More than two years after the EMV liability shift, it remains unclear just how many credit unions have not yet completed their conversion to secure chip-enabled credit and debit cards.
Neither of the national trade associations nor NCUA track EMV conversion at a high level, meaning any estimates must come from card vendors themselves.
“There are roughly 6,000 credit unions in the United States and PSCU processes and represents roughly over 1,000 of them,” noted Art Harper, director of card payment solutions at PSCU in St. Petersburg, Fla. “I wouldn’t say we definitively are the standard in terms of the marketplace … but we are the largest CUSO for credit unions, so we do probably represent a substantial portion of that pool. Due to that, I would say the credit union industry as a whole has been more proactively issuing EMV cards than traditional financial institutions – i.e. banks.”
Harper said only about one percent of PSCU’s credit card clients are not currently live with EMV – fewer than 30 credit unions, he said – while on the debit side, PSCU has fewer than 100 clients left to convert.
CO-OP Financial Services, another major vendor of card processing services, could not say how many credit unions it provides with card services, but said about 600 clients are currently live with EMV with another 200 in the process.
Michelle Thornton, director of product development at CO-OP, suggested that across the banking industry adoption is likely at about 65 percent, adding, “I don’t think credit unions are any further behind than community banks.”
The credit union service organization CSCU has just under 2,000 member-owners, and Director of Payments Strategy Lou Grilli told CU Journal that about 75 percent of the CUSO’s credit card clients have reissued EMV-enabled plastic, along with about 50 percent of its debit card clients.
Grilli noted that EMV conversion actually has two different stages – enabling and reissuance. All CSCU credit card clients are EMV-enabled, he said, and all but about five credit unions on the debit side are EMV-enabled.
Why wait?
The purpose of the liability shift was to ensure that in the event of a data breach, the party involved in the transaction – whether merchant or financial institution – that was less secure would be liable for any losses. So why haven’t credit unions reached 100 percent adoption?
The consensus among most analysts was that those institutions that have not yet completed conversion to EMV are smaller credit unions, an assumption borne out anecdotally by many and specifically by a representative from Vantiv.
“We do not have [conversion rates] broken out by asset size, but at the end of [Q3 2017], 27 percent of our FIs had not started an EMV project to convert their card base,” Vantiv reps told CU Journal. “The majority of those clients are smaller, ‘community size’ clients.”
One thing that could be holding back some remaining credit unions from converting, suggested PSCU’s Harper, is the combination of higher-priority needs.
“Those that may not have chosen to do EMV initially, mainly it’s because of the fact that they are working on other, higher priorities,” he said. “Those I’ve spoken with in the past were working on priorities like a core conversion — that usually takes precedent. You don’t want to implement something on one platform and then have to move it to another platform, and then not have the ability to have that chip supported and have to do a secondary mass reissue.”
And smaller CUs may also have other factors at play in their decisions, he added.
“For a smaller credit union that is not part of a CUSO environment that can leverage the CUSO from a cost standpoint, [conversion] would probably be a little more challenging for them,” Harper said. “What we have seen is that a lot of member-owner credit unions have done different things to off-set the costs, such as brand flips, and within brand flips, may have moved out of platinum card issuance to things that provided higher interchange in order to offset that cost.”
Never-ending battle?
EMV cards carry a longer lifespan than traditional mag stripe cards, which – along with reducing the potential for fraud – was supposed to help reduce costs for issuers long-term.
But it hasn’t exactly worked out that way – at least not yet. The cards carry a lifespan of up to five years, but card fraud hasn’t gone down – it’s merely shifted from card-present fraud to card-not-present fraud. And for many FIs, the end result is still the same: reissuing consumers’ cards when incidents of fraud occur.
“These cards might have a longer lifespan, but breaches are negating that because [credit unions] are having to reissue card because of so many breaches,” observed CO-OP’s Thorton. “I don’t know if there’s going to be any material savings because of the longer life of the card; I think the savings will be in less card-present fraud.”
CSCU’s Grilli added that some fundamental changes are taking place, but they’re happening slowly because they take time and cost money.
“As more chip cards are reissued, the chances of counterfeit cards decrease,” he explained, adding that increases in tokenization will further secure consumers’ payment information. “As far as reissues down to zero, we won’t be there in three or four years—[CUs are seeing] decreasing reissuance and decreasing usefulness of the data that is breached, and hopefully that will drive costs down for the issuers.”
PSCU’s Harper, however, countered that cost savings from extended card lifespans could begin to show up within the next 18 months, adding that many CUs have already seen savings as card-present fraud has gone down.
“Last count was, due to EMV, around $7 million that PSCU has been able to save from a fraud perspective from an EMV transactional savings,” he said.
Still, reminded Thornton, fraudsters haven’t exactly stopped trying.
“For everything we come up with, they’re coming up with ways to break it,” she said. “Certainly card-on-file tokenization for online merchants is helping or will help – any tokenized payment is a big help. I use Apple Pay as often as I can; I see it as being more secure. I think all of those things will help, but it will continue to be a battle we fight every day.”
