Technology may be a solution to domestic payment card fraud

By Andy Williams, Associate Editor, Avisian Publications

Like a massive tidal wave, EMV continues to roll across the world, changing the global payments landscape. Since UK banks first committed to EMV five-years ago, more than 100 countries have taken the plunge in efforts to stem credit card fraud.

But the U.S. has always remained outside the EMV plan. This, however, may be changing as fraud, technology and business is changing the payments landscape.

Brian Byrne, head of product technology for standards and specifications at Visa estimates there are some 730 million EMV cards and 10 million terminals in existence around the world.

Toni Merschen, group head of chip at MasterCard Worldwide, notes that the Single European Payments Area initiative requires 38 countries to complete the migration to EMV by Jan. 1, 2011.

EMV gets its name from the companies which originally created it, Europay, MasterCard and Visa. Seven years ago Europay merged with MasterCard and the new standards body was renamed EMVCo. Its members now include Visa, MasterCard, Japan-based JCB and its newest member, American Express.

EMVCo’s primary goal “is to facilitate global interoperability and compatibility of chip-based payment cards and acceptance devices through deployment of relevant EMV Specifications,” says an EMVCo spokesperson.

EMV also goes by “chip and PIN,” because the card contains a chip and a PIN is required before a transaction is processed. But nowadays, that chip and PIN moniker may be misleading. As Byrne, points out, many countries are foregoing the PIN part of EMV implementation, the predominant reason being that many consumers don’t want to remember a PIN.

The country most advanced towards EMV implementation is the UK, the banks their were the first to adopt chip and PIN, says Merschen. Other markets that have reached maturity for EMV migration on either cards, point-of-sales devices and ATMs include France and Turkey in Europe and Malaysia in the Asia-Pacific region, he adds.

The migration isn’t easy. Merschen says a number of infrastructure changes are required to handle EMV. “For issuers, there are new data elements that need to be supported by the issuer authorization and clearing host systems. Card data preparation, including key management, and card personalization also require hardware and software upgrades,” Merschen says. “On the acquiring side, the impacts are similar. Acquirer host systems must be able to receive new data fields from terminals, which also need to be upgraded from both a hardware and software perspective.”

Glitches all but resolved

In the early days of EMV there were issues, Merschen says, such as a shortage of approved products, lack of customer and vendor expertise with EMV and areas where the specifications left implementation options.

That was then. These issues from the early days of EMV have largely been resolved, says Merschen. “Robust migration processes are available to guide the banks, merchant, and consumers in their migration involvement,” he adds.

Visa’s Byrne describes the early road bumps as minor. “This card issued in country A was having some acceptance problems in country B. In some cases, some of the older terminals wouldn’t work properly, but that was usually due to configuration issues, fairly minor stuff.”

EMV in the U.S.?

So with the U.S. sandwiched between two EMV countries–Mexico and Canada–most think it’s only a matter of time before the U.S. joins the EMV parade.

Paul Beverly, president of Gemalto North America, believes increased fraud will mandate such changes.

In an article in the spring 2009 issue of Regarding ID magazine, Beverly wrote: “The rest of the world is well on the way to EMV implementation. Europe and Asia have long been issuing cards and … Latin America, faced with exploding credit card skimming fraud, is fully committed to EMV smart cards. .. Yet stakeholders in the United States still find fraud losses and identity theft risks acceptable. It is disappointing that U.S. companies are trailing the rest of the world in this area.”

Charles Walton, executive vice president for payments for INSIDE Contactless, believes that the U.S. will ultimately get on board with the secure cards. “We’re seeing inherent insecurities in the system, such as the Heartland Payment Systems hack. It’s only a matter of time before these types of hacks will become intolerable.”

Walton says hackers will look at the weakest point in the payment chain and exploit it. “If you start securing one point in the chain, it begins to expose the other points, the path of least resistance for water, will find the lowest point.”

MasterCard’s Merschen says that these fraud migration and data compromise incidents, plus the possibility of government regulation will lead several U.S. banks to consider EMV.

The handwriting is on the wall, so to speak. “It’s inevitable that the U.S. migrate to EMV, primarily because fraud is escalating,” adds Randy Vanderhoof, executive director of the Smart Card Alliance. “Major financial institutions in the U.S. are also international so it will not be a big step for them to issue these cards in the U.S.”

Contactless and EMV

At first blush it would seem that contactless and EMV would be working toward opposite purposes, but Walton says EMV can run on top of contactless. “I would think of EMV as a security protocol that works with contactless as well as contact chips.”

Visa is using EMV specs in its contactless payWave technology, Byrne says. “The way we’re deploying contactless in the U.S. is using EMV specs,” says Byrne. “It’s based on EMV technology making use of strong security elements baked into EMV. These new cards will not only be accepted in readers in the U.S. but also in the UK.”

The next generation of contactless cards will be a step toward EMV, says Vanderhoof. For example, MasterCard terminals certified for contactless also carry elemental portions of EMV. “We’re seeing these gradual upgrades of the infrastructure to support it,” he says.

Vanderhoof says these new rules for EMV contactless are different than those for EMV contact cards. Purchases under about $25 can be a contactless transaction in the UK, just like in the U.S. “Just tap it and go, no PIN or signature. After a certain number of transactions you might be required to enter your PIN.”

EMV vs. contactless overseas

While EMV and contactless will have to coexist in the U.S., it’s not that simple where’s there’s already an EMV infrastructure in place. “Europeans have a lot invested in EMV,” says Urs A. Lampe, vice president, product marketing and new business for contactless smart card provider LEGIC Identsystems, in Switzerland. “Now contactless is happening and the EMV installed base is all on contact, so you’ll probably see some swapping out of terminals in the next few years.”

Or they could opt for integrated contactless readers or readers that are configured to accept contactless peripherals, adds Byrne.

Another solution is dual interface products in which a single chip can communicate in contact or contactless mode. INSIDE will be bring the Micropass 6002, a dual interface chip to market in the fourth quarter of this year, Walton says.

Merschen adds that a number of markets, such as Canada, the UK, France, Malaysia and Taiwan, have already embraced dual interface solutions, running both EMV contact and contactless transactions using one single chip. “Some banks have clearly stated that contactless will be a standard feature for many of their portfolios,” he says.

Canada, Walton says, is an interesting market because 10 million contactless chip cards have been deployed. He projects that by the end of the year, dual-interface cards will make an appearance there. “We’ll be seeing use of chip-based cards in the U.S. for security reasons. The buildup of EMV in Canada will tend to cause fraud to migrate to the U.S.,” he adds.

But there’s no getting around that the purposes of EMV and contactless can be at odds. “EMV certainly brings about much more security and flexibility to today’s mag-stripe cards,” Merschen says. “While contactless brings transaction speed and cardholder convenience.”

In the U.S. it may come down to a question of speed versus security. As retailers transition to newer payment terminals it will be up to the card issuers on whether or not to deploy EMV and put a safeguard in place to help stem the tidal wave of payment card fraud.

---

EMV definitely works, but…

Latest card fraud losses reported by APACS, the UK payments association, show EMV does work, but it’s not a cure all. Certain types of credit card fraud will require other measures.

While 2008 fraud loss figures totaled about U.S. $902.5 million the two main areas of fraud were on transactions not protected by chip and PIN: Internet, phone and mail order fraud, and fraud abroad committed by criminals using stolen UK card details in countries yet to upgrade to EMV.

This second fraud type has nearly doubled in two year, providing more ammunition to those pushing the U.S. to become EMV compliant.

Phone, Internet and mail order fraud (card not present) accounted for more than half of those losses at U.S. $485.9 million, just a 13% increase over 2007 losses but is double the losses suffered in 2004.

Counterfeit card fraud increased 18%, to about U.S. $250 million. But that’s down from the 46% increase reported in 2007. The vast majority of this fraud is due to criminals stealing card details in the UK to make counterfeit magnetic stripe cards for use in countries yet to upgrade to chip and PIN, says APACS.

“The industry continues to apply pressure on those countries, such as the U.S., where chip and PIN has still to be rolled out,” the APACS report adds. “Increasingly effective use of intelligence systems and the ongoing global rollout of chip and PIN have contributed to this slowdown.”

Although card fraud losses have increased, losses as a percentage of plastic card turnover amounted to just 0.12% in 2008, equaling about a tenth of a penny lost to fraud in every dollar spent. This, too, reflects EMV’s “positive effects as well as the fact that we continue to use our cards more and more each year,” says APACS.

As to card not present losses, that can happen with or without EMV. More retailers, APACS notes, need to encourage cardholder and retailer use of the secure codes found on the back of most credit cards.

However, one area where EMV is still vulnerable is with ID theft. Card ID theft losses have increased by 39% where criminals take over the running of another person’s credit or debit card. This fraud typically involves a criminal obtaining a genuine card and a genuine PIN, and has contributed to the fraud increases seen at UK shops and cash machines, APACS says.