Spencer is one of several large retailers adopting the "swipe-and-park" approach to chip and PIN implementation-so called because checkout staff swipe the card through a magnetic-stripe reader and then park it in the chip reader. Swipe-and-park equipment allows the data to be read on a mag-stripe card, but is programmed to give preference to chip data on smart cards.
"The technology drives whether the transaction is chip- or mag-stripe-driven," Forbes says.
Mag-stripe technology won't disappear after 2005. The reality is that for some years, retailers will have to be able to read mag-stripe-only cards, such as those issued in the U.S.
The other perceived advantage in the first phase of chip and PIN rollout is that swipe and park does not involve any changes in procedure for customers or for checkout staff. The shopper hands her card to the clerk, who swipes and parks it to obtain authorization and then returns the card.
Once U.K. cards are PIN-enabled (which they are not at present), customers will have the option of retaining control of their cards, which they will be able to insert into an integrated card reader/PIN pad at the point of sale. Alternatively, they can ask checkout staff to insert the card, although they will still have to key in their PINs.
Tesco plc, the biggest U.K. supermarket group, has taken a lead in chip and PIN implementation. Around one million debit and credit card customers shop in Tesco stores every day, accounting for 10% of total U.K. card transactions. Out of ?10 billion ($15.6 billion) spent annually on cards in Tesco stores (approaching ?13 billion this year), 70% is on debit cards and 30% is on credit cards.
Like Marks & Spencer, Tesco is taking the swipe-and-park route.
So Far, So Good
"On trials, the feedback from staff-and customers, where they've noticed it-is that it works well," says Nick Mourant, treasury director at Tesco. "It's a deliberate approach of taking small steps and it future-proofs us against delays in rolling out PIN-enabled cards." He adds that, "I have some doubts whether (the banks) will hit their targets, given the speed at which the banking industry moves."
Tesco is unlikely to roll out PIN pads before August or September of 2004, "until our customers are ready," Mourant says. "I cannot take the risk to clog up my stores with customers who don't know what PIN is about."
Safeway plc, the fourth-biggest U.K. supermarket group, is the most advanced in migration terms. All of its stores were to be chip- and PIN-enabled by late April. "We've trained 80,000 people," says Jeremy Wyman, business systems manager at Safeway.
Contrasting with M&S and Tesco, Safeway has installed stand-alone POS terminals with an integrated PIN pad at its 8,000 checkout lanes. "The customer keeps the card and drives the transaction," says Wyman. "No one else needs to handle it."
Spar, the consortium of independent retailers, has 2,760 U.K. convenience stores, with annual sales of ?2.3 billion ($3.6 billion), of which about 8% are on cards. "We have lots of store sizes and formats," says Roy Ford, information-technology controller at Spar U.K. "One size doesn't fit all."
At its checkouts, Spar will have a further variation on the payment theme. "We've had a lot of support from Streamline (the merchant-acquiring unit of The Royal Bank of Scotland Group/NatWest Bank) and we've chosen VeriFone terminals," says Ford. "Our staff will put the card into the terminal and then turn it round for the cardholder to key in the PIN."
At Sainsbury's, the No 2 U.K. supermarket group, "we haven't made a decision on swipe and park," says Carole Oldham, business focus manager, service solutions. "Our guiding principle is to develop and implement chip and PIN, with customers and colleagues in mind, to leverage maximum benefit from the technology."
Sainsbury's is midway through a comprehensive overhaul of its group POS systems. "Chip and PIN is not the biggest thing we're doing at the moment," says Oldham. "It's something we're fitting in."
The chain is most likely to adopt a "soft launch" approach, she adds. "Switch the (chip and PIN) functionality on before promoting it and allow store staff to use their cards first, before they are sitting at the till."
For the biggest retailers, commercial issues around migration to Europay/MasterCard/Visa (EMV) chip card security standards have largely been resolved. To drive chip and PIN acceptance, U.K. acquirers have offered a carrot-and-stick approach. The carrot is a discount-rate reduction of 10 basis points for accepting credit card transactions, worth ?3 million ($4.6 million annually to Tesco.
The stick is the liability shift to whichever party to the transaction cannot support an EMV-compliant sale. Tesco estimates its exposure here at ?5 million ($7.8 million).
Across all the U.K.'s card-accepting retailers, based on total bank card payments of ?170 billion ($265 billion) in 2001, Tesco estimates chargebacks at ?85 million ($133 million), rising by ?260 million ($406 million) if the liability shift had been in place. But U.K. card fraud was "only" ?410 million ($626 million) in 2001; by 2005, says Forbes, "it could be ?850 million-and it's going somewhere."
That "somewhere" very well could be to mid-sized or smaller merchants that are late in converting to more secure POS equipment, or to payment forms that don't have as much protection as cardholder-present transactions will in just over a year and a half. "Fraud will shift from larger merchants to smaller as gangs look for the next weakest links," says Mourant. "These are likely to be checks or Internet card-not-present."
For Spar, the chip and PIN investment case is compelling. "Opting out wasn't an option for us-fraud will migrate to what's seen as easy targets," says Ford. "Some of our stores are open 24 hours and we could become major targets, if we're not careful."
With the expectation that fraudsters might shift some of their focus to checks, Forbes says Marks & Spencer is installing an online check-validation system in its stores.
At Safeway, chip and PIN implementation took 14 months to complete under a dedicated team and paid for itself in six months, says Wyman. "The business case has a hard-wired ROI. The business drivers for us are incentives from the banks and the liability shift. Incalculable fraud is heading in our direction."
As a bonus, he notes that "We'll save 13,000 miles of till receipt paper every year. That's ?541,000 ($844,000), and it wasn't in the business case."
Supermarkets downplay the faster transaction times that chip and PIN proponents tout as an opportunity for retailers. Tesco's calculations show that an average mag-stripe transaction takes 25 seconds. With chip, this rises to 28 seconds. But the addition of PIN as well as chip pulls the time back to 25 seconds, because PIN is faster than signature-based transactions.
Among unresolved operational procedures, retailers see the rules governing fallback to a card's magnetic stripe as the most important.
"What happens if the chip doesn't work-and they don't always work, there are three issuers whose cards don't work properly," says Wyman. "Who do we call when cards return messages you're not expecting?"
Safeway made progress on this issue only "when a NatWest senior manager's card was rejected," Wyman adds. "But the number of problems is less than with mag-stripe, and data quality is higher."
The remaining chip problems are disappearing, says Waqar Qureshi, vice president at Visa International's London-based Visa European Union region. "They reflect the change from (old) specifications to EMV," Qureshi says. "The old generation of cards wasn't fully tested for EMV."
Another issue, says Mike Postle, head of national accounts at Streamline, is fallback to the mag-stripe when customers forget their PINs. "The rules need to be confirmed," he says.
At present, "there's no change to the rules which require the retailer to check the details on the card," Postle says. "Are those rules going to be changed? There are discussions going on within the schemes, but no confirmation."
Postle believes that while there may be some initial flexibility, the longer-term game plan must be for customers to be asked to tender a different form of payment rather than to continue rely on the mag-stripe.
Retailers and acquirers all agree that "education, education, education" of the public is key to the success of the U.K.'s chip and PIN program. Though there has been extensive consumer research, says Sinclair of the Project Management Office, "we need to understand cardholder reaction."
To get such reaction, a 15-week test started this spring in Northampton, a city a bit north of London. The test involves about 1,800 integrated POS terminals and 134 ATMs in an area with 147,000 debit cards and 88,000 credit cards in circulation.
Regarding consumer attitudes, the glass is either half-full or half-empty, depending on the observer. In a recent survey (chart, page 26), over 60% of respondents voiced opinions for chip and PIN usage, says Sinclair. "The size of the communications task is made easier by the majority in favor of it," he says.
But viewing the same figures, Tesco's Mourant says, "Some 40% of the U.K. consumer base is still resistant or antagonistic. A lot of customers will hate PIN-let's not underestimate this."
Problems in the Middle
Mid-sized or so-called mezzanine retailers are another headache for chip and PIN strategists. Even the numbers involved are uncertain. The British Retail Consortium estimates 7,000, but Postle says Streamline's records show 20,000.
The PMO classifies them as the "IPOS" category-independent retailers with their own electronic POS systems. They account for about 20% of annual U.K. card purchase volume.
The top 25 retailers, with 50% of spending, and small retailers, with 30%, will achieve chip and PIN compliance. The biggest will do so by working closely with their acquirers, and the smallest because their terminals are acquirer-owned. But mid-sized retailers appear to have low awareness of chip and PIN, little commercial involvement and disparate terminals and systems.
"We're striving to engage with them and it's a struggle," says Sinclair. "We need to create real momentum and ensure a significant volume of implementation among these medium-sized retailers."
A rapid increase in awareness is necessary, says Streamline's Postle.
"Fifteen to 20 major merchants are Streamline clients and we've agreed to dates for testing and approval with all of them," he says. "But the mezzanine merchants are critical to success and will provide a positive way forward for the whole exercise-and all 20,000 will have to be tested."
Safeway's Wyman says he's "amazed that some retailers think chip and PIN won't happen."
No doubt over the next 18 months, mid-sized retailers will get the message that rising fraud may be heading their way. For those who don't, reverting to a contract where the acquirer supplies the terminals is a possibility.
With a long list of unresolved issues, retailers are also downplaying the opportunities which the new chip and PIN infrastructure may enable: increased use of unattended payment terminals, more self-scanning and chip-based loyalty programs.
Retailers say they will not chip-enable their loyalty programs-a favorite component of the business case for EMV as advanced by the card associations. Marks & Spencer is not planning to change its proprietary Chargecard, according to Forbes.
"It will remain mag-stripe for the time being, but we'll monitor things and see if it becomes a target for fraudsters," he says.
Sainsbury's is a key player in the U.K.'s Nectar loyalty scheme, but Oldham says that "It's mag-stripe-based and it will remain so for the next few years."
More generally, she cautions against too much ambition on the back of chip rollout.
"As far as adding new functions at the POS is concerned, I've warned our people-don't make it too complex, there are 100,000 store-based colleagues who need to be retrained."
Authoritative analysis and perspective for every segment of the payments industry
Authoritative analysis and perspective for every segment of the industry
Have an account? Sign In