Retailers continue push for PIN use on new credit cards

Dive Brief:

The Oct. 1 deadline for retailers to be ready to process new, more secure EMV chip-enabled cards has come and gone, but many retailers are pushing for further modification to point-of-sales systems that would allow customers to use personal identification numbers when they check out.
The yet more secure addition of PINs, which is standard in Europe and elsewhere, is considered ideal by cyber-security experts, but banks have resisted their use because they say they don’t add that much more protection, and consumers won’t want the hassle.
Nevertheless, Target and Wal-Mart have decided to unilaterally have their own store credit cards PIN-enabled, as have some smaller banks, while other retailers, like Macy’s, are sticking with chip and signature only. Yet others, like J.C. Penney, haven’t begun processing the new cards at all.

Dive Insight:

While many retailers and retail industry groups have continued to clamor loudly for the addition of PIN numbers in the use of credit cards, Reuters reports that the industry isn’t of one mind on the issue.

Macy’s and J.C. Penney, for example, don’t seem to be in any rush to implement the new systems, much less add the extra burden of using PINs—as big or small as that may be—to the process.

While banks have insisted that consumers don’t want the added nuisance and confusion of using PINs, it seems to be the banks—which have referred to the new cards as “chip and PIN”—that are confused, according to reporting by Reuters. The Federal Bureau of Investigation recently added to the confusion by urging the use of largely unavailable PINS.

It’s worth noting that Target, a retailer who learned the hard way just how devastating a cyber-breach can be, is among the retailers advocating for tighter credit card security.

While banks and credit-card companies forged an agreement with retailers that would shift liability for cyber-breaches to retailers that don't have the new EMV-enabled systems, that could get redefined if the next retail breach comes on an EMV-enabled system that doesn’t process PINs. That shift is in effect as of Oct. 1.

"The PIN is definitely a must," Lance James, chief scientist with cyber intelligence firm Flashpoint, told Reuters. "It's one extra step that provides true two-factor authentication."