The growing adoption of contactless payment cards in the United States could open the door to a more fraud-resistant — and until now, expensive — security format that has taken off almost everywhere but here.
U.S. issuers have shown steadfast resistance to the Europay, MasterCard, Visa security standard, which uses cards with embedded chips and requires cardholders to enter PINs to authorize transactions at the point of sale.
Though executives generally agree EMV offers improved security over standard magnetic stripe cards, they also say banks and merchants here have little interest in footing the bill to distribute cards that feature the chips, or installing the necessary readers at the point of sale.
Contactless payment cards, however, could make the anti-EMV argument obsolete, payment executives say.
"There's no reason we can't support all the cardholder verification methods we have today," including EMV, using contactless cards, said Simon Pugh, the head of MasterCard Inc.'s worldwide global center of mobile excellence. "If you look at the technology, it's easy. If you look at the business processes and how you introduce it in a controlled and global fashion, it will require some thought."
Mr. Pugh said that the technical specifications of contactless and EMV are closely aligned; both formats define the way a card communicates with a card reader. For EMV, the readers access data stored on the chips in the cards to verify that the cardholders are entering the correct PINs. For contactless cards, the chips transmit the card account number to the reader using wireless technology.
Mr. Pugh said MasterCard helped develop both payment standards, and that the contactless format was designed to work with EMV. "It builds upon EMV technology."
He said there is no technical reason the chips in a contactless card cannot also store a PIN that could be used to authenticate cardholders.
In fact, Mohammad Khan, the founder and president of Vivotech Inc., a provider of contactless payment terminals and software, said both use the same basic components. Contactless uses "the same card, driven by the same chip" as EMV, he said. "But it has a transmitter in it as well."
Mr. Khan said that as more and more countries switch to EMV, criminals will shift more of their energy to the United States, where the mag-stripe infrastructure is easier to circumvent.
"The U.S. as a country is open to attack. The fraud people always move toward the weakest point," Mr. Khan said. "Every other country in the world has a deadline to move to EMV. I believe the industry needs a deadline in the U.S. as well."
Jeff Hale, the chief marketing officer of the New York payments software company ACI Worldwide Inc. , agreed. "Virtually every major market in the world is adopting EMV on some time line, except the U.S.," Mr. Hale said. "Where do you think the fraud is going to go?"
EMVCo LLC, the trade group that administers the security standard, said that EMV is in use, or being tested, in Europe, Asia, Latin America, South Africa, and Canada.
Canadian payments companies have been testing EMV in that country since 2007. In October the Canadian debit network Interac Association, along with MasterCard Canada Inc. and Visa Canada Association, announced plans to shift Canada's entire card acceptance infrastructure to EMV.
The conversion project is expected to run through 2015, but the companies said they expect the majority of Canadian debit cards and automated teller machines to support the EMV format by next year.
EMVCo, in an October 2007 white paper, has already tackled the question of delivering EMV with contactless cards.
In countries that use EMV, people can initiate purchases with contactless payment cards without inserting the cards into the reader or entering their PIN, but only for small transactions. In Europe, for example, the limit is typically 25 euros; for larger transactions, people must insert their cards and enter their PINs.
Mr. Pugh said this limit is a policy decision made by EMVCo, to accommodate the improved speed and convenience of contactless cards, "not a limit imposed by the technology."
That approach is similar to rules in the United States that permit people to use cards for some small purchases without a signature. Mr. Pugh said he could envision an EMV environment here, based on contactless cards, that requires people to enter a PIN for purchases above a certain threshold.
Still, some observers are highly skeptical that EMV will catch on in the United States.
"The U.S. is going to adopt EMV in about the same way the U.S. adopted the metric system — somewhere between kicking and screaming and not at all," said Ed Kountz, a senior analyst at the technology research company Forrester Research Inc. of Cambridge, Mass.
The cost of card fraud is not great enough to justify the expense of changing the enormous card-acceptance infrastructure nationwide, Mr. Kountz said. "It doesn't seem to have hit a tipping point where it's impossible to bear."
Kevin Gillick, the executive director of GlobalPlatform, a trade group for the smart card industry, also voiced doubt that contactless technology would open the door to EMV in this country, at least in the near future.
"America is not going to be moving to EMV, not anytime soon. The current infrastructure is considered secure enough and fraud losses are written off as a cost of doing business," Mr. Gillick said.
But the growing adoption of EMV in other markets, especially Canada and Mexico, is likely to put more pressure on merchants and card issuers here, Mr. Gillick said.
"It is my belief that fraud from Canada and Mexico will redirect itself, resulting in increased fraud into the United States," Mr. Gillick said. "Will they continue to write it off as a cost of doing business? At what point will fraud loss in the United States be painful enough to justify migration to EMV?"
Several major issuers and credit card networks either declined to discuss their views on implementing EMV or did not respond to inquiries, including Bank of America Corp., JPMorgan Chase & Co., Wells Fargo & Co., Barclays PLC, Citigroup Inc., HSBC PLC, and Visa Inc.
Mr. Pugh said the notion of contactless EMV could get a boost from another significant transition now under way: the growing interest in adding payments capabilities to mobile phones through a version of the contactless card wireless format called near-field communication.
Several major card companies and issuers have tested NFC-capable phones, and many have concluded that phones will likely become contactless payments tools, storing multiple card accounts.
In this model, the standard EMV terminals that accept plastic cards are useless, because mobile phones cannot be swiped through them.
Mr. Pugh said he has an NFC phone and that he has had no difficulty using it all over the United States for purchases of any size; when necessary, he enters his PIN, he said. Adding EMV security would not make much of a difference in his purchasing experience, he said.
