Mad stripe

[Dave Birch] Back in 2007, I wrote that

When even Canadian and Mexican migration is complete, will the U.S. then be forced to issue EMV? Probably not, because of on-line authorisation. Besides, who knows what new technologies will be dominating the retail payments space by then?

[From Digital Money: EMV USA]

Is this still true? Now that the first EMV card has been issued by a US bank, the discussion about migrating the world’s largest card market away from trivially-counterfeitable 40-year old magnetic stripe technology and on to hard-to-counterfeit 30-year old smart card technology is starting up again.

Because of the way our payment system is set up, the cost of switching to chip-and-PIN cards would have a huge impact on merchants, who would have to bear the expense of purchasing new terminals to accommodate the cards.

[From U.S. magnetic stripe credit cards on brink of extinction?]

So it’s merchants who are the block here? Well, not all of them.

Wal-Mart is calling for the U.S. to move to European-style payments card security, including smart cards that use chip-and-pin technology. “It’s time for chip-and-pin in the U.S,” Jamie Henry, Wal-Mart’s Payment Services Director, told attendees at a Smart Card Alliance event in Scottsdale, Ariz., recently.

[From Wal-Mart Touts EMV Card Security. Would it Work Here?]

You can hear Jamie discussing this is in more detail in a podcast from SecureID News. I suspect that many large retailers like Walmart have POS replacement cycles and the addition of EMV to the replacement specification isn’t that big of a deal. Yes, it would cost a big retailer millions of dollars to install EMV terminals, but if they’re installing EMV terminals anyway the marginal costs are not that great.

Wal-Mart are themselves no strangers to EMV – for example their ASDA stores in Britain have accepted Chip and PIN cards for years – and they are therefore in a good position to understand the issues involved with EMV migration in the USA.

[From EMV Migration – Wal-Mart calls for Chip & PIN Technology | EMVX Blog]

So perhaps EMV migration in the US is getting a little closer, although I suspect that not many retail chains will follow Walmart’s lead. You can see the reluctance to invest in a technology that, while it works, is already pretty old. Perhaps it’s time to take a deep breath and starting working on the next generation of payment systems — beyond EMV — and invest in that instead? Which means, as far as most observers are concerned, moving toward mobile (potentially via contactless).

If all of the stakeholders — banks, payment schemes, retailers, regulators etc — sat down with a clean sheet of paper and put forward their suggestions for the ideal payment system of the future, would it look much like EMV? Well, if the US isn’t ready for that kind of radical solution then here’s a different migration plan.

Gerard Hartsink, the chairman of the European Payments Council, who is also a senior executive vice president at ABN Amro in Holland, said that European financial companies will have largely completed the transition to the EMV Integrated Circuit Card Specification by 2011, and the council, which is driving the transition to the Single Euro Payments Area, could then advise its members to stop accepting magnetic stripe cards, which are considered less secure than those that use EMV.

[From Europe to Eye Mag-Stripe Ban – 06.26.2009 – American Banker Article]

Closer to home, Canada has already announced its dates

Magnetic stripe debit card transactions will no longer be accepted at ABMs after December 31, 2012. Magnetic stripe transactions will no longer be accepted at POS after December 31, 2015.

[From 6 years is too long for elimination of mag strip debit cards « The Bankwatch]

And further afield…

Visa Australia said today it was moving to chip and PIN technology for all of its credit cards, with signature transactions to be banned by April 2013.

[From Visa Australia kills signatures by 2013 – News – Security – ZDNet Australia]

I was with an American friend in London a couple of weeks ago and he tried to buy something in a shop. I saw with my own eyes as the assistant put the card — obviously bereft of chip — into the terminal, which then rejected it. The shop assistant said “I’m sorry but we don’t accept these cards”. I dazzled her with my expertise in these matters, explaining that my friend was a visitor from across the pond and that his card has a magnetic stripe and that if she swiped it through the card slot on the side of the terminal then everything would be all right. “I’m sorry”, she said, “but we don’t accept these cards”. She was implacable and the transaction never took place.

So I can see two categories of customers who might be getting chip cards. Suppose US issuers sent chip cards to people who travel outside the US and to people who want to use chip cards with their PC for secure access to bank accounts and so on. These people might well never use the chip at a US POS but still find it useful. The latter case is particularly interesting, in the light of Visa Europe’s decision to start offering CodeSecure cards (the cards with a PIN-pad and display on the back) for 3D-Secure online shopping. Visa and MasterCard could offer this technology on US non-chip cards as well, initially for online shopping but in time — since we all know that in the long run the payments go into the cloud and physical and virtual POS will combine — for all payments. Thus, we have a path to a non-EMV interoperable chip and PIN solution.

I don’t think this will happen, because I think that mobile will dominate for the foreseeable future, but it is at least a mildly interesting speculation.

P.S. I was given a new chip card by a UK issuer last week so I took it with me to the US and it didn’t work in a single terminal (the problem is to do with the personalisation of the MSD option) so we’ve still got a long way to go.

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]