-
Retailers will no longer be easy pickings for cybercriminals once chip-and-PIN technology is widely adopted. All well and good, but bankers fear hackers will redirect their energies to infiltrating banks.
December 24 -
An executive order signed by President Obama on Friday that mandated the adoption of chip-and-PIN technology in government cards and enabled its use in facilities like post offices smacks of politics over substance, analysts said.
October 17 -
Bank of America plans to issue chip-based debit cards to customers next month, signaling a resolution of the long-standing issues plaguing EMV debit card issuance in the U.S.
September 30
The addition of tougher anti-fraud technology to credit and debit cards has banks walking a fine line.
On the one hand, the new EMV technology should reduce data breaches and fraud that eat into the bottom line. On the other hand, EMV is expensive and it is difficult for some banks to digest that cost in one fell swoop. But if they try to spread out those costs over time, they leave themselves exposed to greater financial liability in the interim.
The issue comes to a head in October. That's when the liability for counterfeit cards shifts under card network rules. If fraud occurs, the company that has not adopted EMV technology (EMV stands for EuroPay-MasterCard-Visa), either the bank or the retailer, takes on greater liability for losses connected to the fraud.
Plenty of institutions have not fully implemented the EMV technology, and some say they will not be ready by October. Many small banks cannot afford such a large expense in one quarter, said James Sills, chief executive of the $289 million-asset Mechanics & Farmers Bank in Durham, N.C.
"Your income statement can probably handle it better if you spread it out, rather than do it all it once," said Sills, who is also a former chief information officer for the state of Delaware.
Banks are not required to adopt EMV cards, but the largest U.S. financial institutions have publicly committed to adopting the new standard, representing about 80% of all credit and debit cardsin the market, according to the EMV Migration Forum, a trade association of banks, retailers, payment processors and other companies involved in the transition.
Aite Group, a consulting firm in Boston, estimates that about 70% of credit cards and 40% of debit cards will be EMV-enabled by the end of the year. EMV will dramatically help banks reduce fraud, said Julie Conroy, research director for retail banking at Aite Group.
"As issuing banks get EMV-capable chip cards in the market, those cards are very effective at getting rid of counterfeit-card fraud," Conroy said.
Counterfeit cards cost the banking industry about $3 billion per year "and EMV gives us the ability to wipe that off the map," Conroy said.
Costs associated with EMV are significant, even if a bank opts to spread out the pain. The $139 billion-asset Fifth Third Bancorp in Cincinnati estimates it will spend about $15 million on EMV upgrades in the second half of 2015. Fifth Third declined to provide cost estimates for its full EMV upgrade.
Each card embedded with an EMV chip costs between $3.50 and $4, Sills said. Banks must also upgrade ATMs so they can accept the cards, a process which Aite Group estimated will cost between $2,000 and $3,000 per machine.
The danger involved with not being fully EMV-compliant by October is that it exposes a bank to greater liability from October until all cards and ATMs are upgraded, said Charles Bradley, senior vice president for consumer planning at Fifth Third. The bank has developed a rollout schedule that first converts those cards with the highest transaction volume.
"We'll go first with our highest spenders and international travelers and then move through the rest of the portfolio when we can," said Jim Bell, senior vice president of card services at Fifth Third. "We expect to be nearly entirely migrated by the first quarter of 2016."
The $17 billion-asset First National Bank of Omaha in Nebraska, which has about 4 million credit cards in circulation, is taking a calculated risk by not fully upgrading by October, said Mihaela Kobjerowski, vice president for consumer marketing. Since less than half of all merchants' terminals will be EMV-compliant by October, the chance of First National being subject to fraud is lessened, she said.
As an added benefit, First National will be able to get a better sense of how the system will work by waiting, she said.
"We wanted to do it gradually to have a chance to observe consumers' behavior and learn from it," Kobjerowski said.
Even though First National will not be fully EMV-compliant by October, the bank considers itself "a bit ahead of the industry curve" in terms of implementation, Kobjerowski said. As of February, about 34% of First National's cards are upgraded to EMV, compared to the company's internal estimate of 17% for the industry. First National estimates that about 55% of its credit cards will have EMV by October, and 70% by the end of the year.
The $4.4 billion-asset Sandy Spring Bancorp in Olney, Md., also won't be fully ready for EMV by October, said John Sadowski, chief information officer. Sandy Spring is working with its primary vendor, FIS, to start replacing its 61,000 credit cards in July. Sandy Spring could have introduced the new cards earlier, but there was no good reason to accelerate the rollout, he said.
"The liability shift in October is really the pivot point for us," Sadowski said.
Banks have the option of making their EMV cards either chip-and-signature, in which a customer signs for a purchase, or chip-and-PIN, which requires a four-digit code when purchases are made. Sandy Spring is leaning toward having chip-and-PIN cards, although a final decision has not been made, Sadowski said.
An additional danger for banks that are not EMV-ready by October is damage to their brand names, said Gil Mermelstein, managing director in the banking practice at West Monroe Partners.
"There is reputational risk of being perceived as not safeguarding the security of customers," Mermelstein said. Hackers may also try to target the cards of bank issuers that have not adopted EMV by October, he said.
But it is a good thing for many banks to gradually delay EMV implementation for other reasons, Mermelstein said. Replacing all cards at once could overwhelm some banks' call centers. Plus, there is a cost savings by waiting until cards expire before replacing them, rather than conducting a mass replacement of all cards.
The high costs of upgrades notwithstanding, some bankers expect the adoption of EMV to help fight fraud, even if it is not a quick fix.
"The EMV technology is a lot better than the magnetic strip, which has stagnant data on it," Sills said. "The chip card has dynamic data. You'll see a corresponding drop in fraud, but it will take time. It's not going to be an overnight situation."
