EMV in the US – time to just
“I’m looking at a
map showing the progress of migration from magnetic stripe card
technology to EMV chip around the world. In most developed
countries, migration is complete or well underway. In most other
countries, migration has at least started. The only exceptions are
basically deserts, jungles, a few rogue states such as North Korea
and Iran… and the United States of America.
The continued reluctance of the US
to embrace the EMV chip is increasingly anomalous. The main
rationale for chip-based payment cards is reduced fraud.
Historically, fraud levels have been relatively low in the US,
mainly because of the wide use of online authorisation networks, so
the cost of migrating to chip was not justified.
But this argument no longer holds.
It has long been predicted that as more and more countries moved to
chip, fraudsters would concentrate their attentions on those
countries which still rely on the less secure magnetic stripe
technology, and today that means the US.
This is indeed happening. The main
focus of organised card crime today is on hacking large databases
of card details and using these to generate counterfeit magnetic
stripe cards. Witness the recent high profile breaches at US
institutions such as Heartland and TJX.
And it is not just the US which
suffers from magnetic stripe card fraud. Banks outside the US,
whose investment in EMV chip has indeed driven down levels of
domestic fraud, are increasingly frustrated that levels of “fraud
abroad”, mostly originating in the US, remain high.
The problem is that until the whole
world migrates to EMV, we live in a hybrid world where all branded
chip cards must also carry a magnetic stripe. Not only does this
undermine the otherwise high security of the EMV chip
infrastructure, it also leads to acceptance problems and
Ultimately, maintaining this hybrid
world of two card payment infrastructures is unsustainable. My
prediction is that the US will migrate to EMV chip, that it will
happen sooner rather than later, and that once it starts it will
Already there are encouraging
signs. The United Nations Federal Credit Union (UNFCU) recently
announced that it was issuing chip-based credit cards to its
customers who frequently travel abroad. Other US issuers are
This is not surprising. Aite Group
found that of US citizens who travel abroad, 50% had experienced
acceptance problems. Increasingly, we can expect non-US merchants
to be reluctant to accept US cards, either because of the fraud
risk or simply because staff are no longer familiar with magnetic
Another significant event was at
the last Smart Card Alliance conference with Jamie Henry, director
of payment services at the retail giant Walmart, saying “it’s time
for chip and PIN in the US”.
The emphasis on PIN in particular
is significant. One of the major advantages of the EMV chip is that
it facilitates PIN verification, which is much more secure than
signature verification and also more convenient for merchants and
cardholders. That is why countries such as the UK took advantage of
the migration to chip to migrate to PIN verification at the same
Henry was also blunt in rejecting
‘band-aid’ incremental steps towards full chip-and-PIN such as
end-to-end-encryption and tokenisation.
This also makes sense, not only on
grounds of overall costs, but also because without a full EMV chip
and PIN infrastructure in place it will be difficult for the US
card payments industry to take advantage of a new wave of
added-value EMV applications.
Other countries are increasingly
leveraging their EMV infrastructures with card products which
enhance or go beyond payments – such as remote card authentication
for secure e-banking and e-commerce, multi-payment cards which
offer a choice of credit or debit payment, and multi-application,
multi-partner entitlement cards to replace proprietary, closed-loop
smartcard schemes (of which there are many in the US) with more
cost-effective, interoperable products.
These sorts of products are simply
not feasible with an infrastructure based on magnetic stripe.
So my advice to the US is – ‘just
do it’. Move rapidly to full EMV chip-and-PIN, learn from the
experience of other countries, and embed added-value functionality
in the infrastructure from the outset.”
Nick Collin is an independent
management consultant at Collin Consulting and author of a new
report EMV Chip Applications: Catching the Next Wave.