Navigating the United State’s EMV zone of doubt and blame

by Christopher Danvers

As we approach the first EMV-related liability shifts later this year, it’s clear the U.S. payments ecosystem is deeply entrenched in the unavoidable “zone of doubt and blame” right now regarding EMV. Since 2011 when the major card brands announced their EMV roadmaps for the United States, we’ve heard all sorts of concerns, opposition, and criticism, including:

  • Why are we replacing a 70’s technology (mag stripe) with a security standard that’s already 10 years old?
  • Why doesn’t the U.S. leapfrog EMV and just replace cards with more secure mobile payments based on tokenization?
  • Who moves first; should card issuers circulate chip cards with little to no U.S. Point of Sale (POS) acceptance, or should retailers upgrade terminals first to provide acceptance in order to support mass chip card issuance?
  • Why spend so much money and time on EMV when it won’t reduce all fraud, and in fact could just shift counterfeit card fraud volumes to card-not-present and lost/stolen fraud?

And most recently retailers have voiced frustration that U.S. issuers are issuing chip-and-signature cards instead of chip-and-PIN cards, which are perceived to be more secure. While the industry has generally worked through most of the above issues, the chip-and-signature vs. chip-and-PIN debate deserves some attention. On the backdrop of 15 months of some of the worst merchant POS system data breaches in history, it seems rather convenient to shift the focus of security discussions of POS system vulnerability to one focused on the merits of chip-and-PIN or chip-and signature cards.

 

continue reading »