PIN? WHAT PIN?
The U.S. is the last major country to switch to chip cards. But there’s a major difference between most new cards being issued here and those used overseas for years. And some big merchants aren’t happy about that.
In Europe and most developed countries, chip cards require customers to type in a personal identification number, or PIN, for each transaction. Many debit cards in the U.S. also require a PIN. But most of the new credit cards only require a signature.
Home Depot, Walmart, Kroger and other merchants recently sued Visa and MasterCard. They allege PIN-less chip cards are less secure, and that they’re pushing merchants toward accepting less-secure transactions that earn higher fees for the credit card networks and banks that issue most cards.
“We have a half-(hearted) approach in the United States and we did it out of deference to the (banks) who didn’t want to spend money” on the more sophisticated chip cards, said Mark Horwedel, CEO of The Merchant Advisory Group, which represents more than 100 big retailers.
It is harder for criminals to get a customer’s PIN number, providing another security layer, added Jared Drieling, of The Strawhecker Group, a payment data analysis firm.
But the switch to PIN cards would be tougher for customers, merchants and banks, he acknowledged.
“Consumers clearly don’t like to remember PINs,” he said, and not all merchants have the keypads required to enter PIN numbers. “It would be more expensive to support.”
A spokesman for the credit card industry declined to comment on the lawsuits, but said they won’t affect the switch to chip cards. “Those are disputes over money,” said Jason Oxman, chief executive of the Electronic Transactions Association.
CREDIT CARD SHUFFLE
Merchants, banks and other players in the credit card industry have been spending billions on the switch to chip cards. Under the credit card networks’ rules, merchants who miss a deadline generally have to absorb fraud costs from then on. Here are the deadlines for various players:
Oct. 1, 2015: Banks and merchants on the Visa, MasterCard, American Express and Discover networks must issue or accept chip cards.
Oct. 1, 2016: Bank ATMs on MasterCard’s network.
Oct. 1, 2017: Service station fuel pumps on the four networks, and ATMs on Visa’s network.
These are trying times for shoppers who use plastic, and for merchants who accept it. Which is most of both.
Nearly a year has passed since the Oct. 1, 2015, industry deadline when merchants were supposed to be able to accept upgraded credit and debit cards aimed at squelching fraud. The deadline also applied to banks issuing the new "chip" cards, a name stemming from the small chips embedded in them.
But only about half of the nation’s merchants have new terminals to process the cards, and many who do face delays in getting them tested and certified, according to industry experts.
Meanwhile merchants who haven’t made the switch — or haven’t been able to — are grumbling about higher fraud costs, according to industry players. That’s because the major card networks, Visa and MasterCard, shifted liability for fraud to merchants after Oct. 1 unless they used the new chip system. Previously, banks and other card issuers bore those costs.
And some businesses, especially fast-food restaurants, have put off the switch out of fear the slower chip card process will gum up operations during busy periods.
Stuck in the middle are customers like Spencer Martinez, who wonder what to do when it comes time to pay for their purchases: swipe (for the traditional card-readers) or insert (for chip card terminals).
With retailers using a variety of old and new terminals, or new ones that aren’t yet working, “you never know which one you’re going to get,” said Martinez, a Californian who was recently buying supplies at the Home Depot in Midtown Atlanta.
Home Depot was among the first big retailers to make the switch last year. But the Atlanta-based company, as well as Walmart and Kroger, recently sued Visa and MasterCard, alleging that the new cards and terminals still aren't fraud-proof and require them to pay too much for some transactions.
Some companies that have converted are angry they’re not seeing any payback from the upgrade, said Mark Horwedel, chief executive of The Merchant Advisory Group, a trade group representing more than 100 of the largest retailers.
They’ve “seen no reductions in their fraud-related (costs) despite spending millions and millions of dollars” on new terminals, he said. Instead, the banks and other credit card issuers are reaping the savings, he said.
“This is a big money grab, frankly,” he said.
A representative for the card networks, banks and other card issuers acknowledged problems with the switch, but said it is making a dent in credit card fraud. The industry also is rolling out fixes, he said.
“We are seeing a drop in fraud,” said Jason Oxman, chief executive of the Electronic Transactions Association. He cited data from Visa indicating that fraud dropped 26 percent at merchants that have made the switch.
“But the problem today is criminals still have plenty of merchants to choose from” among companies that haven’t upgraded, said Oxman.
More security, longer waits
Traditional cards have customer data recorded on magnetic strips that are more easily copied and counterfeited. When fraud happened, card issuers typically absorbed the cost or passed it on to customers through finance charges.
The chips in the new cards create an identity code for each transaction, in theory making counterfeiting much harder.
Banks have upgraded about 60 percent of the 1 billion credit and debit cards held by U.S. consumers, while about 30 percent of the nation’s 8 million merchants have upgraded machines in operation, according to Oxman.
Up next, with an Oct. 1 deadline this year: bank ATMs on MasterCard’s network. Service station fuel pumps and ATMs on Visa’s system have until Oct. 1, 2017.
The new cards require customers to plug their card into a new type of terminal until the transaction is done. It can take up to 30 seconds, by some estimates — much longer than the moment or two for a swipe.
The delay bothers some customers and businesses.
Mellow Mushroom, an Atlanta-based pizza chain, hasn’t switched yet due to concerns over cost and complexity.
“It’s not as simple as picking up one terminal,” said Annica Kreider, Mellow Mushroom’s vice president of brand development. After studying options for a year, she said, the company believes many restaurants will have to upgrade their wi-fi networks and buy hand-held terminals still under development.
So far, she said, Mellow Mushroom’s restaurants have seen a “small increase” in fraud costs, she said.
Melissa Bigler, a waitress at the Mellow Mushroom in Midtown Atlanta, foresees big headaches during busy periods or when customers want to split a check on separate cards, because of the longer processing times.
“If you have a bunch of credit cards, it’s going to take a while,” she said.
Oxman said Visa and MasterCard are rolling out a software fix that should cut processing times to a few seconds. But companies are just beginning to install the upgrades.
Meanwhile, many merchants are still waiting to install upgraded equipment and get it certified.
Mid-sized chains with a dozen to a few hundred shops “have the most difficult chore of all,” said Horwedel, with the retailer trade group. He said fraud-related costs for some are up as much as 1,000 percent this year, he said.
Caught in the middle
Small mom-and-pop stores made the jump fairly easily, he said, because they only had to switch out one or two terminals. Likewise, big retailers have lots of money to tackle the problem.
But mid-sized merchants had to tackle a task almost as complex as the giant retailers’, with fewer resources, said Horwedel.
“I think it will be another two or three years of pain before it gets appreciably better,” he said.
Visa and MasterCard recently moved to streamline testing and certification, Oxman said. In the interim, Visa stopped charging merchants for fraudulent purchases below $25, and will cap such charges to 10 per month starting in October.
Many merchants decided to wait until after last year’s Christmas shopping season to begin the transition to chip cards, noted Jared Drieling, business intelligence manager at The Strawhecker Group, a payment data analysis firm.
In the rush to upgrade earlier this year, many found there weren’t enough outside consulting firms to help them put together their systems, test them and get them certified.
“That’s really the bottleneck,” he said, though he added the roll-out is not going that badly considering the size of the American retail market.
The United States was one of the last major developed nations to switch to the chip cards, widely used in Europe for more than a decade.
“We’re not even a year into it, and I think we’ve made significant progress,” Drieling said.
