EMV Chip Technology Rules – Did They Change the World?

The introduction of EMV Chip technology in credit cards in the United States market (which started in 2015 and will continue into the near future) will have a positive effect on fraud prevention in the credit industry, but is not a “magic bullet” for all fraud-related costs that our members must bear. The liability shift that places expense of any fraudulent card use at a brick and mortar establishment (known as “card present” fraud) on the merchant will have only a temporary effect on our members, with little long-term liability shift to merchants.

The current liability shift places the expense of any card present fraud on a merchant only when a merchant has not invested in an EMV certified and chip enabled Point Of Sale (“POS”) terminal and an EMV Chip card is used in the commission of fraud. Otherwise, the liability resides with the card issuer, as has always been the case.

During the switch to EMV Chip cards and POS terminals, not all merchants will have EMV Chip technology in place, which could lead to a significant shift in liability. However, this shift will be temporary, as merchants will continue to update their card processing systems to come in line with EMV Chip technology. While there will continue to be a number of vendors who may choose to bear the liability for card present fraud committed with EMV Chip enabled cards, and never change to EMV Chip technology (for example automated fuel dispensers, which are physically more difficult to replace and likely much more expensive) these vendors are a small fraction of merchants utilizing credit card payment systems. Because of this, it is unlikely that our members will benefit from any significant long-term shift in liability to vendors.

There is little debate; EMV Chip cards, when used with chip and pin number technology, can significantly reduce in-person card fraud as compared to traditional magnetic stripe cards. For example, when EMV Chip and Pin was introduced in France in 2005, counterfeit card fraud dropped 91%, and fraud from card theft dropped 98% 1 . This is because stolen EMV Chip and pin cards are nearly impossible to use in brick and mortar stores because of the fraudster’s inability to access the required PIN.

Likewise, reduction in counterfeit card fraud after EMV Chip cards were introduced in France was due almost entirely to the inability of fraudsters to reproduce the unique chip installed in every card. Because of this, stolen credit card information can no longer be used in card present fraud simply by swiping the card at checkout, because the EMV Chip must be read for the transaction to be completed. 1 Face-to- face domestic fraud rate in France, 2012 Banque de France Unfortunately, the system being implemented in the United States does not utilize Chip and Pin technology (as is used in France,) but rather uses Chip and Signature technology. Chip and Signature technology does not require an in-person purchaser to know a secret pin number, like the EMV Chip and pin system, and instead allows the credit card user to simply sign for the transaction like traditional credit and debit cards. This will effectively negate the added protection offered by EMV Chip cards against stolen cards being used in brick and mortar locations, because the second level of security offered by a pin number does not exist. Implementation of EMV Chip and signature technology as opposed to EMV Chip and pin technology will hinder the anti-fraud capabilities of the EMV Chip card. Between 2002 (just before EMV Chip cards came into wide use in the Eurozone in 2005) and 2012, counterfeit card fraud in the United Kingdom dropped from 35% of all credit card fraud to 11% of all credit card fraud, a significant decrease. As discussed previously, EMV Chip and signature technology does not prevent the use of a stolen card (because one can forge a signature,) and thus the effects of chip-and- pin on the use of lost or stolen cards are irrelevant here. These numbers include fraud carried out with EMV Chip cards in overseas markets, including the United States. With the United States joining the club, so to speak, there are even fewer foreign markets in which card present fraud can be committed, and thus the effect of the EMV Chip in the United States are likely to be even greater than those seen in the United Kingdom.

In that same time frame, Card Not Present fraud (fraudulent use of cards via internet and phone) rose from 26% of all credit card fraud to 63%. 2 While this may seem to be an explosion in fraud after the introduction of EMV Chip cards, if we look to the amount of fraud in British Pounds and compare it to the increase in online commerce during the same time, we see a different story. Even between 2005 and 2012, when ecommerce sales were experiencing exponential growth (on the order of hundreds of percentage points,) British card-not- present fraud only increased by 85.7 Million Pounds, or 29%. 3 This not only includes the natural and expected growth of Card Not Present fraud, but also likely includes some percentage of the fraud that would have been otherwise been carried out in brick and mortar stores. This is positive evidence for the effect of EMV Chip technology on even card not present fraud.

Furthermore, EMV Chip technology does not affect any data that are stored by retailer’s systems. Thus, breaches like the ones at Target, Staples, Home Depot, and Michaels would not have been prevented by EMV Chip. In conclusion, the effect of the transfer of liability under EMV Chip technology will likely be both small and temporary for our members. EMV Chip 2 Financial Fraud Action UK, Fraud The Facts 2013, p.12 3 Id at 15, 17 technology only prevents issuer liability in a small number of cases, and merchants will likely continue to sign on to EMV Chip technology, lowering the number of instances of merchant liability. Additionally, EMV Chip technology will not prevent retailer hacking, nor will it prevent card not present fraud. Further, some of the positive attributes of EMV Chip technology will be negated by the use of chip and signature technology as opposed to chip and pin. However, in light of the statistics from France and the United Kingdom, EMV Chip and signature as implemented in the United States is likely to reduce the commission of counterfeit card fraud – a valuable first step in the fight against card fraud in general. Our members lives may not be forever changed by the EMV Chip, but its introduction will benefit them both now and in the future.