Once the world moves to EMV, the card companies have said they will get rid of the mag-stripe," said Caroline Walpole, a smart card expert in the United Kingdom and senior business consultant for Omaha, Neb.-based ACI Worldwide. "But until everybody in the world is ready, we can’t lose the mag-stripe."
Fortunately, almost "everybody" in the world is ready — everybody but the United States. But experts like Walpole say the United States’ migration isn’t far behind Canada, where the EMV shift is expected to wrap by 2007.
The problem is that until the United States jumps aboard, the rest of the world will have to continue offering both magnetic-stripe and chip-card options at the POS and ATM. Although the mag-stripe will primarily serve as a back-up, as the rest of the world becomes more accustom to chip-cards, the States’ old-fashioned mag-stripe technology is expected to get the boot.
"Many countries are saying that the only reason they have fraud is because of the mag-stripe," Walpole said. "So you could say that within your own country you would use EMV transactions, and for international transactions you would use the mag-stripe. … But that gets confusing," and it ultimately doesn’t eliminate the higher risk of fraud that using a mag-stripe card poses.
Francois Lasnier is North American vice president for Axalto Holding N.V., a France-based provider of smart cards and POS terminals. Lasnier said that he expects MasterCard and Visa to mandate the technology in the United States within the next five years, after the rest of the world is ready to roll.
"That’s the last link is the smart card infrastructure," Lasnier said. "The systems and the payment technology are ready. The acquirers are ready ... and because they are ready for the Canadian market, it will set up well for deployment in the U.S."
"In next two or three years, there won’t be anything to hold it up," he added. "The U.S. will have to catch up."
EMV: A refresher
If you’re at all involved with debit/ATM or credit cards, you’ve heard of EMV — the Europay/MasterCard/Visa standard initiated in 1996 by the three card associations for which the standard is named.
EMV is a standard for chip-embedded cards, often referred to as smart cards. Instead of using a mag-stripe to store account information, the cards use chips. At the moment, however, the cards are equipped with both chips and stripes. And MasterCard and Visa have not said when the stripes will permanently fall from the cards.
In 1999, Europay, MasterCard and Visa founded EMVCo, an independent organization, to manage and enhance EMV specifications. EMVCo updates standards as technology improves. EMVCo’s purpose: to reduce incidents of fraud resulting from compromised cards at the ATM and POS.
Smart cards were an obvious choice for EMV: They’re more secure and can hold more information than mag-stripes.
According to one EMV report, Visa estimates that counterfeiting can be decreased by at least 70 percent with smart cards. And a standard 64 KB smart-card chip can hold about 13 times more information than a standard mag-stripe.
But the idea of using smart cards at the ATM and POS in the United States hasn’t received a warm reception.
"EMV in the U.S. has not gotten out of the starting box," said Martin Macmillan, London-based Level Four Software’s chief executive. "But we noticed fraudsters getting wise in the U.K., and we’re seeing some of this moving into the U.S."
U.K. led the way
The financial industry in the United Kingdom was the first to endorse EMV specifications when card fraud soared in the mid-'90s. In 1999, the U.K. began converting its 80 million mag-stripe debit and credit cards to smart cards. It also required that ATMs and POS terminals be equipped with EMV-compliant card readers.
Today, 80 percent of the U.K.’s cards are EMV compliant, Walpole said. That’s larger because the EMV compliance deadline for the European Union was January 2005. Any fraud at the ATM or POS that could have been prevented with EMV compliance will be the responsibility of ATM deployer or retailer.
"So you could have a customer with an EMV card, but because you did not have an EMV terminal, you had fraud. In that case, you are liable," Walpole said.
The same liability will hit Central and Eastern Europe, the Middle East, Africa and Asia/Pacific in January 2006, the compliance deadline for those regions.
"That would make me, as a U.S. banker, start to think, ‘You know what?’ I’m going to have to start looking at this,’" Walpole said. "Some U.S. banks are global banks, and they’re already rolling this out in the rest of the world — like Citibank. So it’s not like these U.S. banks aren’t getting experience."
The other push: the expected influx of fraud.
"The fraudsters now have difficulty with the cards in the U.K. and France," Walpole said. "So they’ll just take those cards across the border where there is no EMV. The U.S. has said publicly that they aren’t moving to EMV, so fraudsters know to go there."
But making the conversion to EMV is expensive, and the United States has not experienced enough fraud to justify the switch, said Randy Vanderhoof, executive director of the Princeton Junction, N.J.-based Smart Card Alliance.
Also, as Macmillan points out, "POS fraud has not been an issue in the U.S. (as it was in the U.K.)." And there are a few reasons for that, including the United States’ use of PIN-based debit transactions. In the U.K., PIN-based transactions were not the norm before EMV.
However, there already are signs of change. Lasnier said approximately 35 percent of POS systems in the United States are ready for EMV. And he estimates that 50 percent of the POS devices being sold in the United States include smart-card readers.
Robin Gustin, president of Capital Security Systems, a Hicksville, N.Y. ATM systems technology company, also believes EMV is on the way. Her company is marketing its Super ATM platform, which includes an EMV-compliant smart-card reader, in the United States.
"What we developed was a series of process patents," Gustin said. "It’s a process of using the ATMs for actions." Basically, companies buy the patent to use the platform."
But Gustin said it could require a mandate before the United States as a whole is motivated to shift. "The EMV platform, the technology and the legislation all have come together, and the banks have to make the business decision. After that, it will be here like is everywhere else in the world.
