Sep 20, 2013, 11:40 am
Last edit by: philemer
Posts from 1/1/16 onward can be found here: http://www.flyertalk.com/forum/credit-card-programs/1739359-2016-onward-usa-emv-cards-availability-q-chip-pin-signature.html
EMV wikipost volunteers: kebosabi
What is EMV?
EMV is a defacto global standard of technology where there is a visible microchip on the front of the card. It looks like this:
Who issues them?
See Google Docs spreadsheet in Post #1
SFOAMS also has created a list of excellent webpage that shows US EMV cards in a more interactive interface
Another site, which lets you narrow the search for an EMV card by various parameters, is http://www.spotterswiki.com/emv/index.php.
Several credit unions issue some form of Chip-and-PIN credit cards or prepaid cards. Prepaid EMV cards however are not recommended due to junk fees. USAA (currently restricted to members of military) used to offer Chip-and-PIN cards, but as late has backtracked to Chip-and-Signature priority.
Hey that's a cool Google Docs list! I know others that aren't on that list. How can I help by adding them to the list?
My bad for not putting this into the wiki sooner. Right now, the Google Docs is locked out of editing and only in "read-only" view because there were instances in the past where people would just delete the rows not thinking that it affects others viewing the list.
If you promise not to delete any rows and input all the pertinent info (annual fee, rewards, FTF, etc.), I can provide you with edit access. Just shoot me a PM to kebosabi with your gmail address and I'll provide you edit access.
Thanks for helping out!
As of October 2014, no USA-based card issuer offers Chip-and-PIN priority cards except for BMO Harris (Diners Club) and UN Federal Credit Union. Other major USA-based banks such as BofA, Chase, Citi, as well as others issue Chip-and-Signature cards which may work at many automated kiosks. However, bear in mind the word may is used above is a context where there is no absolute certainty of success for certain environments such as automated kiosks due to different natures of offline and online transactions. It is highly recommended to read Post #3 which lists real life FTer examples on how Chip-and-Signature worked and did not work at various transaction environments.
Can I upgrade it right now?
If it's listed on that Google Docs spreadsheet or SFOAMS' Silk page, wouldn't hurt to call/twitter them for a free upgrade. If you get the response you don't like, hang up, try again.
What is the difference between Chip-and-Signature and Chip-and-PIN?
You insert the chipped card into the slot. The physical contact terminal will read the EMV chip and the terminal will automatically read the preferred cardholder verification methods (called CVM) for that card.
Chip-and-Signature means that the terminal will printout a receipt for you to sign. This is the most prevalent authentication for most US issued EMV cards. Chip-and-Signature helps in a way that it will get through to face-to-face merchant transactions where you and the merchant do not speak the same language.
Chip-and-PIN means that the terminal will prompt you to input a PIN for authentication. Some credit union issued credit cards will have this CVM as secondary if Chip-and-Signature cannot be done. Chip-and-PIN is the more prevalent method of authentication used outside the US, especially in transaction environments where no human interaction is needed (i.e. automated gas pumps, toll roads, train kiosks, etc.).
The Google Docs spreadsheet will list which CVM are used in the EMV cards listed. Some cards can only do Chip-and-Signature. Other cards can do both Chip-and-Signature and Chip-and-PIN. And others might have a third option called No CVM (no authentication needed) which is reserved for low value transactions.
One chip can hold a lot more data, therefore it is capable of doing multiple verification methods. That's one of the great things about EMV over the mag-stripe which can hold very little data.
I want to know for sure what my EMV chip does. Is there anyway I can test out my own EMV card to see what the CVM list is?
alexmt has written up a nice step-by-step procedure on Post #3615.
If most of the EMV cards in the US is the Chip-and-Signature type, doesn't that mean it's still useless abroad?
Depends if you see it as glass half empty or glass half full. See Post #3 for further details on how Chip-and-Signature has worked both successfully and unsuccessfully depending on the merchant transaction environment and use your best judgment whether which one is right for you.
Are there any places in the US that are accepting transactions via the EMV chip?
tmiw has created a dedicated Google maps webpage to show where EMV has been proven to work here: http://emvacceptedhere.com/ Per his Post #4240, feel free to add any places with active EMV terminals if you come across one.
As of 2014/05, the EMV terminals in most Walmarts and Sam's Clubs are being turned on. Hence, the best place to try them out would be your local Walmart or Sam's Club. For other merchants, it's slowly being phased in.
I hope people will post them in the Post your receipt of your 1st EMV based transaction in the US thread. cvarming has shown us an EMV transaction receipt from Brooklyn, NY in Post #2380. I myself had my first EMV based (Chip-and-Signature) transaction in two stores in the Los Angeles area, as shown in detail in Post #2705 (courtesy of WhatWhatTech for pointing these two stores out)
I don't want a chip in my card. I heard horror stories all over the media saying hackers can steal my credit card info from a mile away.
There are two types of chips. One is contactless and the other is contact. Cards can be either one or the other, or both.
In the Google Docs spreadsheet, the cards that are capable of contactless payments are listed seperately under the "RFID or NFC contactless chip" column. If it says yes, then that means it has the ability to do contactless payments. If it says no, it doesn't have that feature.
The one that the media has overhyped about hackers "stealing your information wirelessly" was the contactless type like this:
You are worried about this happening, right?
You don't have to worry. EMV is a chip standard that can have both contact and contactless interfaces. With the traditional contact interface, this means you actually have to physically insert the chip into a POS terminal for it to be authorized, like this:
With the contact interface, nothing is wireless. No data is sent out in a stand-alone contact type EMV chip. With the EMV contactless interface, data is sent wirelessly.
Furthermore, contactless chip cards are required to show a symbol (looks like Wi-Fi symbol) somewhere on the card that to denote it's capability as a contactless card. For example, here's an example of a Discover Card with contactless capability (in which Discover calls "Discover ZIP") showing the contactless symbol on the back of the card:
Don't believe everything that the media says. Besides, millions of people all over the world from London to Singapore, uses contactless payments daily in extremely crowded subways and mass transit with nary any problems. There are multiple layers of encrypted securities and keys that are needed to break the code.
Frankly, giving your physical card to a waiter/waitress who takes the card out of your view is much more susceptible to fraud than contactless payments.
Why should I care?
If you are an international traveler, you will want this because majority of the world has or in the process of converting to this payment format.
In fact, in 2012, even North Korea moved to the EMV format, leaving the US as one of the countries in the world that hasn't done so.
In addition, VISA, MC, AMEX, and Discover have all agreed to incentivize the USA shifting to EMV payments by 2015 by shifting liability for fraudulent transactions to merchants if they do not have EMV equipment and the cardholder has an EMV card. So if you travel internationally or would like to get one before the others, you might be interested in getting one.
BS! I had no problems using my card in [insert whereever country], [insert whatever point in time]
If you stick to the tourist path where they have lots of visitors from the US, you should have no problems using your mag-stripe only card in hotels and restaurants, at least for now. But as things can change as things go forward.
However, consider that once you start taking the off-beaten path, go to non-touristy places where they are not familiar with mag-stripes, rent a car and use toll roads, fill up gas, or try to buy train tickets you might end up into a trouble of the machine not recognizing your card because it lacks the chip. Furthermore, a lot of toll roads, gas pumps, and automated ticket machines lack any human assistance to help you when you need it the most.
But [insert credit card company] told me all merchants that display their logo must accept them! All I have to do is report them for violating their agreements, right?
There are several factors against this.
1. You can only speak English. The merchant representative, most likely a part-time clerk earning minimum wage, speaks in a different language, let's say French. If you have no French language skills, how are you going to get your point across? Are you going to whip out your cell phone at exorbitant int'l roaming charges and hope the customer service is going to translate it for you on the spot? Or maybe you might actually know French. But how about Swahili, Farsi, Balinese, or the multiple languages in mainland China?
2. Just like US, the rest of the world's businesses uses part-time minimum wage workers as cashiers to cut down on labor costs. Most of their SOP training manuals are written by MBA types to not to do anything they are not familiar with. Do not expect them to understand the intricate details of credit card mumbo jumbo. You don't expect Taco Bell employees to understand the minute details of Discover-JCB-Union Pay agreements, right? Same thing the other way around: be respectful as a guest in their country, prepare in advance in their ways, avoid being an "ugly American" stereotype.
3. You are a guest in their country. You are a minority. If 99.9% of their country's people and other tourists from around the world uses EMV, do you really think they are going to accomodate the 0.1% of American tourists who only have mag-stripes credit cards?
4. Again, you are a guest in their country. How would you, as an American standing in line, react if a Chinese tourist was clogging up the lines at a local Taco Bell because the clerk doesn't understand the Discover-Union Pay agreement and has trouble communicating between Mandarin spoken by the tourist and English spoken by the Taco Bell clerk? Same way the other way around. You do not want to clog up the lines for everyone. The less hassle, the better.
5. VISA and MC make tons of money from merchants in that country. Say SNCF French Rail. It's a billion dollar company in France. Do you think VISA is going to pull the plug of their relationship with SNCF because SNCF refuses to do mag-stripe processing at their unmanned train station kiosk? Of course not. Be realistic.
6. And lastly, if you're up against an unstaffed toll kiosk, gas pump or train ticket machine, are you going to yell curses at the machine?
But I want my credit card to be able to be used in the US too!
No worries. They have not gotten rid of the mag-stripe on the back of the card for backward compatibility reasons, just like we still have embossed numbers on our cards for backwards compatibility to using those old carbon copy imprinters.
[insert own Hyatt card image front and back together with red arrows pointing to all the backward compatibility features]
You use the chip on the front of the card abroad (for now), and the mag-stripe just like any other card for the US. Basically, you're increasing your credit card's acceptance rate by getting a card that both via the chip and the mag-stripe. You're getting a better deal for free.
And when 2015 comes along and US switches to EMV, you'll be way ahead of everyone else too!
So why did the rest of the world and the US moved/moving toward EMV?
Primarily, due to fraud concerns. You see, the mag-stripe has been with us since the 1950s. It may have been the most high tech thing back in the day, but with the technology that is available today, any shmo can pick up a $100 USB magnetic card skimming device off of eBay and get your credit card info.
And unlike skimming off contactless cards which actually need the person to have l33t programming skills, skimming off a magnetic stripe has become so ubiquitous that nary a day goes about skimming fraud going on somewhere in America, from gas pumps, Michael's stores (2011), Target breaches (2013), restaurant waiters/waitresses, to even McDonald's drive thrus.
https://www.google.com/search?q=skimming+fraud
These type of fraud used to be prevalent in Europe. But once they started switching over to EMV starting over 2 decades ago, this type of fraud went elsewhere. It went over to Asia, Canada and Mexico, Latin America, etc. etc. until they too began implementing EMV to combat skimming fraud. The US is practically the only country left that hasn't done so, therefore all the fraud that used to take place elsewhere is now happening here.
But EMV is old and it's not fool proof. Shouldn't we just skip over it and do something new instead?
Yes, EMV is old. It was developed in the 1990s and its smart card payment predecessor was first introduced in France. But as of today, it has become the defacto global standard of payments.
But then, what else is there? There is no other de facto global standard of payments alternative. For example, if we decide to skip over it and do something new, hypothetically like DNA matching technology, it still means US int'l travelers will continue to have problems abroad with useless plastic acceptance because no other country is using this DNA matching technology except the US.
Besides, nothing is fool proof. You can say that the bank vault isn't fool proof because you can crack it open if enough C4 is used. But your average low-life scumbag isn't likely to get military grade C4 easily either. But the bank vault does make it harder to get the bank's money over say a petty cash box. That's the point here. EMV is akin to a security tight bank vault, the old mag-stripe is akin to a petty cash box lying around inside the drawer.
I'm a business owner and I don't think EMV is going to take off. I'm not going to spend extra hundreds of dollars to upgrade my credit card machine. Convince me other wise why I should.
I can understand the added extra cost to your business once this switchover takes place. But before even saying that, look at your existing POS terminal. Does it have a slot somewhere to insert a card?
Most likely, if you had replaced your POS terminal within the past five years, you already have an EMV capable terminal. EMV is basically just not turned on yet from the processor and acquirer side.
If you have an EMV capable terminal, then a best bet would be to contact your acquirer to have the EMV feature turned on. You did your end of the deal already by having an EMV capable terminal, it is now the acquirers' responsibility to turn it on in accordance to the EMV switchover mandate.
And if you don't, you are going to replace your POS terminal anyway from common wear and tear. It isn't a hard switch-over. You can continue to use your POS terminal until it dies out because EMV cardholders will still have the mag-stripe on the back. And by the time your non-EMV capable POS terminal is up for replacement the market will be full with these newer POS terminals that can accept the mag-stripe, EMV, as well as contactless payments.
In addition, you may also want to check with your acquirer or processor about EMV capable terminals. Some of them are willing to replace your terminal for free in preparation for the US EMV switchover. Call and ask for details.
But what's in it for me? I'm the one that has to pay for the upgrade.
All the major card networks have given incentives for merchants for the upcoming EMV switchover.
If 75% or more of your credit card transactions are done on an EMV contact and contactless terminal, they are going to waive your annual PCI-DSS fees, which usually costs you around $5.00-$19.95/month per terminal. The overall long term cost savings of those compliance fees will be larger than the cost of an one time upgrade for the terminal.
The downside is that once EMV switchover happens and if you do not have a POS terminal that is able to accept EMV, the fraud liability shifts over to the merchant.
I own several fast food franchises. If I upgrade my POS terminals at all of my restaurants, it's going to cost me thousands, if not millions. I don't think anyone is going to use a fake credit card to buy $5 burgers. And if they do, wouldn't it be cheaper for me to eat the fraud cost?
Remember also that fraud isn't just committed by dishonest customers using fraudulent cards. Fraud can also happen with dishonest employees skimming off credit card data from the mag-stripe as in the case of a teenage McDonald's drive thru employee skimming off $13,000 of customers' credit cards in Olympia, WA. Consider the public relations fall out that your business may have if this happens (i.e. the big Target breach of 2013, where someone used a mag stripe card to load malware INTO Target's system). Is it worth risking to take such a huge PR disaster?
EMV wikipost volunteers: kebosabi
What is EMV?
EMV is a defacto global standard of technology where there is a visible microchip on the front of the card. It looks like this:
Who issues them?
See Google Docs spreadsheet in Post #1
SFOAMS also has created a list of excellent webpage that shows US EMV cards in a more interactive interface
Another site, which lets you narrow the search for an EMV card by various parameters, is http://www.spotterswiki.com/emv/index.php.
Several credit unions issue some form of Chip-and-PIN credit cards or prepaid cards. Prepaid EMV cards however are not recommended due to junk fees. USAA (currently restricted to members of military) used to offer Chip-and-PIN cards, but as late has backtracked to Chip-and-Signature priority.
Hey that's a cool Google Docs list! I know others that aren't on that list. How can I help by adding them to the list?
My bad for not putting this into the wiki sooner. Right now, the Google Docs is locked out of editing and only in "read-only" view because there were instances in the past where people would just delete the rows not thinking that it affects others viewing the list.
If you promise not to delete any rows and input all the pertinent info (annual fee, rewards, FTF, etc.), I can provide you with edit access. Just shoot me a PM to kebosabi with your gmail address and I'll provide you edit access.
Thanks for helping out!
As of October 2014, no USA-based card issuer offers Chip-and-PIN priority cards except for BMO Harris (Diners Club) and UN Federal Credit Union. Other major USA-based banks such as BofA, Chase, Citi, as well as others issue Chip-and-Signature cards which may work at many automated kiosks. However, bear in mind the word may is used above is a context where there is no absolute certainty of success for certain environments such as automated kiosks due to different natures of offline and online transactions. It is highly recommended to read Post #3 which lists real life FTer examples on how Chip-and-Signature worked and did not work at various transaction environments.
Can I upgrade it right now?
If it's listed on that Google Docs spreadsheet or SFOAMS' Silk page, wouldn't hurt to call/twitter them for a free upgrade. If you get the response you don't like, hang up, try again.
What is the difference between Chip-and-Signature and Chip-and-PIN?
You insert the chipped card into the slot. The physical contact terminal will read the EMV chip and the terminal will automatically read the preferred cardholder verification methods (called CVM) for that card.
Chip-and-Signature means that the terminal will printout a receipt for you to sign. This is the most prevalent authentication for most US issued EMV cards. Chip-and-Signature helps in a way that it will get through to face-to-face merchant transactions where you and the merchant do not speak the same language.
Chip-and-PIN means that the terminal will prompt you to input a PIN for authentication. Some credit union issued credit cards will have this CVM as secondary if Chip-and-Signature cannot be done. Chip-and-PIN is the more prevalent method of authentication used outside the US, especially in transaction environments where no human interaction is needed (i.e. automated gas pumps, toll roads, train kiosks, etc.).
The Google Docs spreadsheet will list which CVM are used in the EMV cards listed. Some cards can only do Chip-and-Signature. Other cards can do both Chip-and-Signature and Chip-and-PIN. And others might have a third option called No CVM (no authentication needed) which is reserved for low value transactions.
One chip can hold a lot more data, therefore it is capable of doing multiple verification methods. That's one of the great things about EMV over the mag-stripe which can hold very little data.
I want to know for sure what my EMV chip does. Is there anyway I can test out my own EMV card to see what the CVM list is?
alexmt has written up a nice step-by-step procedure on Post #3615.
If most of the EMV cards in the US is the Chip-and-Signature type, doesn't that mean it's still useless abroad?
Depends if you see it as glass half empty or glass half full. See Post #3 for further details on how Chip-and-Signature has worked both successfully and unsuccessfully depending on the merchant transaction environment and use your best judgment whether which one is right for you.
Are there any places in the US that are accepting transactions via the EMV chip?
tmiw has created a dedicated Google maps webpage to show where EMV has been proven to work here: http://emvacceptedhere.com/ Per his Post #4240, feel free to add any places with active EMV terminals if you come across one.
As of 2014/05, the EMV terminals in most Walmarts and Sam's Clubs are being turned on. Hence, the best place to try them out would be your local Walmart or Sam's Club. For other merchants, it's slowly being phased in.
I hope people will post them in the Post your receipt of your 1st EMV based transaction in the US thread. cvarming has shown us an EMV transaction receipt from Brooklyn, NY in Post #2380. I myself had my first EMV based (Chip-and-Signature) transaction in two stores in the Los Angeles area, as shown in detail in Post #2705 (courtesy of WhatWhatTech for pointing these two stores out)
I don't want a chip in my card. I heard horror stories all over the media saying hackers can steal my credit card info from a mile away.
There are two types of chips. One is contactless and the other is contact. Cards can be either one or the other, or both.
In the Google Docs spreadsheet, the cards that are capable of contactless payments are listed seperately under the "RFID or NFC contactless chip" column. If it says yes, then that means it has the ability to do contactless payments. If it says no, it doesn't have that feature.
The one that the media has overhyped about hackers "stealing your information wirelessly" was the contactless type like this:
You are worried about this happening, right?
You don't have to worry. EMV is a chip standard that can have both contact and contactless interfaces. With the traditional contact interface, this means you actually have to physically insert the chip into a POS terminal for it to be authorized, like this:
With the contact interface, nothing is wireless. No data is sent out in a stand-alone contact type EMV chip. With the EMV contactless interface, data is sent wirelessly.
Furthermore, contactless chip cards are required to show a symbol (looks like Wi-Fi symbol) somewhere on the card that to denote it's capability as a contactless card. For example, here's an example of a Discover Card with contactless capability (in which Discover calls "Discover ZIP") showing the contactless symbol on the back of the card:
Don't believe everything that the media says. Besides, millions of people all over the world from London to Singapore, uses contactless payments daily in extremely crowded subways and mass transit with nary any problems. There are multiple layers of encrypted securities and keys that are needed to break the code.
Frankly, giving your physical card to a waiter/waitress who takes the card out of your view is much more susceptible to fraud than contactless payments.
Why should I care?
If you are an international traveler, you will want this because majority of the world has or in the process of converting to this payment format.
In fact, in 2012, even North Korea moved to the EMV format, leaving the US as one of the countries in the world that hasn't done so.
In addition, VISA, MC, AMEX, and Discover have all agreed to incentivize the USA shifting to EMV payments by 2015 by shifting liability for fraudulent transactions to merchants if they do not have EMV equipment and the cardholder has an EMV card. So if you travel internationally or would like to get one before the others, you might be interested in getting one.
BS! I had no problems using my card in [insert whereever country], [insert whatever point in time]
If you stick to the tourist path where they have lots of visitors from the US, you should have no problems using your mag-stripe only card in hotels and restaurants, at least for now. But as things can change as things go forward.
However, consider that once you start taking the off-beaten path, go to non-touristy places where they are not familiar with mag-stripes, rent a car and use toll roads, fill up gas, or try to buy train tickets you might end up into a trouble of the machine not recognizing your card because it lacks the chip. Furthermore, a lot of toll roads, gas pumps, and automated ticket machines lack any human assistance to help you when you need it the most.
But [insert credit card company] told me all merchants that display their logo must accept them! All I have to do is report them for violating their agreements, right?
There are several factors against this.
1. You can only speak English. The merchant representative, most likely a part-time clerk earning minimum wage, speaks in a different language, let's say French. If you have no French language skills, how are you going to get your point across? Are you going to whip out your cell phone at exorbitant int'l roaming charges and hope the customer service is going to translate it for you on the spot? Or maybe you might actually know French. But how about Swahili, Farsi, Balinese, or the multiple languages in mainland China?
2. Just like US, the rest of the world's businesses uses part-time minimum wage workers as cashiers to cut down on labor costs. Most of their SOP training manuals are written by MBA types to not to do anything they are not familiar with. Do not expect them to understand the intricate details of credit card mumbo jumbo. You don't expect Taco Bell employees to understand the minute details of Discover-JCB-Union Pay agreements, right? Same thing the other way around: be respectful as a guest in their country, prepare in advance in their ways, avoid being an "ugly American" stereotype.
3. You are a guest in their country. You are a minority. If 99.9% of their country's people and other tourists from around the world uses EMV, do you really think they are going to accomodate the 0.1% of American tourists who only have mag-stripes credit cards?
4. Again, you are a guest in their country. How would you, as an American standing in line, react if a Chinese tourist was clogging up the lines at a local Taco Bell because the clerk doesn't understand the Discover-Union Pay agreement and has trouble communicating between Mandarin spoken by the tourist and English spoken by the Taco Bell clerk? Same way the other way around. You do not want to clog up the lines for everyone. The less hassle, the better.
5. VISA and MC make tons of money from merchants in that country. Say SNCF French Rail. It's a billion dollar company in France. Do you think VISA is going to pull the plug of their relationship with SNCF because SNCF refuses to do mag-stripe processing at their unmanned train station kiosk? Of course not. Be realistic.
6. And lastly, if you're up against an unstaffed toll kiosk, gas pump or train ticket machine, are you going to yell curses at the machine?
But I want my credit card to be able to be used in the US too!
No worries. They have not gotten rid of the mag-stripe on the back of the card for backward compatibility reasons, just like we still have embossed numbers on our cards for backwards compatibility to using those old carbon copy imprinters.
[insert own Hyatt card image front and back together with red arrows pointing to all the backward compatibility features]
You use the chip on the front of the card abroad (for now), and the mag-stripe just like any other card for the US. Basically, you're increasing your credit card's acceptance rate by getting a card that both via the chip and the mag-stripe. You're getting a better deal for free.
And when 2015 comes along and US switches to EMV, you'll be way ahead of everyone else too!
So why did the rest of the world and the US moved/moving toward EMV?
Primarily, due to fraud concerns. You see, the mag-stripe has been with us since the 1950s. It may have been the most high tech thing back in the day, but with the technology that is available today, any shmo can pick up a $100 USB magnetic card skimming device off of eBay and get your credit card info.
And unlike skimming off contactless cards which actually need the person to have l33t programming skills, skimming off a magnetic stripe has become so ubiquitous that nary a day goes about skimming fraud going on somewhere in America, from gas pumps, Michael's stores (2011), Target breaches (2013), restaurant waiters/waitresses, to even McDonald's drive thrus.
https://www.google.com/search?q=skimming+fraud
These type of fraud used to be prevalent in Europe. But once they started switching over to EMV starting over 2 decades ago, this type of fraud went elsewhere. It went over to Asia, Canada and Mexico, Latin America, etc. etc. until they too began implementing EMV to combat skimming fraud. The US is practically the only country left that hasn't done so, therefore all the fraud that used to take place elsewhere is now happening here.
But EMV is old and it's not fool proof. Shouldn't we just skip over it and do something new instead?
Yes, EMV is old. It was developed in the 1990s and its smart card payment predecessor was first introduced in France. But as of today, it has become the defacto global standard of payments.
But then, what else is there? There is no other de facto global standard of payments alternative. For example, if we decide to skip over it and do something new, hypothetically like DNA matching technology, it still means US int'l travelers will continue to have problems abroad with useless plastic acceptance because no other country is using this DNA matching technology except the US.
Besides, nothing is fool proof. You can say that the bank vault isn't fool proof because you can crack it open if enough C4 is used. But your average low-life scumbag isn't likely to get military grade C4 easily either. But the bank vault does make it harder to get the bank's money over say a petty cash box. That's the point here. EMV is akin to a security tight bank vault, the old mag-stripe is akin to a petty cash box lying around inside the drawer.
I'm a business owner and I don't think EMV is going to take off. I'm not going to spend extra hundreds of dollars to upgrade my credit card machine. Convince me other wise why I should.
I can understand the added extra cost to your business once this switchover takes place. But before even saying that, look at your existing POS terminal. Does it have a slot somewhere to insert a card?
Most likely, if you had replaced your POS terminal within the past five years, you already have an EMV capable terminal. EMV is basically just not turned on yet from the processor and acquirer side.
If you have an EMV capable terminal, then a best bet would be to contact your acquirer to have the EMV feature turned on. You did your end of the deal already by having an EMV capable terminal, it is now the acquirers' responsibility to turn it on in accordance to the EMV switchover mandate.
And if you don't, you are going to replace your POS terminal anyway from common wear and tear. It isn't a hard switch-over. You can continue to use your POS terminal until it dies out because EMV cardholders will still have the mag-stripe on the back. And by the time your non-EMV capable POS terminal is up for replacement the market will be full with these newer POS terminals that can accept the mag-stripe, EMV, as well as contactless payments.
In addition, you may also want to check with your acquirer or processor about EMV capable terminals. Some of them are willing to replace your terminal for free in preparation for the US EMV switchover. Call and ask for details.
But what's in it for me? I'm the one that has to pay for the upgrade.
All the major card networks have given incentives for merchants for the upcoming EMV switchover.
If 75% or more of your credit card transactions are done on an EMV contact and contactless terminal, they are going to waive your annual PCI-DSS fees, which usually costs you around $5.00-$19.95/month per terminal. The overall long term cost savings of those compliance fees will be larger than the cost of an one time upgrade for the terminal.
The downside is that once EMV switchover happens and if you do not have a POS terminal that is able to accept EMV, the fraud liability shifts over to the merchant.
I own several fast food franchises. If I upgrade my POS terminals at all of my restaurants, it's going to cost me thousands, if not millions. I don't think anyone is going to use a fake credit card to buy $5 burgers. And if they do, wouldn't it be cheaper for me to eat the fraud cost?
Remember also that fraud isn't just committed by dishonest customers using fraudulent cards. Fraud can also happen with dishonest employees skimming off credit card data from the mag-stripe as in the case of a teenage McDonald's drive thru employee skimming off $13,000 of customers' credit cards in Olympia, WA. Consider the public relations fall out that your business may have if this happens (i.e. the big Target breach of 2013, where someone used a mag stripe card to load malware INTO Target's system). Is it worth risking to take such a huge PR disaster?
USA EMV cards: Availability, Q&A (Chip & PIN -or- Chip & Signature) [2012-2015]
Jan 7, 2014, 11:34 am
#2536
Join Date: Jul 2010
Location: New York
Programs: Cutting down :-(
Posts: 604
Jan 7, 2014, 11:37 am
#2537
Join Date: Jul 2010
Location: New York
Programs: Cutting down :-(
Posts: 604
Yup. That's what I'm saying. I put it into my EMV reader -- no CVMs defined, just track data. 
I presume there's something on the track that still triggers the 'insert chip' message, though. Maybe that's worth something.
Re: "encryption". Well... not sure what's encrypted. I can see my name, card number and expiry on the chip without entering a PIN, and there are no encryption keys on the chip, and it's not capable of encrypting/decrypting anything. Maybe their marketing copy just means it's harder to replicate the chip, which is true.
I presume there's something on the track that still triggers the 'insert chip' message, though. Maybe that's worth something.
Re: "encryption". Well... not sure what's encrypted. I can see my name, card number and expiry on the chip without entering a PIN, and there are no encryption keys on the chip, and it's not capable of encrypting/decrypting anything. Maybe their marketing copy just means it's harder to replicate the chip, which is true.
Jan 7, 2014, 11:38 am
#2538
Join Date: Jul 2006
Location: LAX
Programs: AA EXP 1.5MM, Asiana Club Silver, KE Morning Calm, Hyatt Platinum, Amtrak Select
Posts: 7,161
Standard answer along the lines of: Good news! You won't be required to enter a PIN overseas, all merchants are required to accept Visa/Mastercards! Additionally we have other cards that offer Chip and Signature so you won't have to worry about being required to set a PIN!
The former is the vantage point for most international travelers - the ability to use their cards from their neighborhood 7-Eleven to a gas pump in rural France. The latter is the vantage point for all consumers alike - expectation of better securities to prevent fraud from occurring too easily to start with.
Last edited by kebosabi; Jan 7, 2014 at 11:51 am
Jan 7, 2014, 11:48 am
#2539
Join Date: Jul 2007
Posts: 1,762
Don't we all get it by now. There is this sense many people in this country have that the only way to do things is the way we do it. We've discussed throughout the reluctance or better word is resistance to joining the rest f the world by adopting the metric system and cling to the imperial system that even the British have given up (although at the urging of the eu), the outdated Farenheit temperature scale, the $1 bank note, asinine gun laws, lack of single payer healthcare for all, emv chip and pin credit cards. Magnetic strips are fine. They work and besides why would we want to do things the way they do it in Europe (or Canada or Australia). I go back a long way when we were told we would begin converting to metric in the 1970's and when last I checked, we still use miles and teach our kids there are 5,280 feet in a mile or 1,760 yards and of course the ever present 12 inches in a foot...kids in the rest of the world learn there are 1000 meters in a kilometer and 100 centimeters in a meter. Just move the decimal point. And we wonder why our kids hate math.
EMV conversion looks like it will suffer the same gruesome fate and I really believe that ultimately we will end up with chip and signature in this country because as they say Americans are reluctant to embrace new things. There may be some truth to that!
EMV conversion looks like it will suffer the same gruesome fate and I really believe that ultimately we will end up with chip and signature in this country because as they say Americans are reluctant to embrace new things. There may be some truth to that!
Jan 7, 2014, 12:05 pm
#2540
Join Date: Jul 2006
Location: LAX
Programs: AA EXP 1.5MM, Asiana Club Silver, KE Morning Calm, Hyatt Platinum, Amtrak Select
Posts: 7,161
For the most part nowadays, we have the ability to change our smartphones to display the weather degrees in Celsius, display the phone time to the 24 hour standard, our GPS to speak out distance in km over miles, buy a metric scales on Amazon.com, and these changes can be done on an per-individual level. If it can be easily done on the individual level, I could care less. And that is exactly what I do: I have my smartphone show time in 24 hour format, show the weather in Celsius, and my Garmin GPS is set to say and display everything in metric.
The problem with EMV on which is set at higher priority is that there is no consumer choice; it's what gets decided by the bank, not the individual preference of the user.
If there was a way to say, go online to your credit card account, and you as the individual have control to set up which comes first on the AID list, I'd be more than happy as a compromise. Give the individual card user the ability to change the AID priority list as they see fit, instead of letting the banks or government entity decide whats best for us.
Something like this:
1. Go online at citi.com
2. Set up your EMV AID preference (PIN, Signature, no CVM in this order)
3. Head to local branch, re-program your EMV card to your set AID preference
4. You now have a Citi card that is programmed to your specifics
That would be more than a good compromise for me.
The problem with EMV on which is set at higher priority is that there is no consumer choice; it's what gets decided by the bank, not the individual preference of the user.
If there was a way to say, go online to your credit card account, and you as the individual have control to set up which comes first on the AID list, I'd be more than happy as a compromise. Give the individual card user the ability to change the AID priority list as they see fit, instead of letting the banks or government entity decide whats best for us.
Something like this:
1. Go online at citi.com
2. Set up your EMV AID preference (PIN, Signature, no CVM in this order)
3. Head to local branch, re-program your EMV card to your set AID preference
4. You now have a Citi card that is programmed to your specifics
That would be more than a good compromise for me.
Last edited by kebosabi; Jan 7, 2014 at 12:20 pm
Jan 7, 2014, 12:18 pm
#2542
Join Date: Jul 2009
Location: KWI
Programs: AA EXP
Posts: 806
Confirmed via my Barclays contact that it defaults to Chip and Sig first, then PIN second. Both on Arrival and Hawaiian. Since Barclays is still in the trial phase, they are much more receptive to comments than say Chase or Citi. Send them in!
Is part of the reluctance to adopt Chip and PIN have to do with how you physically pay? I imagine a lot of places (especially dining) in the US are set up so that you must give your card to the cashier or server which would make it difficult for PIN entry (at least how we're use to paying at table). When I was in Canada they brought the payment terminal to your table to enter the PIN. I have yet to see that here.
Is part of the reluctance to adopt Chip and PIN have to do with how you physically pay? I imagine a lot of places (especially dining) in the US are set up so that you must give your card to the cashier or server which would make it difficult for PIN entry (at least how we're use to paying at table). When I was in Canada they brought the payment terminal to your table to enter the PIN. I have yet to see that here.
Last edited by LoneTree; Jan 7, 2014 at 12:33 pm
Jan 7, 2014, 12:27 pm
#2543
Join Date: Oct 2005
Location: SF
Programs: UA, VX, QF, EY, VA
Posts: 756
Either way, the entire (original) point of the EMV chip is that the chip itself is a tiny computer capable of encrypting and decrypting data using a variety of algorithms (DES/RSA/AES). Each chip can contain its own private key, and it's capable of proving its authenticity to the terminal/network/etc if need be. All my Australian EMV cards contain the correct keys/etc for offline+online encryption.
You can read book 2 of the EMV standard for more information.
Jan 7, 2014, 12:28 pm
#2544
Join Date: Jul 2006
Location: LAX
Programs: AA EXP 1.5MM, Asiana Club Silver, KE Morning Calm, Hyatt Platinum, Amtrak Select
Posts: 7,161
A NOLA article back in 2012 says that Drago's in New Orleans, LA changed them to those when some of their waiters were caught skimming off credit cards in the back room.
Originally Posted by NOLA
Cvitanovich said Drago's is and remains in compliance with the Payment Card Industry (PCI) Data Security Standards. But he is upgrading the restaurant's technology to prevent this type of theft from occurring. He has ordered handheld credit card terminals for his serving staff.
"The credit card will not leave the table at the Metairie restaurant. The server will bring the terminal to the table and the credit card will be scanned, never leaving the sight of the customer," Cvitanovich said.
He hopes to have the terminals in place when next week when the restaurant reopens after Mardi Gras.
"The credit card will not leave the table at the Metairie restaurant. The server will bring the terminal to the table and the credit card will be scanned, never leaving the sight of the customer," Cvitanovich said.
He hopes to have the terminals in place when next week when the restaurant reopens after Mardi Gras.
Last edited by kebosabi; Jan 7, 2014 at 12:38 pm
Jan 7, 2014, 12:39 pm
#2545
Join Date: Jul 2007
Posts: 1,762
Confirmed via my Barclays contact that it defaults to Chip and Sig first, then PIN second. Both on Arrival and Hawaiian. Since Barclays is still in the trial phase, they are much more receptive to comments than say Chase or Citi. Send them in!
Is part of the reluctance to adopt Chip and PIN have to do with how you pay? I imagine a lot of places (especially dining) in the US are set up so that you must give your card to the cashier or server which would make it difficult for PIN entry (at least how we're use to paying at table). When I was in Canada they brought the payment terminal to your table to enter the PIN. I have yet to see that here.
Is part of the reluctance to adopt Chip and PIN have to do with how you pay? I imagine a lot of places (especially dining) in the US are set up so that you must give your card to the cashier or server which would make it difficult for PIN entry (at least how we're use to paying at table). When I was in Canada they brought the payment terminal to your table to enter the PIN. I have yet to see that here.
Jan 7, 2014, 1:32 pm
#2546
Join Date: Nov 2004
Location: Philadelphia
Programs: AA (Exec Plat), ANA (Plat), Club Carlson (Gld), Hilton (Diamond), IHG (Plat), SPG (Gld)
Posts: 447
Obviously we don't know the inner workings and thoughts of the people who make these decisions but as we think back, it remains my opinion that Chase and Citi never at the time had their heart in the emv chip but they were getting so many complaints from their high end users who travel a lot that they just sort of took the easy way out and brought about chip and signature which really didn't require all that much back office changes. It was a cheap way to appease their top of the line cardholders. Ikay, get that (don't agree but can understand what they did). However, at least to me and I'm pretty dumb it made no sense why the fcu's in the DC area went with chip and signature priority cards rather than just issuing priority chip and pin cards. I don't see the savings, I don't see any possible rationale. Do they really think Americans would rebel against having to enter a pin? There has to be some reason we're all missing for such a shortsighted decision where the consequences are beginning to become apparent. And while I don't know how it will end up working, hasn't Australia recently imposed regs requiring cc transactions to be done with a pin? (although perhaps it only applies to Australian cards, that's not clear). And there's always talk of the eu sticking its nose into this and requiring pins on cc transactions in the future.
And then where will we be if we continue on this path with chip and signature or chip and signature priority cards.
And then where will we be if we continue on this path with chip and signature or chip and signature priority cards.
Jan 7, 2014, 1:33 pm
#2547
FlyerTalk Evangelist
Join Date: Dec 2009
Location: HaMerkaz/Exit 145
Programs: UA, LY, BA, AA
Posts: 13,167
Josh...I respectfully disagree about id checking and will never never show id and carry in my wallet the regulation from mastercard which clearly states a merchant may not refuse to complete a transaction when id is not shown. Here's why.
Credit card fraud while traumatic perhaps and a little pain in the butt is fairly easy to deal with thanks to US liability laws. As you probably know, the maximum liability for fraud in the US is $50 and I don't know of any bank which tries to collect the $50. You indicate which transactions are fraudulent, sign an affadavit, get a new credit card and the biggest hassle is changing the merchants you have automatic payments assigned to the card but then again you have to do that when a new card is issue after expiration anyway (some merchants continue to debit expired accounts and it sometimes goes through anyway). Credit card fraud is absolutely not identity theft. Identity theft is a much more serious problem and may really involve lots of headaches. Identity theft rings operate on gathering information. Even getting your driver's license number can be an opening in your security firewall. Who's to say some clerk is not capable when you show your driver's license of memorizing the number or your birthdate or whatever. This could lead to identity theft.
Sorry I would rather chance credit card fraud than identity theft. Showing ID is not a wise thing to do.
Credit card fraud while traumatic perhaps and a little pain in the butt is fairly easy to deal with thanks to US liability laws. As you probably know, the maximum liability for fraud in the US is $50 and I don't know of any bank which tries to collect the $50. You indicate which transactions are fraudulent, sign an affadavit, get a new credit card and the biggest hassle is changing the merchants you have automatic payments assigned to the card but then again you have to do that when a new card is issue after expiration anyway (some merchants continue to debit expired accounts and it sometimes goes through anyway). Credit card fraud is absolutely not identity theft. Identity theft is a much more serious problem and may really involve lots of headaches. Identity theft rings operate on gathering information. Even getting your driver's license number can be an opening in your security firewall. Who's to say some clerk is not capable when you show your driver's license of memorizing the number or your birthdate or whatever. This could lead to identity theft.
Sorry I would rather chance credit card fraud than identity theft. Showing ID is not a wise thing to do.
2. Do you ever buy alcohol or go into a bar? They check your ID there
3. Not really as much, but what about places where you're required to show a drivers license or passport?
The neccessity of the portable terminals came up somewhere in this long thread. Since in a chip and pin situation the card has to be in the reader when the pin is entered, obviously restaurants need portable wireless terminals unless they use the Denny's method of paying the cashier as you leave (where a pos terminal would be the same as any retailer). Actually this is another issue as I hate when my card is taken by a waiter to some back room where of course theft of the data on the magnetic strip is easy to do and probably the times (4 in all in the last 20 years) I've been nicked by counterfeited cards, twice to the tune of $8,000) I would wager the number was stolen by a scanner at a restaurant back room operation (I keep my eye out for extra swipes at cashers). Frankly almost every restaurant will have to invest in portable terminals if this should come to pass. (I love the ones at Wagamama in the UK...they either swipe or insert the card and hand you the terminal while you enter the information as to whether you wish to leave a tip on the transaction!) Easy in the UK too...tip is 10% of the bill (although the bill already includes the VAT..in the USA it's 15 to 20 per cent but supposedly only on the price before sales tax...that's why many restaurants make sure the final amount including sales tax is prominent on the bill!) But in the UK, especially Wagamama with the portable terminal, if the bill is £17.30, the tip is £1.73 which I round to the nearest shilling oops 5p.
Jan 7, 2014, 1:41 pm
#2548
Join Date: Jul 2009
Location: KWI
Programs: AA EXP
Posts: 806
I am not as familiar with EMV as other experts on this forum, but I did work in the banking industry for several years. The only reason I can think of that most banks in the US have decided to go with Chip & Signature rather than Chip & Pin is that financial institutions have trained debit card users to always choose signature over pin because it provided extra security & benefits when run over the Visa/Mastercard network, and also provided these same financial institutions higher interchange revenue(credit vs debit). Now I realize this is no longer the case with regards to interchange at least for the megabucks, but does a chip & pin card allow customers to choose credit (visa/mastercard) vs debit routing as current debit cards do? If not, this is the only possible explanation I can think of because banks can still encourage customers to choose credit increasing their volume for Visa/Matercard agreements and thus allowing them to meet guaranteed minimum spend volume similar to the Chase/Visa transaction volume agreement that has been talked about on this board.
Jan 7, 2014, 1:52 pm
#2549
Join Date: Jul 2007
Posts: 1,762
I am not as familiar with EMV as other experts on this forum, but I did work in the banking industry for several years. The only reason I can think of that most banks in the US have decided to go with Chip & Signature rather than Chip & Pin is that financial institutions have trained debit card users to always choose signature over pin because it provided extra security & benefits when run over the Visa/Mastercard network, and also provided these same financial institutions higher interchange revenue(credit vs debit). Now I realize this is no longer the case with regards to interchange at least for the megabucks, but does a chip & pin card allow customers to choose credit (visa/mastercard) vs debit routing as current debit cards do? If not, this is the only possible explanation I can think of because banks can still encourage customers to choose credit increasing their volume for Visa/Matercard agreements and thus allowing them to meet guaranteed minimum spend volume similar to the Chase/Visa transaction volume agreement that has been talked about on this board.
Of course it was a different world then, I agree. The thought of hopping on a plane in NY and six hours later being in London for not all that much money comparatively just didn't exist, did it? But in many respects, our country and I'm just the messenger here has many many of its citizens living in an isolationist world. Big deal that they use chip and pin elsewhere. We don't need it. Our magnetic strips, yes a bit out of date, but they work. Same is true of some of the things I mentioned. Who needs the metric system? Who needs $1 coins? People who want these things are Europhiles as if that's a dirty word (I've been called that for advocating for chip and pin). The adage is most people don't travel outside the country so what difference does it make if some of these rich people can't use their credit cards in (you name the country). Just pay cash. Problem solved.
Another argument we hear is that even emv is out dated so why convert if something better is just around the corner (retinal scans?). I think all this is why chip and pin has not been introduced yet and may never become the standard here. One gets the feeling that the country is headed in the direction of chip and signature and who cares about the rest of the world. I could be and I hope I'm wrong but it's hard to reach any other conclusion.
Jan 7, 2014, 1:56 pm
#2550
Join Date: Jul 2009
Location: KWI
Programs: AA EXP
Posts: 806
I definitely had this one when I asked my credit union to issue an EMV card. "Just go to an ATM. Problem solved."