Jason O’Brien, SVP of Payments, SWBC Financial Institutions Group
Financial institutions have steadily rolled out new credit and debit cards with EMV chip technology over the last two years to the tune of 462 million cards as of September 2017. EMV—or Europay, Mastercard, Visa, the developers of the chip technology—was created to help reduce card fraud, which was a growing threat every year.
Card fraud, in the shape of duplicating a person's card data located on the magnetic strip on the back of the card, was/is a relatively easy thing to do. With the right equipment and a little know-how, a criminal could quickly and easily capture someone's information at ATM or merchant locations with card skimmers. It's a practice that continues to rise in frequency. A recent FICO report found that the number of compromised U.S. ATMs and merchants rose 39% in the first six months of 2017, compared to the same time in 2016.
The belief is, because of the advent of EMV technology on more and more cards, scammers are finding weaknesses at gas stations and merchant locations who haven't converted over to chip-enabled card readers. The National Association of Convenience Stores (NACS) estimates that it will cost the industry an estimated $4 billion to replace card readers–and in some cases–completely replacing pumps and system hardware and software. The benefit, however, is that card terminals will be more difficult to hack. It's a move in which Visa and Mastercard say will overall better protect consumers, companies, and banks.
Why are gas stations an important piece of the card fraud prevention movement and why should your financial institution pay attention? Visa and Mastercard have given the deadline of October 2020 for gas stations to make the switch from magnetic strip card readers to EMV readers at the pump. Gas station operators who don't meet the deadline have the potential for penalties; as the liability of fraudulent charges transfers from financial institutions to gas station operators who don't make the conversion in time.
How Does it Work?
To better understand why EMV is not going to solve all our card fraud problems, its best to understand how EMV chips work. Basically, when you "dip" your chip-enabled card into a reader to make a purchase, the chip essentially communicates in a language that the chip reader understands. The communication being sent contains your account and card information but is hidden behind a crypto key to help protect against fraudulent charges.
If someone were to hack into the card terminal to retrieve transaction information and use it to make other illegal purchases, the criminal would not be able to make any purchases. That's because the key that the EMV chip sent to the card terminal at the store is a one-time use code. So as soon as the code is generated and used to validate the purchase, it's no longer valid and your information is secure.
This differs from magnetic strips on cards where all the information is essentially stored on the same technology that was used to put music on cassette tapes back in the day. The information on magnetic strips is static, not dynamic like the EMV chips. So if that same crook from before hacked the terminal where you used a card with a magnetic strip and pulled all the transaction data, your personal and bank information would be exposed as there's no key protecting the data.
Is EMV a Panacea for Card Security?
No, and here's why. EMV technology protects from scenarios as a described above. However, it doesn't stop a criminal whose stolen a wallet or purse. They could essentially take the card and make purchases just as you would and there's nothing to stop them. Other than the victim calling their bank or credit union and canceling the card, which many financial institutions now offer as a self-service option via a smartphone app, there are no other authentication protections currently available in the U.S.
With 55% of U.S. storefronts now accepting EMV cards, data from a VISA USA Infographic show that counterfeit fraud dollars have dropped by 66% for merchants who have completed the upgrade to chip card readers. The hope is the trend will continue, especially as gas station operators convert their pump card readers.
Future of EMV
In Europe and abroad, magnetic strips on cards are rarely used. EMV chip technology has become the new standard and the U.S. is making progress to follow. Additionally, overseas customers use a PIN number with their chip cards. This adds another level of security that could one day make it to the U.S. The PIN number is the layer of security currently missing from cards in the States. This level of protection would help to significantly reduce fraudulent charges on stolen cards. Because even with a stolen EMV card, it would be useless without the associated PIN number for in-person transactions. Further developments in transaction security mean that future EMV transactions used as card-not-present (CNP) could require additional authentication means, according to the PCI Security Standards Council.
Card security is improving. And an increase in security benefits financial institutions who hold most of the liability for reimbursing stolen and counterfeited cards. In just two and a half short years, we'll see how great of an impact updated card readers at gas pumps have on card fraud.
The payments industry is continuously evolving. For additional information on the current state of payments and regulations, download our new ebook, Meeting Consumer Self-Serve Payment Demand.