Visa kick starts EMV chip migration in the US
Visa’s announcement last month of measures to encourage US migration to EMV chip is hugely significant, not just for the US, but for the card payments industry worldwide.
We can now realistically look forward to moving from the current uncomfortable hybrid world of magnetic stripe coexisting with chip technology, to a simpler, more efficient, and more secure chip-only future based on the global EMV standard.
In an article published in February’s Bulletin entitled “The time is right for EMV chip in the US” I argued that the US is approaching a tipping point in terms of pressure for EMV migration, from cardholders, merchants, regulators and the rest of the world. I also noted that the last remaining barrier to migration was a lack of any obvious coordination and leadership within the relatively fragmented US card payments industry. Visa is to be congratulated on now demonstrating such leadership. Of course, the other card schemes will need to join Visa if its initiatives are to have teeth, but MasterCard must surely follow suit soon.
The most important of Visa’s announcements is the extension of a chip liability shift to the US. Simply stated, this means that if a fraudulent transaction takes place which could have been prevented by chip technology, then liability for the loss passes to whichever party has not deployed chip. Remarkably, this will apply to cross-border as well as domestic transactions. In other words, if, say, a UK card with a counterfeit magnetic stripe is used fraudulently at a US merchant, then the US acquiring bank will be liable for the fraud.
While it may seem churlish to pick fault with Visa’s initiative, three anomalies are worth noting.
Firstly, the liability shift does not appear to apply to ATM transactions. This is surprising since US ATMs are an obvious target for fraud. Secondly, Visa still allows signature-based verification with chip cards. This is disappointing since chip-enabled PIN verification is much more secure and convenient. If you’re going to migrate to EMV chip you may as well migrate to chip and PIN at the same time, as in the UK for example. Hopefully, both these anomalies represent a pragmatic attempt by Visa to minimise the pain of the migration, and the necessary changes will be introduced later.
The third anomaly is the emphasis which Visa places on encouraging contactless and mobile phone payments. Regular readers will know that I remain sceptical about contactless payment in general, and mobile NFC in particular, mainly because of the lack of a critical mass acceptance infrastructure. Visa is clearly attempting to spark the creation of this infrastructure by making it relatively attractive for merchants to deploy contactless/NFC terminals (in terms of waiving onerous PCI DSS certification requirements; note also that the liability shift will not apply to mobile NFC payments). Personally, I believe this is misguided, and risks complicating and undermining the really important objective of EMV migration. But good luck to Visa, and let’s hope I’m wrong!
Nick Collin, Banking Automation Bulletin, September 2011