Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity

    EMV Liability Shift Still Leaves Missing Pieces

    Written by

    Robert Lemos
    Published October 26, 2015
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      It’s perhaps the weirdest war of words ever.

      Driven by a shift in liability for fraudulent transactions, banks and retail firms have taken to lobbing critical press releases at each other, charging that the other side has not done enough to protect consumer data. At its heart, the debate boils down to whether retailers’ forced move to chipped credit cards is enough to protect customers’ data or whether additional measures need to be rolled out as well.

      Retailers, which have rushed the rollout of point-of-sale infrastructure to accept chip cards, argue that banks should require PINs to secure transactions, a proposition that requires financial institutions to roll out expensive infrastructure and pay for costly support.

      “Retailers have invested billions to implement new chip-enabled card readers in stores nationwide,” Brian Dodge, executive vice president of the Retail Industry Leaders Association (RILA), said in a statement. “Now, retailers are asking banks and credit unions to meet that commitment by issuing new chip cards with PINs.”

      Banks have fired back, stating that retailers need to secure their payment infrastructure to protect consumer payment data from hard-to-stop cyber-criminals.

      “Millions of Americans have had their most sensitive information compromised in retailer data breaches, so it’s understandable that consumers are concerned that retailers aren’t doing more to prevent future hacking incidents,” Doug Johnson, the American Bankers Association’s senior vice president of payments and cyber-security policy, said in a recent release. “… Retailers need to join with banks and payment networks to combat fraud and focus on the future by updating their payment security systems and proactively working to address emerging threats head-on.”

      Welcome to the post-liability-shift world.

      Retailers, payment processors and card issuers rushed to meet an Oct. 1 deadline to implement the Europay-Mastercard-Visa (EMV) standard for payment security, also known as chip-and-PIN security. Most, however, have missed the deadline. The standard requires credit-card issuers to replace mag-stripe credit and debit cards with smart cards capable of encrypting transaction data and requires retailers to upgrade their payment-card readers, resulting in increased costs to the businesses.

      With Oct. 1 in the rearview mirror, the least-compliant participant in the transaction chain will be responsible for any fraud. The liability shift means that issuers will be held financially responsible for fraudulent transactions, if they have not issued new chip cards to consumers, while the merchants’ payment-processing partners will be held liable if a mag-stripe transaction results in fraud, and those fines could be passed onto the retailers.

      The penalties could be high. Still, retailers have replaced less than a quarter of the 12 million payment terminals, according to financial-market services firm CreditCards.com. Only 40 percent are expected to be upgraded by the end of the year. In addition, fewer than half of consumers have received a chip card to replace an existing mag-stripe credit or debit card, Matt Schulz, senior analyst for the firm, told eWEEK.

      “The giant retailers are the most likely to have this up and running,” he said. “When you get to the mom-and-pop stores, many of them do not even know this is happening.”

      While the complexity of the issue may be to blame for the lack of adoption, some retailers are undoubtedly taking a wait-and-see attitude, because the technology has some practical issues as well. Some consumers and retailers, for example, have complained that processing a transaction via chip cards takes more time, Schulz said.

      “I’ve heard from consumers that I’ve talked to that it takes longer, and people think that it is a little bit inconvenient to take extra time,” he said.

      It boils down to pitting the potential losses due to fraud against the losses due to customer confusion or impatience with the new technology, Richard Peters, director of corporate consultancy Berkeley Research Group, told eWEEK.

      “It seems as if there were a lot of misses in the Oct. 1 deadline,” he said. “It was announced years ahead of time that this was coming, but here we are with the majority of retailers still not changed over.”

      Even when the technology is 100 percent deployed, transactions still will not be totally secure, says Peters. Retailers have a point that chip cards without a PIN are only half of a solution. The chip in the payment card can protect the data on the card, but relying on a signature is a less secure way to authorize the transaction, he said.

      “The future part of this, a big piece of that is the PIN,” Peters said. “With the PIN, you have something you know along with something that you have, and that makes it more secure.”

      The fully implemented technology is not foolproof, either. Recent reports that criminals had circumvented chip-and-PIN in 2011 join prior reports of security vulnerabilities to call into question whether EMV can protect consumers.

      Moreover, the technology is a solution to only a specific piece of the fraud equation—counterfeit-card fraud. In the United Kingdom, for example, chip-and-PIN has resulted in a drop in counterfeit fraud from $259 million in 2008 to $73 million in 2014, according to Financial Fraud Action UK.

      Online fraud, however, is not solved by chip-and-PIN technology. The same report found that card-not-present fraud initially declined after 2008, but had recovered to the same level by 2014.

      “Online fraud is the low-hanging fruit that counterfeiting used to be, so criminals are switching to that tactic,” CreditCards.com’s Schulz said. “There are a lot of calls in the industry for approaches necessary to address online fraud.”

      Robert Lemos
      Robert Lemos
      Robert Lemos is an award-winning journalist who has covered information security, cybercrime and technology's impact on society for almost two decades. A former research engineer, he's written for Ars Technica, CNET, eWEEK, MIT Technology Review, Threatpost and ZDNet. He won the prestigious Sigma Delta Chi award from the Society of Professional Journalists in 2003 for his coverage of the Blaster worm and its impact, and the SANS Institute's Top Cybersecurity Journalists in 2010 and 2014.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×