Smart Chips Still Slow to Catch on at U.S. CUs
Despite the documented ability of smart chips to cut fraud losses, experts say some credit unions and CUSOs have not moved very quickly to start issuing credit and debit cards enabled with the higher tech chips.
Visa USA set the stage for the advance of smart card chips in the U.S. when it announced in August that it would, at long last, back the technology. The cards have steadily grown in overseas markets to the point where they are common in Europe and nearly prevalent in Asia, Visa and other card brands have reported.
The cards' popularity with overseas issuers has arisen from their significantly increased strength against “card not present fraud,” the single largest source of card fraud in the U.S. right now, according to issuers.
Card not present fraud has been made possible by thieves who have learned how to hack into retailers’ card payment systems and steal the card numbers and data stored there. This stolen data has allowed them to manufacture their own fake cards with the cardholder’s data encoded in a stripe of magnetic tape on the back of the card, which can then be used at retailers or ATMs.
The ability to use stolen card data in this way has also created a thriving black market for it, according to law enforcement authorities. This means that people who steal card data don't have to risk arrest by faking cards and trying to use them, said Ann Davidson, senior consultant for CUNA Mutual Group Risk Management. All they have to do is sell the card data they have stolen.
Smart cards effectively reduce this card fraud risk by generating a unique identification code between the properly programmed smart chip embedded in a card and the card reader each time it is used. If the code is not present, the transaction is not approved. This both prevents the fraud and shuts down the market for stolen card data, Davidson and others said.“If there is no place to sell it, why steal it,” Davidson noted.
So against the backdrop of what is, in effect, a significant card fraud industry that costs credit unions, according to surveys, tens of millions of dollars, why haven't credit unions been more excited about the prospect of changing over to cards with chips embedded in them?
“I think there may be a good deal of skepticism out there [about smart cards],” said Bill Lehman, portfolio consultant for Card Services for Credit Unions, the association of CUs which process their card transactions with FIS, the Jacksonville, Fla.-based card processor for the largest number of card-issuing CUs. Lehman said CU representatives have told him they doubted how much use the cards would be for the majority of their members and wondered whether it made any sense to change over their debit and credit card portfolios to a technology that retailers have not yet adopted on a large scale.
He also observed that Visa's campaign in favor of the new technology left card issuers some time to make decisions including not requiring them to do anything at all.
“There is no requirement for credit unions to do anything as card issuers,” Lehman said, adding “so it’s not a big surprise that they haven't rushed to do anything.”
Lehman said the CU executives with whom he has discussed smart cards have been more interested in looking at how they might integrate the cards into their portfolios gradually, perhaps even on an account by account basis rather than in a sweeping change-over.
“I don't think you will see any credit unions changing over their card programs at one time,” Lehman offered.
Kent Potterton, vice president with PSCU Financial Services in St. Petersburg, Fla., said the payments CUSO, which works with CUs that process their card transactions on the First Data platform, had heard something similar.
“Credit unions right now are really looking at this technology and seeing where they can make it fit,” Potterton said.
He observed that the two CUs that have announced commitments to shift their portfolios to the smart chip cards have done so because a significant percentage of their memberships have lived overseas or frequently travel abroad.
In August, PSCU announced that it was working with the $815 million Andrews Federal Credit Union in Suitland, Md. to roll out a smart card for its members. Many of them travel or live overseas as part of military service. The $3.4 billion United Nations Federal Credit Union in Long Island City, N.Y. has already deployed the cards to its membership, which has several branches in other countries. PSCU’s new cards technology will also be available to all 680 of the CUSO's other card processing members.
Like Lehman, Potterton said that the Visa program on smart cards had not required any movement from issuers and that credit unions were hesitant to spend money right away on a technology which may still be years down the road.“The next move is really with retailers,” Potterton said. “It will be easier to issue smart cards when there are more terminals that accept them.”
When more of those terminals might become available is less clear. Visa's smart card initiative will make the first incentive to provide card terminals available to retailers on Oct. 1, 2012. On that day, retailers that can prove that at least 75% of their card transactions originate from terminals that can read smart chip cards will not have to certify their compliance that year with PCI, the industry's card security standard. However, merchant processors do not have to be able to support chip card transactions until April 1, 2013 and retailers will not be liable for fraudulent card charges until Oct.1, 2015. As of that day, if a contact chip card is presented to a merchant that has not adopted at least contact chip terminals, liability for counterfeit fraud may shift to the merchant's acquirer, according to Visa’s schedule. While Visa aimed its smart card initiative at retailers, they appear to be not necessarily any more enthusiastic about the technology.
“It’s a bit of the chicken and egg thing,” said Greg Danzig, president of Charge.com, one of the major retail card processors in the U.S.“Retailers will not want to put in terminals without there being enough cards and issuers that will not want to issue the cards until there are enough terminals to take them.”
He said that Charge.com had not yet even purchased any of the new, chip-enabled terminals though the company had just launched a major promotion where it was giving away terminals to merchants that sign up for its services. Worth $500 a piece, all the new terminals are going to be top of the line, Danzig said. However, the equipment will be magnetic stripe only machines.
“I know that eventually that is where we're all going,” Danzig said. “But so far, we really haven't had any call for [the terminals].”
Nancy Crouch, director of card services for the $5.4 billion AA Credit Union in Fort Worth, Texas, said her credit union had also not really tackled the smart card issue but that it was on the radar.
Crouch said the 290,000 member-credit union had some of the same concerns about how quickly retailers were going to put card readers into place. The costs of the new cards had also not dropped to the point where changing over the card portfolio to avoid fraud costs would be an easy economic decision, she pointed out.
Crouch said she was waiting a bit to see what MasterCard would do. So far, the number two card brand issuer has remained silent on when or if it would join Visa by providing incentives to retailers to start taking the cards.
“Visa and MasterCard are not moving as closely as they used to and we want to see what [MasterCard’s] market impact might be,” Crouch said.
One thing that she said might speed up the CU’s thinking would be if one of American Airlines' big bank competitors, such as Bank of America, started offering the cards widely. If that happens and if it became a competitive issue, Crouch said “we might have to take a look at how we were handling the technology.”