Data: What EMV overlooked

September 12, 2018 11:25 AM

The vast majority of credit and debit cards in the U.S. are now EMV compliant, and nearly 70 percent of U.S. stores can support chip-enabled cards. But there are gaping holes—including smaller financial institutions that haven’t fully converted to EMV and millions of merchant locations still not accepting chip cards.

Fraudsters are meddling with these areas now, chasing the last remaining opportunities to commit counterfeit card fraud.

Gas stations—whose October 2020 EMV liability shift is five years later than general merchants’—are becoming a serious concern, with least 90 percent of unattended payment terminals still not EMV-compliant. Following a spate of headlines about gas station card-skimming crimes, a recent study suggests some consumers are becoming uneasy about paying at the pump.

Here’s a look at the latest U.S. EMV migration milestones and where risks persist.

The U.S. was one of the last sectors to upgrade its payment cards to EMV, in part because of the market’s size and diversity. Almost three years after the broad U.S. EMV liability shift went into effect for most companies in October 2015, nearly 30 percent of U.S. store terminals are still not ready to accept chip-enabled transactions.

Visa estimates that 67 percent of U.S. storefronts are EMV-enabled, including most large retail chains. Some midsize chains required extra time to configure their systems for EMV technology, and many hotels and pay-at-the-table restaurants lag because their customer environments weren’t geared to accepting chip cards.

The numbers suggest fraudsters now have a much narrower—but not insignificant—path to commit counterfeit card fraud at merchants that have not yet added EMV.

After a somewhat slow start, U.S. merchants rapidly gained momentum in converting payment terminals to the EMV format from late 2015 through the present.

Restaurants and hotels are rapidly adopting EMV technology, and chip transactions now account for the vast majority of payment volume in the U.S. As a result, counterfeit fraud dollar losses have declined 75 percent over the past three years, according to Visa.

Merchants with a consistent clientele, and other niche operators, are ignoring the EMV liability shift altogether, a decision that may not affect overall risk factors.

“Some merchants, for one reason or another, figure the cost of upgrading to EMV for their business outweighs the likelihood of losses from counterfeit card fraud,” said Randy Vanderhoof, executive director of the U.S. Payments Forum, a nonprofit that supports cross-industry cooperation and education.

EMV cards contain a chip that that creates a unique cryptogram for each credit and debit card transaction, foiling attempts to clone card account data for counterfeit card fraud.

Some U.S. issuers started shipping customers chip-enabled cards a couple of years prior to the EMV liability shift deadline, and today 97 percent of the nearly 500 billion payment cards in circulation are EMV-compliant, according to Visa. But three percent—about 15 million—of those are older magnetic-stripe cards, which are the easiest to clone for counterfeit card use.

One reason for this delay is that certain smaller banks and credit unions have still not finished converting their credit and debit portfolios to the EMV standard, and some are waiting until existing cards expire before replacing them. If an older style card with no chip is cloned and processed as a mag-stripe transaction at an EMV-enabled terminal, the issuer bears the loss.

“Most financial institutions that didn’t convert to EMV are starting to see liability shift toward them and it will only increase as fraudsters identify which entities are fair game,” said John Buzzard, fraud specialist at Co-Op Financial Services, a financial technology provider to credit unions. Co-Op urges issuers to adopt EMV or encourage customers to use mobile payments to reduce counterfeit card fraud risk.

The card networks granted gasoline merchants with automated fuel dispensers (AFD’s) more time comply with the EMV shift than other types of retailers because of the construction cost and complexity of rebuilding AFD’s to accept chip cards.

Even following an extension of this deadline to 2020, most gas retailers will be scrambling to upgrade to chip-enabled pumps over the next two years. The percentage of gas stations processing chip-card transactions currently is in the single digits, according to the U.S. Payments Forum.

Gas stations recently began drawing more attention following a spate of reports of criminals planting devices within terminals to skim card account information to commit counterfeit card fraud.

Sixty-eight percent of U.S. adults who were inconvenienced by payment card fraud related to card skimming said they have changed the way they pay for gas, according to a survey by CompareCards. Millennials were most likely to suspect they have been a victim of card skimming at the pump within the past 30 days, the survey indicated. CompareCards commissioned Qualtrics to conduct the online survey among 1,000 U.S. adults July 9-11, 2018.

Consumers aren’t liable for losses from counterfeit card fraud or losses from lost and stolen cards, but resolving fraud can be a time-consuming hassle.

Visa also protects issuers from excessive chargebacks by requiring gas station operators to be vigilant about monitoring pumps and terminal-tampering with help from law enforcement agencies, but consumers are aware of a rash of card-skimming incidents at gas stations across the country in recent months.

This month, police discovered card-skimming devices at two suburban Chicago Shell stations; separately, investigators rounded up 117 card-skimming devices in southwest Florida and Indiana law enforcement issued a broad warning about gas station card-skimming. USA Today in July urged readers afraid of card skimming to pay inside stations.

CompareCards’ survey indicated consumers who believe they were victims of fraud connected to card skimming at a gas station are likely to have changed the way they pay for gas.

Almost half of card-skimming victims said they use a credit card to pay more often for gas, while 39 percent said they pay for gas inside the station now and 16 percent said they use cash more often now.

The pressure won’t necessarily accelerate gas stations’ timelines to upgrade to EMV, because 80 percent of U.S. gasoline is sold through independently owned franchise convenience store operations whose resources are stretched thin, according to Conexxus, an Alexandria, Va.-based trade group for convenience and petroleum store operators.

“It’s true that some people’s behavior around fraud is being driven by their fear and what they’ve seen, but until we reach the point where most of these gaps close, there will be risks in the system, and it’s important to remember card protections are there to keep consumers’ money safe,” said Vanderhoof of the U.S. Payments Forum.