Today is the deadline for US retailers to switch over to a payment technology called EMV. That means you’ll have to start verifying your credit card with a chip, as well as a swipe. We talked to payments industry experts about how EMV works, what’s happening today, and what it means for the average shopper.
EMV stands for “Europay, MasterCard, and Visa,” which are the three companies that originally developed the specifications for the technology. Today it’s supported by several other companies, including Discover, American Express, and UnionPay, through an organization called EMVCo.
EMV cards have microprocessor chips inside which make it harder for anyone to steal your account information while you’re making a payment.
On the credit cards we’ve all used in the US until now, the card number was stored on the magnetic stripe on the back side of the card. When you swipe the card at the checkout, the checkout terminal reads your card information from that stripe and then sends it through a network to have the money moved from your account to the retailer. That number is static, which means that it’s always the same number for every transaction — which makes it relatively easy for fraudsters to hack the terminal or the network, steal your card number, and use it elsewhere.
But the microprocessor chip in your EMV card generates a unique code for every transaction. Even if a criminal manages to grab the code from the store, it’s mostly useless because it won’t work a second time, and it can’t be traced back to your real card number.
“It has the same information as the magnetic stripe on your old card, but creates a unique code that gets reorganized with each purchase,” explains John Krauss, Discover’s senior manager for card payments and reissuance strategy. “The code generated takes into account numerous different variables and is not linked to a cardmember’s account.”
The result, according to most of the major players in the payments industry, is better protection against counterfeit fraud. “This process makes chip card information more difficult to steal and therefore makes a chip card more difficult to counterfeit, said Dina DeMerell, executive director of payments security at Chase Card Services.
And, despite some conspiracy theories, it’s not any kind of tracking chip.
Today, October 1, is a deadline for the EMV switchover that the payments industry has given to retailers. After today, retailers who don’t accept EMV payments may be responsible for the costs of what’s called “counterfeit fraud.” That’s a type of credit card fraud based on stealing credit card numbers — by hacking a checkout terminal, for example — and using them to make copies of the victims’ card.
Before today, credit card companies took responsibility for fraudulent purchases. If someone stole your MasterCard number and used it to buy $500 worth of shoes, MasterCard — not you and usually not the store — would cover that cost. After today, if stores don’t accept EMV payments, it’s up to them, rather the card company, to cover the cost of counterfeit fraud.
If stores accept EMV payments, the credit card companies still accept liability for counterfeit fraud. That’s true even if the store accepts EMV payments, but also accepts magnetic stripe payments, and one of those magnetic stripe payments turns out to be fraudulent. The technical wording from Visa is, “The party that has made investment in EMV deployment is protected from financial liability for card-present counterfeit fraud losses on this date. If neither or both parties are EMV compliant, the fraud liability remains the same as it is today.”
Basically, the credit card companies have decided that magnetic stripe transactions are so vulnerable to counterfeit fraud that they don’t want to be responsible for that liability anymore, but they believe EMV is secure enough that they’re willing to be liable for its much more limited risk.
Today is a big deadline for the payments industry, but it’s not a big change for shoppers at the checkout, and most people probably won’t even notice.
For consumers, the “EMV migration” really happens when your bank or credit card company issues you a card with a chip, so if you already have a chip card, you’ve already “migrated” to EMV. You can start using the chip, if you haven’t already, or you can pay by swiping the magnetic stripe. That won’t change today.
And if you don’t have a chip card yet, you’ll still be able to swipe your card’s magnetic stripe, just like you’ve done for years. That won’t change today, either. The EMV terminals that have been installed so far here in the U.S. also accept payments from magnetic stripe cards, and that’s not likely to go away anytime soon.
“Whether you have a chip card or not, you will be able to shop everywhere, just as you do today,” says Randy Vanderhoof, director of the EMV Migration Forum.
Chip cards also still have magnetic stripes, so you can always swipe your card if the checkout terminal isn’t EMV-enabled. That’s a good thing, because even though the big deadline for businesses to accept EMV is technically today, but not all of them have made it. And some businesses, like gas stations, are actually on a different timeline.
If you already have a chip card, you’ve probably been able to use it at some stores, but not others, for the last several months, and that’s likely to be the case for the foreseeable future. “By no means will the migration to EMV be complete this year,” Krauss says. “It may take several years before a vast majority of merchants are EMV-enabled.” For most businesses, converting EMV requires upgrading or replacing older checkout terminals, which can be an expensive process, so it takes some time.
It’s not hard to tell whether a checkout terminal accepts EMV payments; look near the bottom for a slot to insert your card. Most of them are pretty obvious. And if the checkout terminal is EMV enabled, the cashier may prompt you to insert your chip card (if you have one). But when in doubt, swipe. “If unsure whether a business accepts chip cards, swipe the same card the same way as today,” says DeMerrel, and Krauss has the same advice.
Checking out with a chip card isn’t complicated, and it’s really not that different from checking out with your old, familiar magnetic stripe card. There’s really only one difference: instead of swiping your card to pay, you stick it in a slot on the terminal and leave it there while the transaction processes. It’s not that different from how some ATMs already work.
That may add a few extra seconds to your checkout process, industry experts admit. “The time difference between the two isn’t significant, but the process does take a little longer,” said Krauss, who added that Discover is working with merchants to make the payment approval process faster. That’s probably true for other card issuers as well, but some of the extra time probably won’t go away.
“If it seems like it takes a few extra seconds to make a transaction, it’s because there are advanced security processes going on behind the scenes,” explained Vanderhoof.
But, according to a Wells Fargo representative, “the difference is negligible — generally only a few seconds.”
Otherwise, the transaction itself won’t change. “Most chip cards will work the same as the cards they are replacing — credit cards will require signature and debit cards will use PINs,” says Vanderhoof.
If you’re using a debit card, you’ll still type in your PIN like you always have. It’s still up to the store, or your credit card issuer, when to ask for your signature on a credit card transaction. Discover, for instance, says that all of its cardholders will have to provide a signature for all purchases. And according to a release from Visa, most of its’ cardholders credit card purchases under $25 or even sometimes $50 won’t require a PIN or signature.
Just remember to take your card out of the terminal when you’re done.
“All of the major card issuers have started issuing chip cards,” says Vanderhoof. “Chip cards are being issued regularly, so if a consumer doesn’t have one yet, they probably will soon.”
But “soon” is a relative term. A recent report from MasterCard predicts that by the end of this year less than two thirds (63 percent) of credit and debit cards in the U.S. will have chips. The process of issuing chip cards should be “nearly complete” by 2017.
Capital One started issuing chip cards last year, for instance, and it expects to keep issuing new chip cards as its customers’ old magnetic stripe cards expire through 2016, according to a representative.
Meanwhile, Chase says it has issued 64 million chip cards so far, in a mixture of credit and debit. The bank expects to issue chip cards to 70 percent of its cardholders by the end of this year, and DeMerell says, “Customers who don’t have chip cards will get one in the mail in the next 12 months.” Some branches are also able to print new chip cards on the spot, for those who are getting impatient.
And Discover started issuing chip cards earlier this year and is now issuing only chip cards — no more magnetic stripe ones — and the company says it has already issued several million chip cards. “Accounts comprising the majority of our sales will be issued a chip card by the end of 2015,” says Krauss, but it sounds like at least some Discover cardholders will get their chip cards later than that.
Of course, if you’re not sure when you’ll be getting a chip card, or if you really, really want one right away, check with your bank or card issuer.
Despite today’s deadline for most retailers, the “EMV migration” isn’t happening overnight, so there’s no need to panic — or rejoice — over sweeping, instant changes at the checkout. This is a long, gradual process, and today’s liability shift deadline is just one milestone.
In a recent release, Visa said, “From experience in other countries, Visa expects it will take an additional 2-3 years for 60 to 70 percent of transactions to be completed by a chip card and chip terminal, and 4-5 years to reach closer to 90 percent.”
Image credits: AP Images