Preventing Credit Card Data Theft Is Harder Than It Should Be

NEWS ANALYSIS: It's becoming increasingly apparent that it's hard for businesses to prevent credit card data theft. The good news is that it's possible to protect yourself, but the bad news is that it's not that easy.

When I first looked into the credit card security breach at Target and later at Neiman Marcus, the solution seemed easy. If you want to protect yourself from having the mag stripe information on your card stolen, then use a card with an EMV chip.

If your business wants at least some protection, then get a point-of-sale (POS) terminal that will accept cards with EMV chips.

Better yet, do both.

As is the case with many seemingly simple problems, it turns out that this isn't a problem that's easy to solve. You may not be able to get a credit card with an EMV chip, and if you do find one, you may not be able to find a place near your home or office where you can use it. Worse, if you want to protect your customers and yourself by accepting these more secure cards, you might not be able to.

But what's even worse is that the banks and other card issuers may not know whether their own organization has a provision for providing secure credit cards or for providing the POS terminals and software, as well as the processing networks necessary to work with EMV chip credit cards. The only certainty is that there are several banks that simply don't offer them, and don't plan to unless they're forced to do so.

I did a quick survey of banks in the U.S. that provide the enhanced security of EMV chips. I found a mixed bag of offerings and a lot of confusion. For example, I was assured by a Bank of America spokesperson that this global bank only provides EMV-equipped cards to major corporations. But a check of the bank's Website reveals that, in fact, the bank does offer such cards to consumers.

Likewise, I was told by a branch manager at PNC Bank, which serves the eastern United States, that such cards are offered to consumers and small businesses, but a check with the corporate headquarters shows that they are not offered at all.

Fortunately, some banks will let you search for cards with the EMV chip on their Websites. For banks that have what are called Tap Technology chips, you may also search for those. Tap Technology is similar to an EMV card but works by tapping the card on the reader, which then gets the information wirelessly. This method is less secure than EMV, but it does prevent card cloning.

The best source for figuring this out was a Website called Nerd Wallet, which did a study. Other major banks, including Chase and CitiBank, offer at least some such cards, but generally they're aimed at travelers.

So what's standing in the way of the general availability of more secure credit cards for U.S. businesses and consumers? In a word, it's inertia. There's a significant "chicken and egg" process going on where the banks don't want to offer secure cards because merchants don't accept them. Merchants won't accept EMV cards because customers can't get the cards.

Wayne Rash

Wayne Rash

Wayne Rash is a freelance writer and editor with a 35 year history covering technology. He’s a frequent speaker on business, technology issues and enterprise computing. He covers Washington and...