Card Fraud: The Case for Chips

More U.S. Issuers Turn to Chips for Advanced Debit Protections
Card Fraud: The Case for Chips
It's just more than a year since United Nations Federal Credit Union announced plans to introduce chip cards to its U.S. membership.

The $3.1 billion New York-based institution said in June 2010 that it was launching a service for its elite cardholder portfolio - a service that called for the migration of Visa-branded credit cards from magnetic-stripe technology to the more internationally accepted Europay, MasterCard, Visa or EMV chip standard.

Today, UNFCU says the program has been a success; and plans are now underway for the first quarter of 2012 to expand the EMV offer to more members. "Our members that have the EMV card are very pleased with it," says Merrill Halpern, who oversees card services at UNFCU. "It truly has proven our original business case, and we are seeing increased volume across all categories."

Purchase volume within the elite portfolio has increased 20 percent since the launch of EMV. "It ties in with services we provide the global traveler," Halpern says. UNFCU's membership comprises United Nations employees and their families who live in the U.S. and abroad.

Member satisfaction and acceptance of the card has been contagious. "[It] also has created demand among those who don't currently qualify," Halpern says. "I have never seen a portfolio take off like this EMV portfolio took off."

Does that mean more U.S. acceptance? Halpern says he is not sure.

"We think it's a great thing for everyone," he says. "It will open doors for more contactless [payments] in the U.S., and we are getting questions from other institutions about chip cards. They are thinking that if they invest in it, they will get the 1-cent incentive for fraud prevention," which is afforded by the Durbin amendment, to the Dodd-Frank Wall Street Reform and Consumer Protection Act. The amendment gives the Federal Reserve the authority to offer a 1-cent incentive to card-issuing institutions that invest in debit-fraud prevention.

"Most institutions are using neural networks, but they see the chip as an additional way to reduce fraud," Halpern says. "We believe it's a viable means for controlling debit fraud."

Debit Fraud Prevention: The Driver

Debit fraud, often perpetrated by card skimming continues to garner global attention.

In Europe, despite a move to EMV chip and PIN technology, which is widely regarded as being more secure than the mag-stripe, debit fraud related skimming remains a problem.

Lachlan Gunn, who heads the European ATM Security Team, says the plaguing problem is the lingering mag-stripe, which even EMV-compliant cards have retained because of the United States' reluctance to make a mass migration toward EMV.

"European gangs [are] going to the U.S. because of the success of EMV implementation in Europe and other parts of the world in reducing skimming-related losses," Gunn says. "The U.S. has no plans to do the same. These guys have perfected card skimming techniques in other markets and now appear to be hitting the U.S., as a 'soft' target." [See Europol's Organised Crime Threat Assessment, which states that 80 percent of fraud incidents hitting cardholders in the European Union is committed in the U.S.]

In its most recent card fraud report, EAST reports that skimming incidents continue to show signs of increased sophistication, and lingering mag-stripe technology has made global card schemes vulnerable to attack. "Despite a continuing fall in overall losses, the trend of the majority of losses due to skimming occurring outside of EMV-liability-shift areas continues, with such losses reported in 35 countries outside of SEPA [Single Euro Payments Area], and in seven countries within SEPA," Gunn says. "The USA is the top location for such losses, followed by Argentina, the Dominican Republic and Russia. Several countries have now seen the introduction of regional card blocking, with some card issuers blocking domestic cards for usage outside of Europe."

Mag-Stripe Tech: 'Never Meant to be Secure'

The growing European block on mag-stripe transactions is spurring U.S. banking institutions to review EMV more closely. "What are the drivers to EMV?" asks Jack Jania of Gemalto, a global provider of smart cards. "Security is No. 1, and ubiquitous acceptance is No. 2. Right now, ubiquitous acceptance of the mag-stripe is breaking, and it's only going to get worse. Moving forward to 2015, it's going to be much worse. In Asia and the U.K., they are already starting to pull the mag-stripe off their cards. And more ATMs in Europe are only reading the chip. Those moves will be more and more prevalent."

Aite Group, in its recently published "Mag Stripe to Malware: Card Security Risks in 2011" report, says the need for ubiquitous global card acceptance is helping U.S. card issuers warm to EMV.

In 2009, 36 percent of surveyed risk management executives said they did not expect U.S. mag-stripe cards to be replaced with EMV-compliant technology. In 2011, that percentage dropped to 17, Aite says.

"The consensus is now that the United States will eventually migrate to EMV," Aite reports. "The death of the mag stripe will be slow, however. More than half of respondents believe that it will be five years or more before the U.S. payments industry begins its migration."

But growing fraud losses are spurring change, perhaps more rapidly than expected. California-based Fremont Bank, a $2.5 billion community institution that serves the San Francisco Bay area, says the cost of debit fraud has exceeded what the bank is willing to justify. To counter losses associated with fraud, Fremont is transitioning its debit portfolio from the mag-stripe to the chip.

The move, however, is not yet being made toward EMV. At the moment, the bank is transitioning its cards to tap-and-go near-field-communication chip technology offered through STAR Network's CertiFlash program. [See A Step Closer to EMV.]

"We've seen a significant increase in this kind of fraud," says Chris Olson, Fremont's chief operating and enterprise risk officer. "If I look at the first six months of 2010, as compared to the first six months of 2011, we've seen a 70 percent increase in the number of claims, which represents a 55 percent increase in the number of dollar claims. So it is significant for us."

UNFCU's Halpern says growing incidents of debit fraud will likely encourage other institutions to make similar moves. "The mag-stripe was never meant to be secure. And the technology is so old," he says. ... To see more movement in the U.S., I think we need to see more from the acquirers. But growing fraud is a driving force as well."


About the Author

Tracy Kitten

Tracy Kitten

Former Director of Global Events Content and Executive Editor, BankInfoSecurity & CUInfoSecurity

Kitten was director of global events content and an executive editor at ISMG. A veteran journalist with more than 20 years of experience, she covered the financial sector for over 10 years. Before joining Information Security Media Group in 2010, she covered the financial self-service industry as the senior editor of ATMmarketplace, part of Networld Media. Kitten has been a regular speaker at domestic and international conferences, and was the keynote at ATMIA's U.S. and Canadian conferences in 2009. She has been quoted by CNN.com, ABC News, Bankrate.com and MSN Money.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing bankinfosecurity.in, you agree to our use of cookies.