U.S. CREDIT CARD companies and banks are beginning to distribute new credit cards with an embedded chip as well as the magnetic strip
that has been in use since the 1970s.
Named for its promoters Europay,
MasterCard, and Visa, the EMV system augments the old magnetic strip
cards with a chip that can authenticate a transaction using cryptography—a so-called “smartcard.” EMV
was deployed in the U.K. from 2003
to 2006 and in other European countries shortly afterward; it is now being
rolled out from India to Canada. The
idea was to cut fraud drastically, but
real-world experiences turned out to
be somewhat more difficult than theory. As shown in Figure 1, fraud in the
U.K. went up, then down, and is now
heading upward again.
The idea behind EMV is simple
enough: The card is authenticated by
a chip that is much more difficult to
forge than the magnetic strip. The card-
holder may be identified by a signature
as before, or by a PIN; the chip has the
ability to verify the PIN locally. Banks
in the U.K. decided to use PIN verifica-
tion wherever possible, so the system
there is branded “chip and PIN”; in
Singapore, it is “chip and signature”
as banks decided to continue using
signatures at the point of sale. The U.S.
scheme is a mixture, with some banks
issuing chip-and-PIN cards and others
going down the signature route. We
may therefore be about to see a large
natural experiment as to whether it
is better to authenticate transactions
with a signature or a PIN.
The key question will be, “better for
whom?” The European experience sug-
gests this will not be a straight fight be-
tween the fraudsters and everyone else.
The interests of banks, merchants,
regulators, vendors, and consumers
clash in interesting ways; the outcome
will not just be determined by how the
fraudsters adapt to the technology, but
by a complex tussle over who pays for
the upgrade and who enjoys the ben-
efits. Fraud savings are not the biggest
game in town; while fraud costs the
U.S. $3–$4 billion, interchange fees are
an extraordinary $30 billion and EMV
will likely have an impact on both.
Although U.S. banks are issuing EMV
cards now, it will be some time before
they start to see a reduction in fraud.
Cards will still have the magnetic strip
and banks will continue to accept
magnetic strip transactions because
it will take many years to upgrade all
the ATMs and point-of-sale terminals.
EMV terminals still process unencrypt-ed card numbers, expiration dates, and
PINs, so if hacked (as occurred in the
late-2013 Target data breach), crimi-
EMV: Why Payment
What lessons might we learn from the chip cards used for
payments in Europe, now that the U.S. is adopting them too?
Although U.S. banks
are issuing EMV
cards now, it will be
some time before
they start to see a
reduction in fraud.