A security analysis firm called Gemini Advisory recently released a report saying that credit card fraud is on the rise in the US. This is surprising, considering that the US has been adopting the chip. Chip cards are supposed to curb this type of fraud, which was out of control in the US, compared to similar fraud in countries that already use EMV (the chip card standard).
Chip cards work by generating a unique code for each transaction and (ideally) require a customer to enter a PIN to verify that they want to make the purchase. This doesn't make it impossible to steal information from chip-based cards, but it does make it much harder to reuse a stolen card. In contrast, using the magnetic stripe to swipe a card simply provides all the relevant information to the merchant's card reader, which is much easier to steal.
Gemini Advisory now says that 60 million credit and debit card numbers in the US were compromised in the last 12 months, and most of them belonged to chip cards.
The company found this information after extensive research on Dark Web sites, where stolen credit card numbers are commonly sold. The company said that 45.8 million, or 75 percent of the numbers published this year, were stolen from a physical point of sale (POS) in a brick-and-mortar store, while the remaining 25 percent came from online breaches. EMV can’t protect against online fraud, so 25 percent means nothing when it comes to the security of chip cards.
But what about the other 45.8 million? Ninety percent of those cards were EMV-enabled. However, that doesn’t mean chip security isn’t working. “These results reflect the lack of compliance by U.S. merchants with EMV implementation,” Gemini writes.
While almost everyone in the US has replaced their old magnetic stripe cards with new ones that have chips, it's not uncommon to try to pay for something in a store with a chip card and be asked to use the magnetic stripe on the back of it. This puts the customer at risk, as their card information can be more easily stolen, regardless of whether it has a chip or not.
When the EMV standard was introduced, its proponents argued that merchants would have an incentive to upgrade their POS terminals to accept chip cards because the responsibility for any fraud would shift from banks to merchants or anyone who didn't support chip cards during a transaction. To avoid the cost of a fraud, merchants would buy expensive new terminals.
But in some cases, merchants have chosen not to upgrade their POS. In other cases, merchants buy these expensive new terminals and can’t use them because they have to be authenticated by the merchant’s payment service provider. (Behind every credit or debit card transaction you make, there are multiple parties responsible for transmitting information about the money being exchanged and the customer’s credit limits.) Some of these payment service providers are slower than others.
There are thousands of payment service providers, each offering SMBs slightly different services for different payments. From a customer perspective, it is difficult or impossible to tell which companies are providing merchant payment processing services and which are responsible for the lack of EMV support.
From a merchant's perspective, the cost of fraud can be less than the cost of understanding what to do after purchasing a chip card reader. According to CreditCards.com., Visa has promised that it will not hold merchants liable for fraud charges under $25 or fraud charges for more than 10 transactions from the same account. Limiting merchant liability is good for merchants, but it also needs to ensure that the EMV terminal is working.
Still, it's unclear what actions major card networks like Visa and MasterCard plan to take to make chip card readers more ubiquitous. In February 2018, Visa wrote that only 59% of U.S. stores were able to accept chip cards, not including ATMs and gas station pumps that will be compliant by 2020. This is a concern because not only are customers vulnerable to having their card information stolen when they can't use the chip, but the limited number of EMV-compliant kiosks gives fraudsters more places to use stolen card numbers.
