Cards: PINs vs. Signatures Sparks Industry Debate
As the payment industry begins to move toward replacing magnetic stripe cards with cards that use embedded smart chips, credit unions and other card issuers will have to eventually decide whether they will issue cards that use personal identification numbers or signatures to validate transactions.
This is a debate unique to U.S. financial institutions. Other nations that have moved to the chip cards have payment industries that have adopted PIN platform validation.
But the situation in the U.S. is different in that the payment industry here is technically sophisticated enough that it can provide online confirmation of embedded-chip data and thus validate card transactions in real time. This significantly undercuts the advantage of using a PIN to prevent fraud and makes PINs seem less necessary, as one recent white paper on the topic described it.
“EMV was developed because European card issuers needed a way to provide merchants with quick, secure authentication,” wrote Aris Jerahian, vice president of client relations for The Members Group, a payment processing CUSO affiliated with the Iowa Credit Union League. “Europe’s poor telecommunications infrastructure and a great number of unmanned terminals and kiosks made it difficult to provide this authentication with traditional mag-stripe cards. EMV, supported by chip-and-PIN technology, became the answer,” he added in the paper, “Chip Card Debate: U.S. Weighs Benefits of PIN and Signature Formats.”
“Since most U.S. payments technology already supports online validation of transactions, the additional level of fraud protection provided by a PIN is less attractive,” Jerahian said when discussing the choice faced by U.S. financial institutions.
In addition, financial institutions might be drawn to the higher credit card interchange that the signature platform has traditionally earned, Jerahian explained, adding that chip card programs that use PINs are also usually more expensive to develop because of the additional computer coding a PIN program usually requires.
There are signs that some card issuers are open to the appeal of a signature card. According to Jerahian, JPMorgan Chase and U.S. BancCorp, the parent company of Elan Financial Services, have both announced that transactions on their new embedded-chip cards will be validated by signatures only and not carry PIN capability. This has drawn wide attention from within the industry because this will make those cards effectively useless in other countries, notably those in Europe and Asia. It would also appear to make the cards useless in unattended transactions where a vender has established PIN-only machines.
“While there are international terminals capable of accepting chip-and-signature transactions, the ones that don’t are generally unmanned, making completion of the transaction impossible,” Jerahian wrote. “Take, for example, a cardholder traveling by train in Europe. Many European train-ticket kiosks require a PIN for offline authorization, forcing a chip-and-signature cardholder to complete the purchase with a different form of payment. Even in manned-terminal situations, chip-and-signature cardholders may have a difficult time explaining the technology to merchants abroad. The merchants may not be familiar with signature authentication; they may also speak a different language than the cardholder, further complicating communication,” he concluded.
But Randy Vanderhoof, executive director of the Smart Card Alliance, an industry group of chip card developers, manufacturers and issuers, argued that the signature vs. pin debate is being misunderstood. While it’s true that an American traveler with an embedded-chip payment card may very well find themselves unable to purchase a ticket from a railway kiosk in London, that will be because the railway has set its kiosks up to accept only cards with PINs, not because there is anything inherent in the technology that said a kiosk can only accept cards with PINs.
In the U.S., a similar railway with kiosks could set them up to ask first for a PIN, but if the card does not support PIN the kiosk could then default to using the validation information contained in the chip alone and not require the cardholder to do anything else, Vanderhoof explained. Each nation has different payment regions that can make these sorts of decisions, he said. In the U.S., where they might be more signature-only cards, merchants could set up their kiosks and other unattended payment venues to take both signature and PIN validation.
So how should a card issuing credit union or other financial institution decide which to issue? Jerahian and Vanderhoof agreed that listening to members or customers and monitoring their needs was going to become even more important.
For example the 96,000-member, $3.6 billion United Nations Federal Credit Union, headquartered in New York City, was the first financial institution in the country to announce it will issue chip-embedded cards and the credit union announced its cards would support PINs. That was because it determined that the bulk of its internationally working and traveling members who would use the cards would need a card that supported PINs. But another credit union, one without many internationally traveling members, might decide not to invest in issuing chip cards with PINs, the industry experts said.
“I can see smaller credit unions or credit unions without large card portfolios opting at first for the signature platform to avoid the higher set up and coding costs that come with a PIN supporting card,” Jerahian said.