EMV card chip
Credit unions have had more than two years to get chip cards into members' hands as part of the highly publicized 2015 EMV liability shift. But there's an open secret in the industry: many credit unions still haven't finished — or perhaps not even started — issuing EMV cards.
It's a situation some in the industry are reluctant to talk about, because publicly outing credit unions that still have mag-stripe-only cards out there makes those credit unions huge targets for criminals. But names or no names, credit unions that haven't issued EMV cards are playing a dangerous game, industry pros say. Here's what some think is going on — and what could happen to credit unions that have decided to let the EMV chips fall where they may.
On the Hook
In October 2015, U.S. payment networks implemented a massive "liability shift" that put non-EMV issuers and retailers on the hook for counterfeit fraud losses associated with debit and credit cards that were present at the time of the transaction. The idea was to encourage the use of EMV cards, which are widely regarded as less susceptible to fraud. A similar shift is happening with ATMs and gas pumps.
In response to the liability shift, many credit unions have done mass reissues of all of their debit and credit cards, which involves sending out hundreds or thousands of new cards that are embedded with EMV chips. Other credit unions have decided to send out new EMV cards only when their mag-stripe-only cards expired.
To be sure, EMV is catching on. According to EMVCo, from the period spanning July 2016 to June 2017, the percentage of EMV-enabled transactions in the United States jumped from to 31.4% from 7.2% for the prior 12-month period. In addition, as of December 2017, 67% of all Visa debit and credit cards were chip cards, according to the card network.
For credit unions, the popular route has been to start with the credit cards, then move to debit. But two years on, many credit unions aren't 100% EMV-compliant in their debit card programs, Allied Solutions Vice President of Risk Consulting Ann Davidson told CU Times.
"If the credit union has a three-year renewal cycle, the three years ends over 2018 — this would tell us there are still cards out there with EMV if the CU started issuing in 2015," she said. "If the credit unions waited for 2016, 2017, and are doing their EMV replacement cards on a renewal timeframe, this tells us there are many cards out there that are not EMV today."
Holding Out
Randy Vanderhoof, who is the director of the U.S. Payments Forum, said he's heard of credit unions that haven't issued EMV cards. It's especially prevalent among small credit unions and community banks, he said.
For many credit unions, the decision comes down to calculating what's cheaper: the cost of card fraud, or the cost of new cards, he said.
"It's a bigger lift for them to have to make the upgrade to EMV with their card stocks and their suppliers, and all of those other sources. Plus, when they buy smaller quantities, their costs are much higher," Vanderhoof explained.
Issuer demand for EMV cards has lulled recently, but it will probably rise again soon and take prices with it, he added.
"The prices right now, that are pretty reasonable in terms of cost, are probably going to start going up once the big banks start reissuing their second generation of their initial EMV cards that they issued three, four years ago," Vanderhoof said.
By now, though, credit unions that have lagged behind or avoided EMV cards altogether likely have done so because they believe it's cheaper to just eat the fraud.
"I think that if, as long as your customers are okay with that and you're comfortable with the risk associated with counterfeit fraud migrating to your portfolio, then I think it's everyone's free choice to make that decision," Vanderhoof said.
"By this point in time, it's not that they're waiting for something to happen," he added. "I think they've made a decision that it's not in their interest to do this, and they're not receiving any complaints from their customers, and so they're going to continue to do business as usual for the foreseeable future. I don't expect that a lot of them will change to EMV cards if they haven't done so by now. But then again, the fraud that exists in the market is continuing to be funneled to those merchants and those issuer portfolios which are still not using technology, so they're more likely over time to be the target for higher fraud."
Of course, it's not the first time credit unions have had to make these kinds of decisions about their card portfolios.
"Back in the '90s when CVV/CVC was being rolled out, many credit unions implemented CVV/CVC as the cards came up for renewal — until they got hit with fraud, then the credit unions did a mass reissue," Davidson recalled. "Some credit unions still sat back, saying they would never get hit. Visa and Mastercard did not mandate CVV/CVC until the fraud got so bad, and then Visa/Mastercard had a mandate when all cards needed to be CVV/CVC."
Could that kind of mandate happen for EMV? "Food for thought," she said.
Kicking the Can
Regardless of why some credit unions are avoiding or lagging on EMV roll-out, one thing is clear: they're tempting fate.
"The key message would be if the credit unions are not 100% EMV, it's no longer an if, it's when they will be targeted for non-EMV magnetic stripe fraud," Davidson warned.
Traditional cash registers aren't the only point of concern, either. Liability shifts at ATMs and gas pumps raise the fraud stakes even higher. Credit unions that own their ATMs or are liable for their ATMs should get them chip-enabled, Davidson cautioned.
"This is critical, since we just saw a potential exposure where the credit union will assume $400,000 in chargebacks by the card issuer to the credit union as the merchant for not having their ATM chip-enabled and the card issuer's cards were chip-enabled," Davidson explained.
From her perspective, it's time credit unions are 100% EMV for all card programs.
"This has to happen, or the credit unions will be the weakest link," she said.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.