Chips are in, stripes are out, and taps are on their way.
It's been two and a half years since the October 2015 credit card industry liability shift that ushered in a new dawn in the realm of payment technologies. The move strongly favors EMV chipped cards (the acronym stands for Europay, MasterCard and Visa) over magstripes, and has cleared the way for an increase in contactless payments down the road. No retailer is legally obligated to change — it's a mandate, not a law — but since the liability shift, any payment fraud is the responsibility of whichever party is using the lesser technology.
Roughly 96% of payments are being made using chip-enabled cards, according to a December 2017 Visa Chip Card Update. And while that doesn't mean these are chip-to-chip payments, it does show that from an issuance perspective, the banking industry has overwhelmingly shifted to EMV.
This leaves the retailers that still relying on magstripes exposed to risk.
EMV is working as intended: Retailers that have implemented EMV terminals saw a decline in fraud equal to twice the overall marketplace.
The number of retailers still holding on to outdated technology is shrinking, though. According to the U.S. Payments Forum Winter 2018 Market Snapshot, released in January global payment networks reported that the number of chip-on-chip transactions for credit cards is over 50%, and that 96% of the top 200 merchants are now EMV capable, versus just 29% of merchants in September 2016.
As of December 2017, 59% of U.S. merchants — over 2.7 million — accept chip, notes the Visa Chip Card Update. That's up 578% from only 392,000 in September 2015, just prior to the liability shift. The same report indicates a 70% decline in counterfeit card fraud for chip-enabled merchants, while the number across all merchants — chipped and unchipped — has dropped 41%.
That means EMV is working as intended: Retailers that have implemented EMV terminals saw a decline in fraud equal to twice the overall marketplace.
To upgrade or not to upgrade?
According to Randy Vanderhoof, director of the U.S. Payments Forum, a multi-industry stakeholder organization that represents the entire payment ecosystem and serves as a neutral body for the payment industry, there will probably never be 100% full implementation for EMV, but that close enough is good enough by most industry standards.
"Ninety percent is considered full implementation," he said. Many retailers have payment terminals that are 10 or 15 years old, and a lot of them are just going to wait for their equipment to break down, because replacing systems is both costly and disruptive. "It could be another 10 years before those old terminals wear out," he said. "And since there's no mandate or requirement for merchants to replace that existing equipment, other than risk of fraud, there will be retailers who just want to wait it out."
Of course, retailers who choose to wait are opening themselves up to increased fraud risk and responsibility. "Although EMV technology is not 100% foolproof, and hackers have figured out ways to hack the more secure EMV technology, it has been seen that incidences of fraud are higher where EMV technology has not been implemented," said Vasudev Bhat, managing director of AArete, a global consultancy specializing in data-informed performance improvement. "The recent data breaches make the case for EMV tech stronger."
"One of the biggest misconceptions is that EMV is a cure for all fraud, that’s not the case."
Chad Lowman
Director of Product Management, Cayan
While upgrading won’t prevent all data theft, industry experts say that part of the reason for upgrading is to prevent the kinds of data theft that can happen while using other types of payment systems.
"One of the biggest misconceptions is that EMV is a cure for all fraud," said Chad Lowman, director of product management at Cayan, a Boston, Massachusetts-based payment technology company that supplies terminals and payment services to retailers. "That’s not the case. It’s really designed to prevent stolen data from skimmers and fake cards, which it has made huge impacts on. There’s still lots of fraud happening through e-commerce, keyed transactions and magstripe-only cards, which EMV isn’t a part of. That’s why it’s important to upgrade devices to EMV, issue EMV cards, and do a full PCI audit to make sure payment data isn’t exposed."
More than security
Preventing fraud isn't the only compelling reason to upgrade to EMV readers, though. The technology behind EMV terminals also enables a plethora of retailer upgrades.
"EMV puts in a lot of the foundation for merchants who had very old terminals, and it gives them a base platform that's future-ready," said Hemal Nagarsheth, principal in the financial institutions group of A.T. Kearney, a global strategy and management consulting company. "It enables NFC, and it's an opportunity for other technology that can be applied in many ways."
New terminals will also ease the transition to contactless payments, since EMV terminals are contactless-enabled now, said Nagarsheth. "The four major credit card networks have announced that they'll soon phase out signatures," he said. "So that's an extra push, too. It's more about making sense of the toolkits available, and how to make the experience better. It's not only about security. Retailers can now make the checkout much more frictionless, and think about APIs, and getting rid of the checkout line, and automatic payments."
Using EMV will not only allow retailers to stay up to date with the latest in-store beacons and mobile tech, though. It's also an important step in preventative maintenance.
"Every segment of business invests a certain percentage of revenue in security," said Vanderhoof. "But the retail business sector has invested a significantly smaller percentage of revenue because [security] is not their primary business. If that doesn't change, more and more retail businesses will feel the effects of data fraud, and some of them will be severely damaged in fines and losses, or in reputation, and they're going to disappear. So they have to invest to stay on top of fraud. They need to put as much attention into that side as they put into marketing."
While most retailers wait for consumers to drive their business decisions, this is one area where consumers are less likely to have an influence. That doesn't mean it's not important — it only means it may be harder for retailers to see the need for upgraded payment tech until something bad happens.
"It would be hard to prove that merchants who have not implemented EMV have seen any significant decline in customers," said Vanderhoof. "Consumers are not the primary driver here, since they're somewhat protected." Vanderhoof said many consumers have even become inured to fraud. "They're used to it, because it's happened to them more than once, or to someone they know," he said. "So they're not as sensitive to it as they were four years ago when the Target data breach happened."
What's next and how soon?
For forward-thinkers, EMV is already in the rearview mirror, as contactless payments become more popular, especially abroad. Vanderhoof said that in some countries, contactless has overtaken other forms of payment. In particular, he pointed to Australia, which is now 93% contactless, and Canada, which is 51%.
However, that kind of market saturation is still a long way off for the U.S. At the 11th annual Secure Technology Alliance Payments Summit in March, keynote speaker Stephanie Ericksen of Visa said that "less than 1% of Visa’s transaction volume in the U.S. was through contactless payments as of January 2018," according to a report. Even though Erickson also said that more than 95% of terminals currently being shipped are contactless-capable, and 46% of Visa transactions in the U.S. occur at contactless-enabled terminals, it's still not widely used at the retail level.
"We're still in the early days of retailers being able to accept contactless," said Vanderhoof. "Twenty or 25% of retailers can accept mobile and contactless now, and consumer behavior isn't going to be significantly changed until people who shop at all those locations have the option of using those options."
Yet things are changing faster than ever, and by next year, the landscape might look very different. "There’s already a big push for contactless EMV, and the card brands have set a deadline to require support next year," said Lowman. "Many issuers are going to be sending out dual-interface cards that combine EMV contact and contactless chips on the same card, so consumers will have more opportunity to pay with contactless."
"In 30 years, people might be using their irises to pay. But there will always be legacy systems that will need to be supported. In the history of payments, nothing has ever gone away. We've only ever added more choices."
Randy Vanderhoof
Director, the U.S. Payments Forum
Lowman believes that along with additional security, contactless payment also increases speed of the transaction. "It’s just a single tap," he said. "No need to insert and wait like with contact EMV. That’s a big benefit to the retailer and cardholder."
And for the true Luddites in retailer? "Most cards still have embossed numbers and those are still valid, magstripes are still around and chipped cards are brand new in light of that spectrum," said Vanderhoof. "In 30 years, people might be using their irises to pay. But there will always be legacy systems that will need to be supported. In the history of payments, nothing has ever gone away. We've only ever added more choices."
