New chip cards need a PIN to protect consumers, retailers tell Congress

Our credit cards are now secured with computer chips, but the world’s largest retail trade group says consumers are no safer, while businesses are being forced to spend up to $35 billion.

Most banks and credit unions are issuing credit cards that require a signature, rather than a PIN, a move that the National Retail Federation says means businesses are spending a fortune on terminals and software that will process "partially protective cards'' that are still vulnerable to data breaches.

“The new EMV equipment does not stop breaches,” said David French, NRF senior vice president for government relations, in a statement submitted to the House of Representatives’ small business committee. “Indeed, in many cases it provides no significant benefits either to the business or to the business’ regular customers. It is merely an additional expense small businesses are being told to bear.”

The committee was holding a hearing on what the switch to chip-enabled, or EMV, cards means for small businesses  just over a week after a liability shift took place, making merchants responsible for fraudulent transactions made with a chip card that they were unable to process.

Ready or not, it's credit card chip and dip time: What you need to know

Chip-enabled cards are more secure than those with just a magnetic stripe because they generate a unique code for each transaction, making them harder to counterfeit. The need for such technology has been underscored in the last couple of years in the wake of several high-profile data breaches at companies such as Target.

But while the chip blocks the hacking or copying of a card, the use of a PIN rather than a signature makes a difference if a card is stolen or lost. "It would be impossible for someone to use a stolen chip and PIN credit card without the correct code," says Bruce McClary of the National Foundation for Credit Counseling. "That would make the chip and PIN the most secure option."

In Europe and other parts of the world, a PIN has been the typical form of verification, and retail representatives say that a PIN is more secure. In the U.S., however, banks and credit unions are mostly sticking to the signature requirement for the new credit cards since traditionally they have not required a PIN. Consumers can request a credit card that requires a PIN if that's what they'd prefer.

Officials with MasterCard and Visa say that the counterfeiting prevented by a chip, is a greater threat than the fraud that may occur when a card is lost or stolen.

"Upgrading to chip cards and chip-enabled terminals addresses counterfeit fraud, which currently has the biggest negative impact on the U.S. economy,'' says Carolyn Balfany, group head of U.S. product delivery for MasterCard Worldwide. "Chip-and-PIN impacts lost (and) stolen card fraud, which is not as prevalent in the U.S.''

Stephanie Ericksen, vice president of Risk Products for Visa, added that the liability for transactions made with a lost or stolen card remains with the banks. "Merchants and consumers continue to be protected with zero liability for this type of fraud,'' she says.

Many retailers are not ready to handle the new chip technology. Just 27% of merchants in the U.S. were expected be able to process chip cards by the Oct. 1 deadline, according to a survey by the Strawhecker Group (TSG), a management consulting company for the payments industry.

But Visa has said that there has been significant progress, with more than 314,000 merchant locations in the U.S. enabled to process chip cards as of Sept. 15. And small businesses represented roughly 50% of chip payment volume in August.

Still, Ericksen says, there's less urgency for smaller businesses that handle low-value transactions and serve repeat customers, like  coffee shops, to make the switch — though, in time, all businesses should be on board and able to handle the new technology.

"While we want businesses to move to chip technology as quickly as possible to improve the security of payments everywhere, we know that some businesses may take more time to upgrade,'' she says. "Higher-risk merchants may make it a priority sooner.''

\