E-commerce merchants aren't supposed to be directly affected by the U.S. shift to EMV-chip cards at the point of sale, but they will face several unintended consequences of the increase in payment card security.
Web merchants are already being told to expect an onslaught of fraud as criminals seek a softer target. But they may also lose legitimate customers as those people get EMV cards with new account numbers, according to an Account Updater Trend report from Subscription Insider and Paul Larsen Consulting.
Account Updater is a service provided by Visa, MasterCard and Discover to help merchants avoid the loss of customers because of declined payment cards. American Express recently added the program in a beta phase.
The report analyzed transactions made by merchants that used the service, but also examined the reasons for declined transactions.
Starting five months ago in May, e-commerce merchants started seeing more declined charges because of more EMV cards getting into the hands of consumers in advance of the Oct. 1 liability shift, the report said.
"After analyzing why cards were being processed and tagged through Account Updater, we saw that from the 2013 and 2014 data breaches, up to 10% of cards were reissued and updated through the program," said Kathy Greenler Saxon, publisher and CEO of Subscription Insider.
The number of reissued cards decreased through the first part of 2015 at 1.2% to 3.1% of account numbers being updated, Saxon said. But the numbers have increased steadily each month as more EMV cards are issued, reaching issuance levels akin to those seen in the wake of the major breaches, Saxon added.
"We are expecting to see that skyrocket as we get into 2016," Saxon said. "If you look at the total number of cards, with more than 200 million credit cards and double that in debit and other payment cards, by 2017 all of these cards will be reissued."
That's a menacing number for e-commerce merchants that rely on subscription payments, Saxon said.
Essentially, e-commerce merchants need to "step up their game" in making sure that their payment gateway providers and processors are using the brands' Account Updater service and sharing that information, Saxon said.
The decision to completely change the numbers on new EMV cards is up to each issuer. Some will change the entire card, and others will change only the expiration date, Saxon said.
Not all issuers or merchants have converted to EMV despite the liability shift, after which the company unable to handle an EMV transaction assumes the liability for fraud.
The day before the official liability shift, Visa reported 151.8 million Visa chip cards have been issued, with about 90.4 million of those being credit cards. The Payments Security Force forecasts that 98% of cards in the U.S. will have EMV chips by the end of 2017.
Much of the pre-launch publicity surrounding potential problems with EMV cards has centered on restaurant tipping complications and the need for merchant and consumer education about how the cards work.
The potential for e-commerce merchants to endure some declined transactions because of new cards not being updated is a problem that should be solved quickly as the merchants become aware, said Thad Peterson, senior analyst with Boston-based Aite Group.
"My sense is that as things pop up, they will be fixed," Peterson said.
Because EMV penetration is fairly low at this point, it allows all industry stakeholders to monitor and address problems quickly, Peterson said. "We have kind of like a built-in beta test going right now [in the first phase of EMV]," he added.
Account Updater provides four types of updates to banks and payments providers who participate in the service. It updates account numbers, expiration dates, account closures, and opt-outs for those who choose not to participate in the program.
About 70% of U.S. banks participate in Account Updater, Saxon said. "So the merchant just needs to be sure if their bank or payment provider is participating and keeping card data updated."
When receiving a new EMV card, many consumers would be advised by the issuer to alert companies that draw recurring billing from their accounts.
But consumers are not always aware of those changes, nor do they pay close attention to the messages included in their issuer's mailings, Saxon said.
"The real message though is that not all gateways and platforms connect to Account Updater, and that is something that many merchants may not be aware of," Saxon said. "The world really changed on Oct. 1."