Don’t be surprised if some merchants look a bit uneasy Thursday. Millions are missing the Oct. 1 deadline to be ready for credit cards with microchips in them.
It means they’ll start absorbing some of the losses from transactions that involve fake cards.
“I know there’s a lot of them out there that are not anywhere near ready,” said Ed Thomas, a Kansas City area account executive for Central Payment, which sells payment systems to retailers. “There’s a lot of holes in the deal I can tell you, from being on the firing line.”
Consumers also will notice that few — and maybe none — of their own cards contain these fraud-fighting chips.
In short, America has a lot of work to do before it’s chip ready and catches up with Europe, Canada, Brazil and other places.
The merchants’ deadline is getting lots of attention, but no one expected all U.S. credit card transactions to involve chips by now anyway.
By international standards, America might be doing all right despite the late start.
Other countries have taken two or three years after their merchants’ deadline dates before chip cards used at chip-ready retailers reached 60 to 70 percent of transactions, said Stephanie Ericksen of Visa. It has taken them four or five years to top 90 percent.
“The pace we’ve seen, the (chip card) issuance we’ve seen and the merchant adoption that we’ve seen is actually very much on track compared with what we’ve seen in other markets,” Ericksen said.
Switching takes years because it involves thousands of U.S. banks and big retailers that issue cards and millions of payment terminals at the checkout stands of retailers.
By Visa’s latest count, only 301,000 “merchant locations” with chip-ready equipment had seen a customer use a chip card through the end of August. The total is expected to escalate as more cards reach more consumers and more retailers update their systems.
Because the transition moves slowly, Oct. 1 amounts to just another shopping day for consumers. Their cards — with and without chips — still work anywhere cards are accepted. That’s because chip cards also come with the magnetic stripe that is on the back of traditional cards, and chip-ready retailers still can accept old cards without any added risk of losses.
Moreover, consumers are not losing any of their fraud protections, such as the ability to challenge fraudulent transactions on their cards.
Chipping away at fraud
Chip cards are aimed at stopping fraud from counterfeit credit and debit cards.
Crooks have figured out lots of ways to steal the information stored on the magnetic stripe on the back of traditional cards. It’s easy at that point to make fake cards and go to town.
The microchips in newer cards deliver the same account information as the stripes. But chips protect the information by hiding it behind a unique code that the chip changes with each transaction. No chip, no code, no transaction. And crooks haven’t figured out how to counterfeit the chips in cards after many years of use in Europe.
Estimates vary on how far along U.S. card issuers are in getting chip cards in customers’ hands. Visa cites surveys that found 56 percent of consumers have at least one chip card in their wallets. CreditCards.com cites surveys that found more than 60 percent have no chip cards.
“We’re getting them out the door as quickly as we and the customers can tolerate,” said Carl Bradbury, executive vice president of consumer card products at Commerce Bank.
The bank is targeting its customers who are most likely to become targets of fraud, which includes frequent users of debit cards. Others are getting cards when their old ones expire.
UMB Bank has begun issuing credit cards with chips in them but hasn’t started issuing debit cards with chips. All UMB cards will have chips by mid-2016, said John Gillard, executive vice president of payment card solutions.
Visa said more than 141 million of its chip cards, like those issued by banks, were in U.S. consumers’ hands at the end of August. That’s up from fewer than 20 million a year ago and more than in the United Kingdom or Brazil, where chip technology is common.
But it is only 18 percent of all Visa cards.
By some estimates, perhaps 70 percent of credit cards and 40 percent of debit cards will have chips in them by year’s end.
Chip card ready
Thursday’s deadline is about the other side of credit and debit card transactions — the places that accept them.
Merchants have roughly 10 million or so point-of-sale terminals where shoppers have gotten used to swiping traditional cards. Retailers have been updating these machines to handle chips.
Walmart, Target and Home Depot, for example, say they’re chip card ready. And many smaller retailers are too.
That means they can handle any card using EMV technology, named for the big card networks that set the technology standards, specifically EuroPay, MasterCard and Visa.
Customers of the Town-Topic Hamburgers on Broadway have helped make sure the iconic downtown Kansas City hamburger and breakfast stand is chip card ready.
When it’s time to pay, many customers set their drinks on the counter above the register. Too close to the edge and — spill — store owner Scot Sparks has to replace his credit card machine.
And Sparks’ card reader from the payments processing company makes sure he’s running the cards the right way.
“Their machine won’t even let you swipe a chip card,” Sparks said between the breakfast and lunch crowds last week. “We’re safeguarded there.”
Being chip card ready safeguards retailers from the losses caused by counterfeit cards, said Chris Lee, head of the U.S. operations of Moneris, a Canadian company that sells payments equipment and software to merchants.
Traditionally, card issuers like banks have been on the hook for that fraud. Under the new rules, the fraud loss falls on whichever party kept the transaction from being a chip card transaction.
Card issuers still are on the hook for fake-card fraud when the customer uses a traditional stripe card, regardless of whether the retailer is chip ready.
The change Thursday puts the retailer on the hook for fake-card fraud when he uses the traditional magnetic stripe on the back of a chip card. It’s an incentive to get chip card readers into use.
Until recently, estimates held that “a little less than half” of the card readers in the U.S. would be chip ready Oct. 1, Lee said. As the date has approached, she said, estimates have gone down.
Lee estimates around 40 percent of registers will be chip card ready by the end of this year.
Some shops have put off the transition because they believe it is unnecessary. Card counterfeiters typically hit big-box retailers, where they can buy expensive electronics to resell, or automated teller machines, where they can grab cash directly.
They’re not likely to score big at a dentist office or hamburger stand, Lee said. And while these merchants eventually will switch to chip card readers, there is no rush.
Learning to shop
Consumers also need to learn how to use chip cards.
Cardholders will know a chip card because they can “see” its chip. It’s a small metallic square on the front of the card just above the card number. This is the contact point between the chip inside the card and the card reader.
Instead of swiping the card, consumers insert the chip card into a slot at the front of the reader. The card has to sit in the slot for several seconds while the transaction is approved and completed.
Shoppers might be tempted to insert the card and promptly pull it out, which is how many ATMs and gasoline pumps currently read the magnetic stripes on traditional cards.
The machine will prompt the card owner for a signature or a personal identification number, or PIN, to verify the transaction, and when it is done and OK to remove the card.
The industry still is wrangling over whether to require customers to remember a PIN for each of their cards. A PIN makes the card more secure because thieves would need to steal the PIN as well as the card. A stolen chip card that works with only a signature is ready to abuse.
Chip cards, even with PINs, won’t stop all credit and debit card fraud. They’re aimed at counterfeit cards used at the point of sale.
Increasingly, however, consumers are shopping online in what the industry calls “card not present” transactions. A website asks for the account number, some additional information such as a billing address and the three-digit security number on the back. Chips and stripes don’t enter into these transactions.
And it’s why experts expect fraudsters who have been counterfeiting cards to turn more of their efforts toward online card fraud.
“We’re doing a lot to fix that fraud too, while we’re at it,” Commerce’s Bradbury said.
Mark Davis: 816-234-4372, @mdkcstar
Comments