The EMV Migration Carries Security Risks
As U.S. issuers and financial institutions prepare for the shift to EMV, two significant benefits over traditional magnetic stripe cards are clear: increased security and reduced incidences of card fraud. However, the migration itself poses risks that must be addressed.
Only a handful of U.S.-based financial institutions have begun providing chip-based debit cards to select customers, very few of the largest issuers have begun offering EMV credit cards and its estimated that a low percentage of U.S. ATMs are capable of processing an EMV card transaction.
For forward-looking financial institutions, expediting the move to chip-enabled cards will be vital to curtailing ATM skimming, card fraud, network hacks and retail point-of-sale fraud, all of which are expected to continue to rise in next year. But financial institutions must approach the EMV migration with caution, as serious risks remain. Institutions should expect increasing fraud pressure during the transition period as criminals attack the weakest points, such as issuers who have not moved to EMV cards and merchants who have not upgraded their terminals. This will require a specific authorization strategy, segmenting transaction activity between EMV and magnetic stripe cards. This strategy will continue to be useful for other markets around the world which are further behind the U.S. in their EMV terminal migrations.
Once the migration is complete, security will improve. Whereas a magnetic stripe delivers static data to the terminal, an EMV chip and an EMV-capable terminal interact dynamically, in real time, using more sophisticated encrypted authentication technology. As a result, chip cards provide better protection against ATM and card skimming fraud losses. However, a magnetic stripe will be on all EMV cards as a fallback for non EMV terminals and countries. Ultimately the complete EMV migration will eliminate the risk of fraud due to skimming for EMV compliant countries.
With debit card fraud losses eclipsing credit fraud losses in recent years, ATM and card fraud has become a key area of focus for risk and compliance officers at banks, who must address the increasing sophistication of financial criminals. Much of Europe has already moved to chip cards, so a U.S. migration would reduce the current gap in compliance and ease risk exposure concerns, especially for institutions with a global presence. Chip cards provide greater authentication capabilities than magnetic stripe cards and, at the same time, reduce the liability of merchants and providers for chargebacks. Additionally, most POS system manufacturers today have incorporated chip capabilities into their sales terminals.
While levels of physical card fraud are expected to decrease over time, banks are at risk for rising fraud rates in other areas: check fraud, first-party fraud and advanced synthetic identities are examples of financial fraud that could increase with widespread EMV adoption. To counter these threats, banks must re-examine their fraud prevention techniques and capabilities, and constantly update their anomaly detection systems. A comprehensive fraud detection and prevention strategy is a necessary and worthwhile investment.
For issuers and countries that continue to use magnetic stripe cards, the potential for increasing levels of card fraud is a clear risk. To best manage this complex and changing landscape, financial institutions should plan to leverage the benefits of chip-based cards and control the associated investment by taking a practical, transitional approach to the inevitable migration to EMV.
Mike Urban is director of financial crime management solutions at Fiserv