On August 9, 2011, Visa USA announced an interesting program to give merchants a carrot to drive them to adopt dual-interface chip technology terminals that will accept EMV (aka Chip and PIN) as well as mobile payments using near field communication (NFC) also known as contactless cards and devices that can transmit card information via NFC.
The carrot Visa USA is offering merchants is a waiver on annual PCI compliance if merchants implement dual-interface chip technology terminals. The criteria merchants must meet in order to obtain the waiver is:
- At least 75% of the merchant’s transactions must originate from dual interface EMV chip-enabled terminals;
- The merchant validated their compliance with the PCI DSS within the last 12 months with the merchant’s acquiring bank or the merchant filed a defined remediation plan with the merchant’s acquiring bank;
- The merchant must have confirmed that they do not store sensitive information (i.e., track data, PIN, CVV) after completion of any transaction; and
- Not involved in a breach situation.
The first requirement certainly drives the swap out of old terminals. However, until banks start issuing the EMV and/or contactless cards in bulk, the investment by merchants in the dual-interface chip technology terminals is not going to happen. What I am sure Visa USA is hoping is to get a large merchant like Wal-Mart, Best Buy or Target to buy into the program and therefore drive the issuers and banks to get on board. Without a big box merchant, this program is pretty much dead on arrival.
The next two points are pretty much the same thing. In order to be compliant with the PCI DSS, a merchant must prove that it is not storing sensitive credit card information. The only reason I can see for the third point is, I am sure, to cover the “defined remediation plan” of the second point in the event that the gap found was related to storage of sensitive information.
The fourth and final point just makes complete sense. If a merchant has been breached, they must have shown that they are PCI compliant before being allowed to be waived from a PCI assessment.
Is it a good idea to waive the annual PCI assessment for merchants all in the name of getting them to adopt a new technology? Particularly technologies that do not entirely solve the fraud issue with credit cards. Yes, you heard me right. EMV and contactless technologies do not entirely solve the fraud problem. While they minimize fraud in the case of card present transactions, they do not even address fraud in card not present transactions. And it is in card not present transactions where fraud is most prevalent.
So why the push for EMV and contactless cards? That is a good question. The proponents of EMV will tell you it is to curb fraudulent purchases. However according the latest information I could find, while EMV is expected to drop card present fraud by 35% this year in Canada (the first full year they have EMV); card not present fraud is continuing to go up. Based on statistics from a variety of sources, card not present fraud ranges anywhere from 40% to more than 60% of the total card fraud committed.
So, if EMV and contactless do little or nothing for the majority of fraud being committed, why the push for them? That is a really good question. And to tell you the truth, I have no idea why Visa USA is pushing this other than to make things consistent worldwide. And from a standpoint of curtailing card present fraud, at less than 5% in 2009 (the last year statistics are available); there is certainly no ROI for EMV. This is why EMV has not been rolled out in the US. There is no payback if banks and merchants invest in EMV.
But then you have contactless cards. Contactless cards rely on near field communications (NFC). NFC is made possible by radio frequency identification (RFID). Like the magnetic stripe, the RFID in a contactless card only has the PIN block encrypted. Numerous proofs of concept attacks have been documented against these contactless cards. The bad news for cardholders is that unlike EMV and regular credit cards, a contactless card can be skimmed without their knowledge or even suspicion. The only way the consumer knows their contactless card has been skimmed is when they get their statement and see the fraudulent charges.
But the really stupid thing about EMV and contactless cards is that until every merchant has the ability to process them, they will continue to have to have a magnetic stripe. This is particularly true for automated teller machines (ATM). Even in Europe where EMV is the only type of card available, ATMs still require a magnetic stripe. This would hold true for the US as well since even the major banks cannot afford to change out the card readers in all of their ATMs to support EMV and contactless. As a result, any transition to these new cards will be a very long time coming.
That is not to say that EMV or even contactless could not take a significant bite out of card not present fraud. While the hardware for the cards exists for PCs, the problem is that such a solution would require a standard application program interface (API) which the card brands, banks, payment processors and merchants have done nothing to create. Over the years there have been a number solutions proposed by banks and card brands, but nothing that was adopted by everyone. As a result, instead of fixing the problem, everyone just accepts it.
The bottom line appears to be that Visa USA is pushing high technology as a solution for card present fraud that just does not address the real problem. However, I guess it is better to appear like you are doing something rather than not doing anything.
Relevant reading:
The Chip And PIN Debate – Part 1
PCI SSC Nixes PA-DSS Certification For Mobile Payments Applications For A While
PCI Guru 