At the joint Smart Card Alliance annual meeting and CTST conference last week, the Smart Card Alliance Latin America (SCALA) says rapidly rising fraud rates due to skimming of magnetic stripe credit cards and shifts in fraud liability are fueling the migration of Latin American banks to smart cards based on the EMV standard.
An important change in the Latin American market is the chip liability shift program that protects the party that has upgraded cards or terminals if fraud occurs, according Kim Hangoc, vice president de Gesto de Produtos do Centro de Excelncia for MasterCard Worldwide. The program is across all of Latin America and has to do with liability for fraudulent transactions based on skimmed and cloned magnetic stripe cards.
After January 2005, if a cloned magnetic stripe from a chip-enabled card is used on a non-chip enabled merchant payment terminal, the acquirer is liable for the loss. If a skimmed magnetic stripe card is used in a chip-equipped terminal, the issuer is liable for the loss. Additionally, a domestic liability shift recently went into place in Brazil in March 2008, and is planned for October 2008 in Mexico and July 2009 in Venezuela.
The banks in Brazil are in the middle of mass deployment, mainly motivated by fraud, Hangoc said. They are using chip cards and requiring a PIN for purchases, for both debit and credit cards. In Mexico the main motivation is not fraud but differentiation, and no PIN entry is required for purchases.
Also the first MasterCard PayPass contactless card using the EMV standard were launched at the end of 2006 in Mexico. Banks in Colombia, Venezuela and Peru have started issuing and are in various stages of testing or implementation. Banks in other countries in the region haven’t started issuing yet but are preparing, he said.
In Brazil skimming and cloned card fraud grew at a 43.5% compound annual growth rate between 2004 and 2006, according to Mario Mello, superintendente executivo de cartes, Banco Real ABN Amro. His bank has already issued 2 million smart bank cards and plans to double that number this year. One big plus for customers is that if the stripe on a chip-equipped card is skimmed, Banco Real can block magnetic stripe transactions on the card, but let the customer continue to make chip transactions until the card is replaced.
More than 3,000 clients per month benefit from this service, improving customer satisfaction, he said. Also the bank generates U.S. $12.5 million per year incremental revenue from this service alone. Mello estimates that 28% of point-of-sales terminals in Brazil have chip readers now.
Banrisul, a large bank in southern Brazil issuing EMV cards, has cut its fraud losses at chip-enabled merchant terminals to zero, according to Jorge Krug, senior IT security executive. Cloned card fraud on chip-enabled cards is also zero, he said. In addition, Banrisul has cut its Internet shopping fraud to zero on its chip cards, because the bank implemented a “card present” PKI application for online payment for its customers.
In addition to the Banrisul issued certificate for online banking, customers can obtain and use PKI credentials with Brazil’s national public key infrastructure, ICP-Brasil. ICP is the acronym for PKI in Portuguese.
Mauricio Coelho, director of PKI for Instituto Nacional de Tecnologia DA Informacao (ITI), said ICP-Brasil has already issued 2 million digital certificates. The credential can be used for legally valid digital signatures for conducting high value Internet transactions and certifying electronic documents such as tax returns and payments; judiciary proceedings; credentials for doctors, dentists and other professionals; registry/notary signing; and other applications.
As an indication of the potential for PKI in Brazil, there are 10 million citizens every day in Brazil’s 15,000 registry offices. By 2011, 1,000 of these offices will be working with digital certificates, Coehlo said. ITI is a federal organization and is the root Certification Authority for ICP-Brasil.
Mexico is also migrating to smart cards with the liability shift effective on October 1, 2008, said Carlos Avila, operations executive director at Banorte. Banorte has issued 700,000 EMV credit cards out of a total of 1.3 million, and has equipped 30,400 of its 33,700 merchant terminals with chip, Avila said. The rest of the merchant terminals will be upgraded by year end.
He estimates that of the 16 million credit card accounts at six leading banks in Mexico, 6 million have been upgraded to chip. The focus is on credit accounts, not debit, since the majority of debit accounts are used for cash withdrawals and not merchant payment, he said.
The Latin America track conference was organized by the Latin America chapter of the Smart Card Alliance. The chapter is building an industry alliance for collaboration, contributing to the accelerated use of smart card technology in the region.
More information can be found at http://latinamerica.smartcardalliance.org.