Sep 20, 2013, 11:40 am
Last edit by: philemer
Posts from 1/1/16 onward can be found here: http://www.flyertalk.com/forum/credit-card-programs/1739359-2016-onward-usa-emv-cards-availability-q-chip-pin-signature.html
EMV wikipost volunteers: kebosabi
What is EMV?
EMV is a defacto global standard of technology where there is a visible microchip on the front of the card. It looks like this:
Who issues them?
See Google Docs spreadsheet in Post #1
SFOAMS also has created a list of excellent webpage that shows US EMV cards in a more interactive interface
Another site, which lets you narrow the search for an EMV card by various parameters, is http://www.spotterswiki.com/emv/index.php.
Several credit unions issue some form of Chip-and-PIN credit cards or prepaid cards. Prepaid EMV cards however are not recommended due to junk fees. USAA (currently restricted to members of military) used to offer Chip-and-PIN cards, but as late has backtracked to Chip-and-Signature priority.
Hey that's a cool Google Docs list! I know others that aren't on that list. How can I help by adding them to the list?
My bad for not putting this into the wiki sooner. Right now, the Google Docs is locked out of editing and only in "read-only" view because there were instances in the past where people would just delete the rows not thinking that it affects others viewing the list.
If you promise not to delete any rows and input all the pertinent info (annual fee, rewards, FTF, etc.), I can provide you with edit access. Just shoot me a PM to kebosabi with your gmail address and I'll provide you edit access.
Thanks for helping out!
As of October 2014, no USA-based card issuer offers Chip-and-PIN priority cards except for BMO Harris (Diners Club) and UN Federal Credit Union. Other major USA-based banks such as BofA, Chase, Citi, as well as others issue Chip-and-Signature cards which may work at many automated kiosks. However, bear in mind the word may is used above is a context where there is no absolute certainty of success for certain environments such as automated kiosks due to different natures of offline and online transactions. It is highly recommended to read Post #3 which lists real life FTer examples on how Chip-and-Signature worked and did not work at various transaction environments.
Can I upgrade it right now?
If it's listed on that Google Docs spreadsheet or SFOAMS' Silk page, wouldn't hurt to call/twitter them for a free upgrade. If you get the response you don't like, hang up, try again.
What is the difference between Chip-and-Signature and Chip-and-PIN?
You insert the chipped card into the slot. The physical contact terminal will read the EMV chip and the terminal will automatically read the preferred cardholder verification methods (called CVM) for that card.
Chip-and-Signature means that the terminal will printout a receipt for you to sign. This is the most prevalent authentication for most US issued EMV cards. Chip-and-Signature helps in a way that it will get through to face-to-face merchant transactions where you and the merchant do not speak the same language.
Chip-and-PIN means that the terminal will prompt you to input a PIN for authentication. Some credit union issued credit cards will have this CVM as secondary if Chip-and-Signature cannot be done. Chip-and-PIN is the more prevalent method of authentication used outside the US, especially in transaction environments where no human interaction is needed (i.e. automated gas pumps, toll roads, train kiosks, etc.).
The Google Docs spreadsheet will list which CVM are used in the EMV cards listed. Some cards can only do Chip-and-Signature. Other cards can do both Chip-and-Signature and Chip-and-PIN. And others might have a third option called No CVM (no authentication needed) which is reserved for low value transactions.
One chip can hold a lot more data, therefore it is capable of doing multiple verification methods. That's one of the great things about EMV over the mag-stripe which can hold very little data.
I want to know for sure what my EMV chip does. Is there anyway I can test out my own EMV card to see what the CVM list is?
alexmt has written up a nice step-by-step procedure on Post #3615.
If most of the EMV cards in the US is the Chip-and-Signature type, doesn't that mean it's still useless abroad?
Depends if you see it as glass half empty or glass half full. See Post #3 for further details on how Chip-and-Signature has worked both successfully and unsuccessfully depending on the merchant transaction environment and use your best judgment whether which one is right for you.
Are there any places in the US that are accepting transactions via the EMV chip?
tmiw has created a dedicated Google maps webpage to show where EMV has been proven to work here: http://emvacceptedhere.com/ Per his Post #4240, feel free to add any places with active EMV terminals if you come across one.
As of 2014/05, the EMV terminals in most Walmarts and Sam's Clubs are being turned on. Hence, the best place to try them out would be your local Walmart or Sam's Club. For other merchants, it's slowly being phased in.
I hope people will post them in the Post your receipt of your 1st EMV based transaction in the US thread. cvarming has shown us an EMV transaction receipt from Brooklyn, NY in Post #2380. I myself had my first EMV based (Chip-and-Signature) transaction in two stores in the Los Angeles area, as shown in detail in Post #2705 (courtesy of WhatWhatTech for pointing these two stores out)
I don't want a chip in my card. I heard horror stories all over the media saying hackers can steal my credit card info from a mile away.
There are two types of chips. One is contactless and the other is contact. Cards can be either one or the other, or both.
In the Google Docs spreadsheet, the cards that are capable of contactless payments are listed seperately under the "RFID or NFC contactless chip" column. If it says yes, then that means it has the ability to do contactless payments. If it says no, it doesn't have that feature.
The one that the media has overhyped about hackers "stealing your information wirelessly" was the contactless type like this:
You are worried about this happening, right?
You don't have to worry. EMV is a chip standard that can have both contact and contactless interfaces. With the traditional contact interface, this means you actually have to physically insert the chip into a POS terminal for it to be authorized, like this:
With the contact interface, nothing is wireless. No data is sent out in a stand-alone contact type EMV chip. With the EMV contactless interface, data is sent wirelessly.
Furthermore, contactless chip cards are required to show a symbol (looks like Wi-Fi symbol) somewhere on the card that to denote it's capability as a contactless card. For example, here's an example of a Discover Card with contactless capability (in which Discover calls "Discover ZIP") showing the contactless symbol on the back of the card:
Don't believe everything that the media says. Besides, millions of people all over the world from London to Singapore, uses contactless payments daily in extremely crowded subways and mass transit with nary any problems. There are multiple layers of encrypted securities and keys that are needed to break the code.
Frankly, giving your physical card to a waiter/waitress who takes the card out of your view is much more susceptible to fraud than contactless payments.
Why should I care?
If you are an international traveler, you will want this because majority of the world has or in the process of converting to this payment format.
In fact, in 2012, even North Korea moved to the EMV format, leaving the US as one of the countries in the world that hasn't done so.
In addition, VISA, MC, AMEX, and Discover have all agreed to incentivize the USA shifting to EMV payments by 2015 by shifting liability for fraudulent transactions to merchants if they do not have EMV equipment and the cardholder has an EMV card. So if you travel internationally or would like to get one before the others, you might be interested in getting one.
BS! I had no problems using my card in [insert whereever country], [insert whatever point in time]
If you stick to the tourist path where they have lots of visitors from the US, you should have no problems using your mag-stripe only card in hotels and restaurants, at least for now. But as things can change as things go forward.
However, consider that once you start taking the off-beaten path, go to non-touristy places where they are not familiar with mag-stripes, rent a car and use toll roads, fill up gas, or try to buy train tickets you might end up into a trouble of the machine not recognizing your card because it lacks the chip. Furthermore, a lot of toll roads, gas pumps, and automated ticket machines lack any human assistance to help you when you need it the most.
But [insert credit card company] told me all merchants that display their logo must accept them! All I have to do is report them for violating their agreements, right?
There are several factors against this.
1. You can only speak English. The merchant representative, most likely a part-time clerk earning minimum wage, speaks in a different language, let's say French. If you have no French language skills, how are you going to get your point across? Are you going to whip out your cell phone at exorbitant int'l roaming charges and hope the customer service is going to translate it for you on the spot? Or maybe you might actually know French. But how about Swahili, Farsi, Balinese, or the multiple languages in mainland China?
2. Just like US, the rest of the world's businesses uses part-time minimum wage workers as cashiers to cut down on labor costs. Most of their SOP training manuals are written by MBA types to not to do anything they are not familiar with. Do not expect them to understand the intricate details of credit card mumbo jumbo. You don't expect Taco Bell employees to understand the minute details of Discover-JCB-Union Pay agreements, right? Same thing the other way around: be respectful as a guest in their country, prepare in advance in their ways, avoid being an "ugly American" stereotype.
3. You are a guest in their country. You are a minority. If 99.9% of their country's people and other tourists from around the world uses EMV, do you really think they are going to accomodate the 0.1% of American tourists who only have mag-stripes credit cards?
4. Again, you are a guest in their country. How would you, as an American standing in line, react if a Chinese tourist was clogging up the lines at a local Taco Bell because the clerk doesn't understand the Discover-Union Pay agreement and has trouble communicating between Mandarin spoken by the tourist and English spoken by the Taco Bell clerk? Same way the other way around. You do not want to clog up the lines for everyone. The less hassle, the better.
5. VISA and MC make tons of money from merchants in that country. Say SNCF French Rail. It's a billion dollar company in France. Do you think VISA is going to pull the plug of their relationship with SNCF because SNCF refuses to do mag-stripe processing at their unmanned train station kiosk? Of course not. Be realistic.
6. And lastly, if you're up against an unstaffed toll kiosk, gas pump or train ticket machine, are you going to yell curses at the machine?
But I want my credit card to be able to be used in the US too!
No worries. They have not gotten rid of the mag-stripe on the back of the card for backward compatibility reasons, just like we still have embossed numbers on our cards for backwards compatibility to using those old carbon copy imprinters.
[insert own Hyatt card image front and back together with red arrows pointing to all the backward compatibility features]
You use the chip on the front of the card abroad (for now), and the mag-stripe just like any other card for the US. Basically, you're increasing your credit card's acceptance rate by getting a card that both via the chip and the mag-stripe. You're getting a better deal for free.
And when 2015 comes along and US switches to EMV, you'll be way ahead of everyone else too!
So why did the rest of the world and the US moved/moving toward EMV?
Primarily, due to fraud concerns. You see, the mag-stripe has been with us since the 1950s. It may have been the most high tech thing back in the day, but with the technology that is available today, any shmo can pick up a $100 USB magnetic card skimming device off of eBay and get your credit card info.
And unlike skimming off contactless cards which actually need the person to have l33t programming skills, skimming off a magnetic stripe has become so ubiquitous that nary a day goes about skimming fraud going on somewhere in America, from gas pumps, Michael's stores (2011), Target breaches (2013), restaurant waiters/waitresses, to even McDonald's drive thrus.
https://www.google.com/search?q=skimming+fraud
These type of fraud used to be prevalent in Europe. But once they started switching over to EMV starting over 2 decades ago, this type of fraud went elsewhere. It went over to Asia, Canada and Mexico, Latin America, etc. etc. until they too began implementing EMV to combat skimming fraud. The US is practically the only country left that hasn't done so, therefore all the fraud that used to take place elsewhere is now happening here.
But EMV is old and it's not fool proof. Shouldn't we just skip over it and do something new instead?
Yes, EMV is old. It was developed in the 1990s and its smart card payment predecessor was first introduced in France. But as of today, it has become the defacto global standard of payments.
But then, what else is there? There is no other de facto global standard of payments alternative. For example, if we decide to skip over it and do something new, hypothetically like DNA matching technology, it still means US int'l travelers will continue to have problems abroad with useless plastic acceptance because no other country is using this DNA matching technology except the US.
Besides, nothing is fool proof. You can say that the bank vault isn't fool proof because you can crack it open if enough C4 is used. But your average low-life scumbag isn't likely to get military grade C4 easily either. But the bank vault does make it harder to get the bank's money over say a petty cash box. That's the point here. EMV is akin to a security tight bank vault, the old mag-stripe is akin to a petty cash box lying around inside the drawer.
I'm a business owner and I don't think EMV is going to take off. I'm not going to spend extra hundreds of dollars to upgrade my credit card machine. Convince me other wise why I should.
I can understand the added extra cost to your business once this switchover takes place. But before even saying that, look at your existing POS terminal. Does it have a slot somewhere to insert a card?
Most likely, if you had replaced your POS terminal within the past five years, you already have an EMV capable terminal. EMV is basically just not turned on yet from the processor and acquirer side.
If you have an EMV capable terminal, then a best bet would be to contact your acquirer to have the EMV feature turned on. You did your end of the deal already by having an EMV capable terminal, it is now the acquirers' responsibility to turn it on in accordance to the EMV switchover mandate.
And if you don't, you are going to replace your POS terminal anyway from common wear and tear. It isn't a hard switch-over. You can continue to use your POS terminal until it dies out because EMV cardholders will still have the mag-stripe on the back. And by the time your non-EMV capable POS terminal is up for replacement the market will be full with these newer POS terminals that can accept the mag-stripe, EMV, as well as contactless payments.
In addition, you may also want to check with your acquirer or processor about EMV capable terminals. Some of them are willing to replace your terminal for free in preparation for the US EMV switchover. Call and ask for details.
But what's in it for me? I'm the one that has to pay for the upgrade.
All the major card networks have given incentives for merchants for the upcoming EMV switchover.
If 75% or more of your credit card transactions are done on an EMV contact and contactless terminal, they are going to waive your annual PCI-DSS fees, which usually costs you around $5.00-$19.95/month per terminal. The overall long term cost savings of those compliance fees will be larger than the cost of an one time upgrade for the terminal.
The downside is that once EMV switchover happens and if you do not have a POS terminal that is able to accept EMV, the fraud liability shifts over to the merchant.
I own several fast food franchises. If I upgrade my POS terminals at all of my restaurants, it's going to cost me thousands, if not millions. I don't think anyone is going to use a fake credit card to buy $5 burgers. And if they do, wouldn't it be cheaper for me to eat the fraud cost?
Remember also that fraud isn't just committed by dishonest customers using fraudulent cards. Fraud can also happen with dishonest employees skimming off credit card data from the mag-stripe as in the case of a teenage McDonald's drive thru employee skimming off $13,000 of customers' credit cards in Olympia, WA. Consider the public relations fall out that your business may have if this happens (i.e. the big Target breach of 2013, where someone used a mag stripe card to load malware INTO Target's system). Is it worth risking to take such a huge PR disaster?
EMV wikipost volunteers: kebosabi
What is EMV?
EMV is a defacto global standard of technology where there is a visible microchip on the front of the card. It looks like this:
Who issues them?
See Google Docs spreadsheet in Post #1
SFOAMS also has created a list of excellent webpage that shows US EMV cards in a more interactive interface
Another site, which lets you narrow the search for an EMV card by various parameters, is http://www.spotterswiki.com/emv/index.php.
Several credit unions issue some form of Chip-and-PIN credit cards or prepaid cards. Prepaid EMV cards however are not recommended due to junk fees. USAA (currently restricted to members of military) used to offer Chip-and-PIN cards, but as late has backtracked to Chip-and-Signature priority.
Hey that's a cool Google Docs list! I know others that aren't on that list. How can I help by adding them to the list?
My bad for not putting this into the wiki sooner. Right now, the Google Docs is locked out of editing and only in "read-only" view because there were instances in the past where people would just delete the rows not thinking that it affects others viewing the list.
If you promise not to delete any rows and input all the pertinent info (annual fee, rewards, FTF, etc.), I can provide you with edit access. Just shoot me a PM to kebosabi with your gmail address and I'll provide you edit access.
Thanks for helping out!
As of October 2014, no USA-based card issuer offers Chip-and-PIN priority cards except for BMO Harris (Diners Club) and UN Federal Credit Union. Other major USA-based banks such as BofA, Chase, Citi, as well as others issue Chip-and-Signature cards which may work at many automated kiosks. However, bear in mind the word may is used above is a context where there is no absolute certainty of success for certain environments such as automated kiosks due to different natures of offline and online transactions. It is highly recommended to read Post #3 which lists real life FTer examples on how Chip-and-Signature worked and did not work at various transaction environments.
Can I upgrade it right now?
If it's listed on that Google Docs spreadsheet or SFOAMS' Silk page, wouldn't hurt to call/twitter them for a free upgrade. If you get the response you don't like, hang up, try again.
What is the difference between Chip-and-Signature and Chip-and-PIN?
You insert the chipped card into the slot. The physical contact terminal will read the EMV chip and the terminal will automatically read the preferred cardholder verification methods (called CVM) for that card.
Chip-and-Signature means that the terminal will printout a receipt for you to sign. This is the most prevalent authentication for most US issued EMV cards. Chip-and-Signature helps in a way that it will get through to face-to-face merchant transactions where you and the merchant do not speak the same language.
Chip-and-PIN means that the terminal will prompt you to input a PIN for authentication. Some credit union issued credit cards will have this CVM as secondary if Chip-and-Signature cannot be done. Chip-and-PIN is the more prevalent method of authentication used outside the US, especially in transaction environments where no human interaction is needed (i.e. automated gas pumps, toll roads, train kiosks, etc.).
The Google Docs spreadsheet will list which CVM are used in the EMV cards listed. Some cards can only do Chip-and-Signature. Other cards can do both Chip-and-Signature and Chip-and-PIN. And others might have a third option called No CVM (no authentication needed) which is reserved for low value transactions.
One chip can hold a lot more data, therefore it is capable of doing multiple verification methods. That's one of the great things about EMV over the mag-stripe which can hold very little data.
I want to know for sure what my EMV chip does. Is there anyway I can test out my own EMV card to see what the CVM list is?
alexmt has written up a nice step-by-step procedure on Post #3615.
If most of the EMV cards in the US is the Chip-and-Signature type, doesn't that mean it's still useless abroad?
Depends if you see it as glass half empty or glass half full. See Post #3 for further details on how Chip-and-Signature has worked both successfully and unsuccessfully depending on the merchant transaction environment and use your best judgment whether which one is right for you.
Are there any places in the US that are accepting transactions via the EMV chip?
tmiw has created a dedicated Google maps webpage to show where EMV has been proven to work here: http://emvacceptedhere.com/ Per his Post #4240, feel free to add any places with active EMV terminals if you come across one.
As of 2014/05, the EMV terminals in most Walmarts and Sam's Clubs are being turned on. Hence, the best place to try them out would be your local Walmart or Sam's Club. For other merchants, it's slowly being phased in.
I hope people will post them in the Post your receipt of your 1st EMV based transaction in the US thread. cvarming has shown us an EMV transaction receipt from Brooklyn, NY in Post #2380. I myself had my first EMV based (Chip-and-Signature) transaction in two stores in the Los Angeles area, as shown in detail in Post #2705 (courtesy of WhatWhatTech for pointing these two stores out)
I don't want a chip in my card. I heard horror stories all over the media saying hackers can steal my credit card info from a mile away.
There are two types of chips. One is contactless and the other is contact. Cards can be either one or the other, or both.
In the Google Docs spreadsheet, the cards that are capable of contactless payments are listed seperately under the "RFID or NFC contactless chip" column. If it says yes, then that means it has the ability to do contactless payments. If it says no, it doesn't have that feature.
The one that the media has overhyped about hackers "stealing your information wirelessly" was the contactless type like this:
You are worried about this happening, right?
You don't have to worry. EMV is a chip standard that can have both contact and contactless interfaces. With the traditional contact interface, this means you actually have to physically insert the chip into a POS terminal for it to be authorized, like this:
With the contact interface, nothing is wireless. No data is sent out in a stand-alone contact type EMV chip. With the EMV contactless interface, data is sent wirelessly.
Furthermore, contactless chip cards are required to show a symbol (looks like Wi-Fi symbol) somewhere on the card that to denote it's capability as a contactless card. For example, here's an example of a Discover Card with contactless capability (in which Discover calls "Discover ZIP") showing the contactless symbol on the back of the card:
Don't believe everything that the media says. Besides, millions of people all over the world from London to Singapore, uses contactless payments daily in extremely crowded subways and mass transit with nary any problems. There are multiple layers of encrypted securities and keys that are needed to break the code.
Frankly, giving your physical card to a waiter/waitress who takes the card out of your view is much more susceptible to fraud than contactless payments.
Why should I care?
If you are an international traveler, you will want this because majority of the world has or in the process of converting to this payment format.
In fact, in 2012, even North Korea moved to the EMV format, leaving the US as one of the countries in the world that hasn't done so.
In addition, VISA, MC, AMEX, and Discover have all agreed to incentivize the USA shifting to EMV payments by 2015 by shifting liability for fraudulent transactions to merchants if they do not have EMV equipment and the cardholder has an EMV card. So if you travel internationally or would like to get one before the others, you might be interested in getting one.
BS! I had no problems using my card in [insert whereever country], [insert whatever point in time]
If you stick to the tourist path where they have lots of visitors from the US, you should have no problems using your mag-stripe only card in hotels and restaurants, at least for now. But as things can change as things go forward.
However, consider that once you start taking the off-beaten path, go to non-touristy places where they are not familiar with mag-stripes, rent a car and use toll roads, fill up gas, or try to buy train tickets you might end up into a trouble of the machine not recognizing your card because it lacks the chip. Furthermore, a lot of toll roads, gas pumps, and automated ticket machines lack any human assistance to help you when you need it the most.
But [insert credit card company] told me all merchants that display their logo must accept them! All I have to do is report them for violating their agreements, right?
There are several factors against this.
1. You can only speak English. The merchant representative, most likely a part-time clerk earning minimum wage, speaks in a different language, let's say French. If you have no French language skills, how are you going to get your point across? Are you going to whip out your cell phone at exorbitant int'l roaming charges and hope the customer service is going to translate it for you on the spot? Or maybe you might actually know French. But how about Swahili, Farsi, Balinese, or the multiple languages in mainland China?
2. Just like US, the rest of the world's businesses uses part-time minimum wage workers as cashiers to cut down on labor costs. Most of their SOP training manuals are written by MBA types to not to do anything they are not familiar with. Do not expect them to understand the intricate details of credit card mumbo jumbo. You don't expect Taco Bell employees to understand the minute details of Discover-JCB-Union Pay agreements, right? Same thing the other way around: be respectful as a guest in their country, prepare in advance in their ways, avoid being an "ugly American" stereotype.
3. You are a guest in their country. You are a minority. If 99.9% of their country's people and other tourists from around the world uses EMV, do you really think they are going to accomodate the 0.1% of American tourists who only have mag-stripes credit cards?
4. Again, you are a guest in their country. How would you, as an American standing in line, react if a Chinese tourist was clogging up the lines at a local Taco Bell because the clerk doesn't understand the Discover-Union Pay agreement and has trouble communicating between Mandarin spoken by the tourist and English spoken by the Taco Bell clerk? Same way the other way around. You do not want to clog up the lines for everyone. The less hassle, the better.
5. VISA and MC make tons of money from merchants in that country. Say SNCF French Rail. It's a billion dollar company in France. Do you think VISA is going to pull the plug of their relationship with SNCF because SNCF refuses to do mag-stripe processing at their unmanned train station kiosk? Of course not. Be realistic.
6. And lastly, if you're up against an unstaffed toll kiosk, gas pump or train ticket machine, are you going to yell curses at the machine?
But I want my credit card to be able to be used in the US too!
No worries. They have not gotten rid of the mag-stripe on the back of the card for backward compatibility reasons, just like we still have embossed numbers on our cards for backwards compatibility to using those old carbon copy imprinters.
[insert own Hyatt card image front and back together with red arrows pointing to all the backward compatibility features]
You use the chip on the front of the card abroad (for now), and the mag-stripe just like any other card for the US. Basically, you're increasing your credit card's acceptance rate by getting a card that both via the chip and the mag-stripe. You're getting a better deal for free.
And when 2015 comes along and US switches to EMV, you'll be way ahead of everyone else too!
So why did the rest of the world and the US moved/moving toward EMV?
Primarily, due to fraud concerns. You see, the mag-stripe has been with us since the 1950s. It may have been the most high tech thing back in the day, but with the technology that is available today, any shmo can pick up a $100 USB magnetic card skimming device off of eBay and get your credit card info.
And unlike skimming off contactless cards which actually need the person to have l33t programming skills, skimming off a magnetic stripe has become so ubiquitous that nary a day goes about skimming fraud going on somewhere in America, from gas pumps, Michael's stores (2011), Target breaches (2013), restaurant waiters/waitresses, to even McDonald's drive thrus.
https://www.google.com/search?q=skimming+fraud
These type of fraud used to be prevalent in Europe. But once they started switching over to EMV starting over 2 decades ago, this type of fraud went elsewhere. It went over to Asia, Canada and Mexico, Latin America, etc. etc. until they too began implementing EMV to combat skimming fraud. The US is practically the only country left that hasn't done so, therefore all the fraud that used to take place elsewhere is now happening here.
But EMV is old and it's not fool proof. Shouldn't we just skip over it and do something new instead?
Yes, EMV is old. It was developed in the 1990s and its smart card payment predecessor was first introduced in France. But as of today, it has become the defacto global standard of payments.
But then, what else is there? There is no other de facto global standard of payments alternative. For example, if we decide to skip over it and do something new, hypothetically like DNA matching technology, it still means US int'l travelers will continue to have problems abroad with useless plastic acceptance because no other country is using this DNA matching technology except the US.
Besides, nothing is fool proof. You can say that the bank vault isn't fool proof because you can crack it open if enough C4 is used. But your average low-life scumbag isn't likely to get military grade C4 easily either. But the bank vault does make it harder to get the bank's money over say a petty cash box. That's the point here. EMV is akin to a security tight bank vault, the old mag-stripe is akin to a petty cash box lying around inside the drawer.
I'm a business owner and I don't think EMV is going to take off. I'm not going to spend extra hundreds of dollars to upgrade my credit card machine. Convince me other wise why I should.
I can understand the added extra cost to your business once this switchover takes place. But before even saying that, look at your existing POS terminal. Does it have a slot somewhere to insert a card?
Most likely, if you had replaced your POS terminal within the past five years, you already have an EMV capable terminal. EMV is basically just not turned on yet from the processor and acquirer side.
If you have an EMV capable terminal, then a best bet would be to contact your acquirer to have the EMV feature turned on. You did your end of the deal already by having an EMV capable terminal, it is now the acquirers' responsibility to turn it on in accordance to the EMV switchover mandate.
And if you don't, you are going to replace your POS terminal anyway from common wear and tear. It isn't a hard switch-over. You can continue to use your POS terminal until it dies out because EMV cardholders will still have the mag-stripe on the back. And by the time your non-EMV capable POS terminal is up for replacement the market will be full with these newer POS terminals that can accept the mag-stripe, EMV, as well as contactless payments.
In addition, you may also want to check with your acquirer or processor about EMV capable terminals. Some of them are willing to replace your terminal for free in preparation for the US EMV switchover. Call and ask for details.
But what's in it for me? I'm the one that has to pay for the upgrade.
All the major card networks have given incentives for merchants for the upcoming EMV switchover.
If 75% or more of your credit card transactions are done on an EMV contact and contactless terminal, they are going to waive your annual PCI-DSS fees, which usually costs you around $5.00-$19.95/month per terminal. The overall long term cost savings of those compliance fees will be larger than the cost of an one time upgrade for the terminal.
The downside is that once EMV switchover happens and if you do not have a POS terminal that is able to accept EMV, the fraud liability shifts over to the merchant.
I own several fast food franchises. If I upgrade my POS terminals at all of my restaurants, it's going to cost me thousands, if not millions. I don't think anyone is going to use a fake credit card to buy $5 burgers. And if they do, wouldn't it be cheaper for me to eat the fraud cost?
Remember also that fraud isn't just committed by dishonest customers using fraudulent cards. Fraud can also happen with dishonest employees skimming off credit card data from the mag-stripe as in the case of a teenage McDonald's drive thru employee skimming off $13,000 of customers' credit cards in Olympia, WA. Consider the public relations fall out that your business may have if this happens (i.e. the big Target breach of 2013, where someone used a mag stripe card to load malware INTO Target's system). Is it worth risking to take such a huge PR disaster?
USA EMV cards: Availability, Q&A (Chip & PIN -or- Chip & Signature) [2012-2015]
Sep 19, 2012, 5:59 pm
#406
Join Date: Oct 2005
Location: SAN
Programs: AS, UA, DL
Posts: 80
My SO just returned from Romania and used the ex-Schwab/B of A chip and signature card. The card worked in many places - gas stations (Petrom) and grocery stores (Kaufland) - where the normal mag strip was rejected on previous visits. These were all attended POS, but it is a huge improvement over just using cash/debit cards like we had to before since normal American credit cards were not accepted.
Sep 19, 2012, 6:03 pm
#407
FlyerTalk Evangelist
Join Date: Jan 2005
Location: home = LAX
Posts: 25,934
My recent experience with a chip-needed situation (the only time I needed a chip card on a 12-day Switzerland/Austria trip) is detailed in this post:
http://www.flyertalk.com/forum/diner...l#post19347157 at post 54 (in Diners Club forum)
(I used a chip & PIN card but the machine did not prompt for a PIN, so a chip & signature card would have presumably worked in the same situation.)
http://www.flyertalk.com/forum/diner...l#post19347157 at post 54 (in Diners Club forum)
(I used a chip & PIN card but the machine did not prompt for a PIN, so a chip & signature card would have presumably worked in the same situation.)
Sep 19, 2012, 6:34 pm
#408
Suspended
Join Date: Oct 2004
Location: Bay Area
Programs: DL SM, UA MP.
Posts: 12,729
I wonder if the Chip and PIN cards on a toll booth requires the driver to punch in the pin?
I can't recall if they had keypads even.
I can't recall if they had keypads even.
Sep 19, 2012, 11:58 pm
#409
Join Date: Aug 2002
Location: NYC
Programs: AA EP, HH Diamond, Admirals Club, Global Entry
Posts: 417
My very very frustrating question is: WHY Citibank and other major US card issuers are not programming the PIN in the chip? Does it cost more? If the global standard is chip-and-pin then why in the US they are changing the protocol to chip-and-signature? I don't understand this at all. VERY VERY FRUSTRATING.
Tintin
Tintin
Sep 20, 2012, 12:14 am
#410
Join Date: Jul 2007
Posts: 1,762
My very very frustrating question is: WHY Citibank and other major US card issuers are not programming the PIN in the chip? Does it cost more? If the global standard is chip-and-pin then why in the US they are changing the protocol to chip-and-signature? I don't understand this at all. VERY VERY FRUSTRATING.
Tintin
Tintin
At first, it was also used by both Chase and Citi as a money maker. Their first attempts at chip technology (chip and signature) were restricted to their highest end cards with large annual fees. It wasn't done to help the consumer (it never is with these big near criminal banks) but rather as a marketing gimmick which would cost them nothing but perhaps entie a few suckers to spend big annual fees because they wanted an emv card. This is still basically the case with Chase and Citi. Then a couple of credit unions bit but again given the lack of pos chip terminals here, they went with a default chip and signature although it is claimed, and for the most part borne out, that where necessary they will work as chip and pin (AFCU and SDFCU).
The big break through was in July when Bank of America made emv chip and signature available on a free, no foreign transaction fee card. I really expectd by now banks such as Capital One and other credit unions would be in on the game but nothing signficiant has happened since July (well Wells Fargo has announced some plans and US Bank but none of the large banks have moved much off dead center). The only good news is that mc and visa have dropped hints or maybe they've made it clear that by 2015 all US issued pos terminals would have to accept chip and pin and maybe by then it will have caught on.
Right now, at least in my opinion, the banks are still trying to pull the wool over our eyes with this and that I agree with those who think that for the most part, although there are some exceptions, chip and signature in Western Europe at least indeed works but at the same places that still accept mag strip cards. (Incidentally, the UK is very sensitive to things like this. When they announced their migration to chip and pin only, seveal advocacy groups for the handicapped say the blind made them pass a provision that if one is handicapped, the banks were required to provide an alternate means (magnetic strip) so they wouldn't have to enter a pin. To the best of my knowledge, that provision remains in effect in the UK although somebody living there might wish to correct me so for the most part in the UK, archaic USA credit cards will continue to work indefinitely and for the most part, the UK is the first destinatin of some many Americans who dare to cross the pond.
Sep 20, 2012, 1:55 am
#411
Join Date: Jul 2006
Location: LAX
Programs: AA EXP 1.5MM, Asiana Club Silver, KE Morning Calm, Hyatt Platinum, Amtrak Select
Posts: 7,161
My very very frustrating question is: WHY Citibank and other major US card issuers are not programming the PIN in the chip? Does it cost more? If the global standard is chip-and-pin then why in the US they are changing the protocol to chip-and-signature? I don't understand this at all. VERY VERY FRUSTRATING.
Tintin
Tintin
2. But in order to write PIN changes physically onto the chip, that would mean one would have to physically come into a bank branch and do the PIN change there. You can't do this over the phone or online. Think about it: there's no magical wireless satellite technology that beams a PIN number change and writes it onto the chip on your card.
3. This is the dilemma for most banks today. Looking at how AndrewsFCU and State Dept FCU has done theirs to issue Chip-and-PIN, it is possible for banks to do so. The down side for Andrews FCU and State Dept FCU Chip-and-PIN cards: PIN changes can't be made.
Which then comes to the question:
So why can we do PIN changes for magnetic stripes?
Well, that's because we already have the infrastructure for it everywhere today. You can do this over the phone, the PIN is recorded on the server on the banks' end, and when it comes to verify your PIN entry, it checks your entry with the PIN recorded in the server. This was the method chosen by majority of banks in the US because telecommunications costs were dirt cheap. And mainly this is now used to do debit transactions.
OTOH, telecommunications costs were very expensive abroad. Sure we may have broadband today, but the whole concept of online verification was created during the dial-up years. If you're old enough, you can recall those old gray dot matrix "yellow carbon copy is yours; white one is mine" POS machines, they were actually dialing somewhere to verify right? For countries where even a local dial up call cost $1 or more per minute, they needed something else.
So that's where the rift occurred. The US went with online verification with the server, whereas the rest of the world went with offline verification with hard coded PIN onto the chip.
Now flash forward two decades later, everyone now has broadband. Telecommunication costs went down in abroad so they now have both: offline verification from two decades ago and online verification which they can now do due to cheaper broadband.
OTOH, we didn't use offline verification, we never had that, so we're stuck with the hole here. We can do online verification because we had that two decades ago (changed from cheap dial-up to cheaper broadband), but we never had offline verification infrastructure.
So the question is: do US banks want to go back and invest in the older offline verification technology or should they just go with online verification? If you put yourself into the shoes of a bean counter at the bank, it's a tough call.
Going back to post #3 banks could be seeing that Chip-and-Signature and if needed, online PIN verification is "good enough" for most transactions. How prevalent is offline chip verification though? That's what they can't see since offline verification is not connected anywhere for US financial institutions to gather data. Is offline chip verification still prevalent abroad as it was two decades ago, or is it on the decline on its way to phasing out due to cheaper broadband technology that makes online verification possible nowadays like the US has been?
If I were to give advice to the banks: yes, offline verification is still prevalent abroad. Sure broadband has made telecommunication costs cheap abroad. But abroad, banks are also VERY conservative. Unlike the US, banks abroad also control the network and POS market. And for banks abroad, they would rather keep reaping the benefits of offline verification (merchant sends the bill in a batch once a month, bank processes it at a time that's beneficial to them, charges merchant additional convenience fees) instead of instantaneous online verification. From the banks abroad perspective, instantaneous online verification means loss of revenues. They'd rather do it the old fashioned offline verification method until the very end. It maybe in decline somewhat, but not in a large scale as US banks would like to imagine.
Last edited by kebosabi; Sep 20, 2012 at 2:21 am
Sep 20, 2012, 9:43 am
#412
Moderator
Join Date: Jun 2003
Location: Miami, Mpls & London
Programs: AA & Marriott Perpetual Platinum; DL & HH Gold
Posts: 48,958
It's not merely a matter of storing a PIN in a Chip. In addition to the PIN maintenance challenges described by kebosabi, the issuer must also build the infrastructure to process the transactions with that method of authentication, and it must also implement online PIN authentication for the countries which do not use the offline method.
It would be worth the expense to create this infrastructure if Chip & PIN were also to be used for domestic transactions, but VISA has concluded that PIN is already an obsolete technique and is guiding USA issuers and merchants in another direction.
It would be worth the expense to create this infrastructure if Chip & PIN were also to be used for domestic transactions, but VISA has concluded that PIN is already an obsolete technique and is guiding USA issuers and merchants in another direction.
Sep 20, 2012, 9:55 am
#413
Join Date: Dec 2003
Location: NYC
Posts: 6,434
It's not merely a matter of storing a PIN in a Chip. In addition to the PIN maintenance challenges described by kebosabi, the issuer must also build the infrastructure to process the transactions with that method of authentication, and it must also implement online PIN authentication for the countries which do not use the offline method.
Global banks already have the necessary infrastructure (and if AndrewsFCU can do it, how hard can it be). Card companies already have the necessary infrastructure (MC and Visa being named parts of EMV). Terminals don't need to updated, as cards can authenticate under swipe, chip & signature or chip & pin depending on the terminal's capabilities. The only issue is changing PIN numbers, which seems a nice to have rather than a necessity.
Last edited by richarddd; Sep 20, 2012 at 10:00 am
Sep 20, 2012, 10:21 am
#414
Join Date: Jul 2007
Posts: 1,762
So here are the bottom line questions of this lone discussion on emv cards on this blog and some others....
1. We have been lectured to death that the day of the magnetic strip are numbered and pretty soon Americans would find it next to impossible to use their archaic credit cdards abroad. Right? We've had scattered reports of some places it has become difficult to use magnetic strip cards (McDonald's in British Colombia; don't know if that is a system decision or one individual franchisee) but it doesn't seem to have become a big problem in most visited tourist spots. So just how necessary is it having an emv chipped card.
2. Does chip and signature offer much of an improve in fraud control over the magnetic strip cards?
3. Is there going to be a more massive expansion of the issuance of emv cards. Nothng much has changed sine B of A made at least one or two free emv cards available in July. I have always thought, others here say I'm wrong, that one of Capital One's centray credit card business is somewaht dependent on no foreign transaction fees. Like I just said, many here say I'm wrong (and I accept the sage advice of people more knowledgeable tham me). So is the growth of emv chipped card issuance at an end?
4. Finally will other credit unions try to expand their credit card portfolios by issuing emv cards. For example because I have the card, Pen Fed over the past year has dropped its foreign transaction fee on my favorite Pen Fed card i.e. the one that gives a 5% discount on gas. Shouldn't they be issuing a chipped card as they've usually been an innovative bank?
5. Finally is the direction to go the ways Andrews FCU and State Department FCU have chosen to go namely to have a default chip and signature card capable where chip and signature is not accepted of being used as chip and pin and is the internal software necessary for this adaptible to larger banks?
They're interesting questions and I don't know the answers as I am far from an expert. Anybody care to chime in?
1. We have been lectured to death that the day of the magnetic strip are numbered and pretty soon Americans would find it next to impossible to use their archaic credit cdards abroad. Right? We've had scattered reports of some places it has become difficult to use magnetic strip cards (McDonald's in British Colombia; don't know if that is a system decision or one individual franchisee) but it doesn't seem to have become a big problem in most visited tourist spots. So just how necessary is it having an emv chipped card.
2. Does chip and signature offer much of an improve in fraud control over the magnetic strip cards?
3. Is there going to be a more massive expansion of the issuance of emv cards. Nothng much has changed sine B of A made at least one or two free emv cards available in July. I have always thought, others here say I'm wrong, that one of Capital One's centray credit card business is somewaht dependent on no foreign transaction fees. Like I just said, many here say I'm wrong (and I accept the sage advice of people more knowledgeable tham me). So is the growth of emv chipped card issuance at an end?
4. Finally will other credit unions try to expand their credit card portfolios by issuing emv cards. For example because I have the card, Pen Fed over the past year has dropped its foreign transaction fee on my favorite Pen Fed card i.e. the one that gives a 5% discount on gas. Shouldn't they be issuing a chipped card as they've usually been an innovative bank?
5. Finally is the direction to go the ways Andrews FCU and State Department FCU have chosen to go namely to have a default chip and signature card capable where chip and signature is not accepted of being used as chip and pin and is the internal software necessary for this adaptible to larger banks?
They're interesting questions and I don't know the answers as I am far from an expert. Anybody care to chime in?
Sep 20, 2012, 10:37 am
#415
Join Date: Jul 2006
Location: LAX
Programs: AA EXP 1.5MM, Asiana Club Silver, KE Morning Calm, Hyatt Platinum, Amtrak Select
Posts: 7,161
Asking for PIN changes upon request was one of the biggest things consumers wanted during the mag-stripe era. Hey, if you open a bank account or a new credit card, that's what most Americans do first, right? Change the PIN to something that's easy for you to remember.
I went to a BofA branch the other day and asked when they would have Chip & PIN coming. They said "probably at least a year away to get the encoders in to all the branches."
From that comment, I deduced that they are assuming that Chip-and-PIN can't be done without significant investment because most Americans don't want static PIN numbers assigned (data research from mag-stripe era) and would rather have the ability to change the PIN to something they can remember...something which will require sometime to do across multiple branches.
OTOH, you have the Andrews FCU, State Dept FCU, or even the Diners Club approach: we can give you Chip-and-PIN, downside is you can't change your PIN (at least not yet).
Me thinks that's the biggest underlying cause why banks are choosing Chip & Signature over Chip & PIN. If people who want full Chip & PIN are willing to write to Chase, Citi, and BofA that we don't mind static issued PINs hard-encoded onto the chip for the time being until they get the infrastructure ready to change the PIN, we probably could have Chip & PIN now.
So it's a toss up:
Chip-and-PIN can be done (as shown by AndrewsFCU, State Dept FCU, Diners), downside is you lose the ability to change the PIN and have to memorize the static PIN assigned to you. In the future changing PIN will be possible, but not as of right now.
or
Chip-and-Signature as a stop gap for now (it's "good enough" for most transactions), then move to full Chip-and-PIN later once they get the systems up and ready to make PIN changes in person at the branch.
Which do you prefer? Banks probably don't know.
Last edited by kebosabi; Sep 20, 2012 at 5:54 pm
Sep 20, 2012, 10:44 am
#416
Join Date: Jul 2010
Location: New York
Programs: Cutting down :-(
Posts: 604
I think the 2015 liability shift can shift mountains. By 2015, mag-stripe transactions (2017 for gas pump POS terminals) will be on their own in case of fraud. You don't need many cases of fraud before you are better off switching to an EMV POS terminal.
Last edited by cvarming; Sep 20, 2012 at 1:04 pm
Sep 20, 2012, 10:51 am
#417
Join Date: Jul 2006
Location: LAX
Programs: AA EXP 1.5MM, Asiana Club Silver, KE Morning Calm, Hyatt Platinum, Amtrak Select
Posts: 7,161
4. Finally will other credit unions try to expand their credit card portfolios by issuing emv cards. For example because I have the card, Pen Fed over the past year has dropped its foreign transaction fee on my favorite Pen Fed card i.e. the one that gives a 5% discount on gas. Shouldn't they be issuing a chipped card as they've usually been an innovative bank?
Andrews FCU and State Dept FCU are, pretty big compared to most other credit unions. They also tend to have higher number of big accounts (military service-members at Andrews AFB and State Dept employees) than say Anytown USA Fire Department Credit Union or so. Without significant capital, most CUs can't do it alone.
OTOH, majority of CUs belong to a collective of a bigger CU service provider. PSCU is one of those. And PSCU offers an prepaid EMV option to smallers CUs that do not have enough capital to do them on their own.
Last edited by kebosabi; Sep 20, 2012 at 1:50 pm
Sep 20, 2012, 10:57 am
#418
Moderator
Join Date: Jun 2003
Location: Miami, Mpls & London
Programs: AA & Marriott Perpetual Platinum; DL & HH Gold
Posts: 48,958
Transactions are approved by the issuing bank, not by the network operator. The issuing bank needs a system to evaluate whether the correct PIN has been entered, in addition to any other consideration already used to approve transactions. A system designed without PIN's will not have this capability.
The fact that the Andrews card uses PIN verification only when absolutely required suggests they incur some additional cost or risk to process those transactions. Perhaps they have leased capacity from an issuer which has Chip & PIN capability, but I don't expect them to tell us.
The fact that the Andrews card uses PIN verification only when absolutely required suggests they incur some additional cost or risk to process those transactions. Perhaps they have leased capacity from an issuer which has Chip & PIN capability, but I don't expect them to tell us.
Sep 20, 2012, 10:59 am
#419
Join Date: Dec 2003
Location: NYC
Posts: 6,434
An intermediate step towards a changeable PIN would be for banks to allow customers to set the initial PIN. Is there any reason that couldn't be done? How often do most people change PINs once they have one they like?
Based solely on a conversation with a Chase CSR, Chase has received a lot of complaints about problems with being able to use chip & signature while traveling overseas. I'd think they would roll out a chip & pin just to compare the reaction.
The global banks issue chip & pin cards in countries other than the US. They already have the PIN infrastructure.
It's hard to draw conclusions about costs from Andrews and SDFCU. As US based institutions, they might be defaulting to the most common US terminals.
Based solely on a conversation with a Chase CSR, Chase has received a lot of complaints about problems with being able to use chip & signature while traveling overseas. I'd think they would roll out a chip & pin just to compare the reaction.
Transactions are approved by the issuing bank, not by the network operator. The issuing bank needs a system to evaluate whether the correct PIN has been entered, in addition to any other consideration already used to approve transactions. A system designed without PIN's will not have this capability.
It's hard to draw conclusions about costs from Andrews and SDFCU. As US based institutions, they might be defaulting to the most common US terminals.
Last edited by mia; Sep 20, 2012 at 11:17 am
Sep 20, 2012, 12:56 pm
#420
Join Date: Jul 2006
Location: LAX
Programs: AA EXP 1.5MM, Asiana Club Silver, KE Morning Calm, Hyatt Platinum, Amtrak Select
Posts: 7,161
How safe and secure is "please set a PIN before we make your card" as opposed to "the computer will automatically generate a PIN, you'll get it separately in the mail, upon receivining it, please call us and do it over the phone prompt or do it in person at the branch and we'll look the other way while you enter it."
The same holds true even with mag-stripe cards today. When you get a card, they send you a pre-assigned PIN. They even go the extra mile to send you the card first, then send the PIN later on a separate letter.
Then, you're supposed to call over the phone , enter your old number to confirm that it's you, then change it to what you want, so that it gets recorded onto the server for online verification.
For ATM debit cards, they assign you a PIN. If you want to change it, you go to any ATM or walk in person into a branch, type in your old PIN and enter in a new one.
In the chance that you forgot your PIN, customer service agents can't tell you what the PIN is over the phone. It has to be reset, sent over the mail for you to physically open the letter and read the PIN with your own eyes, and call back again through the phone prompts to enter in new one again.
They purposely make it this way because, hey, it's your money and credit, and people want these securities. Or, people can give up these securities and make the process a whole lot easier.
Again, in today's age, there's no reason why one cannot pre-select a PIN upon applying for a new credit card or opening a new bank account. The downside is that you lose security: hackers can get that info upon application time, is the customer service agent handling your application request trustworthy, is the person making the card trustworthy, is the mailman trustworthy (reason why card and PIN letters are sent separately), is your nosy neighbor or mailbox thieves trustworthy, etc.
The only other way I can visualize something that is the most secure is something like this:
John the cardmaker: "Hi, is this kebosabi? My name is John and I'm making your new credit card right now. We need you to come over to Columbus, OH at our card production plant to enter a PIN in person at our production facility."
or
David, your neighborhood banker "Hi, is this kebosabi? My name is David your neighborhood banker. We can make your new EMV card right here in the branch. Can you come over at your earliest convenience so we can make it while you wait? You'll also need to select a PIN in a special discrete room"
The latter, seems to be the way banks are choosing to go:
EMV instant issuance solutions at branches:
http://www.bellid.com/solutions/emv-instant-issuance
http://www.gemalto.com/financial/issuance/issuance.html
It ain't going to be cheap, and it ain't going to be a flick-of-a-light switch solution, especially for big banks which has a lot of branches in the US.
Last edited by kebosabi; Sep 20, 2012 at 1:25 pm