Alpine Jennings
EMV is here
Your chip cards should have arrived by now. As BankScoop has reported previously, the EMV (Europay MasterCard and Visa) protocol takes effect tomorrow (October 1st) in the U.S. By now, your bank, credit union or credit card company should have provided you with a new card bearing a chip on the left side (see photo).
As shown in the cover photo, these chip-enabled cards have to be inserted into a card reader in order to securely pay for your transaction. The cards also have the old magnetic stripe on the back and can continue to be used (swiped) the old fashioned way.
So why all the fuss?
Simply put, chip cards are much more secure than traditional payment cards because they have a secure computer in them. When inserted into a chip-enabled terminal, a link is established with the payment network. This link checks the authenticity of the card and uses a unique code to secure the transaction. To date, there have been no known fraud losses using the EMV standard.
In contrast, traditional credit and debit cards use a magnetic stripe to hold data. The data on that “mag stripe” (located on the back of your card) is read by a payment terminal when you swipe your card. It’s the exact same technology that’s been used in tape recorders since the 1930s. It works like this: a magnetic medium (audio tape or your card’s mag stripe) slides against a “read head” that picks up the data. Instead of music, a payment terminal picks up your name, card number and other data from your card’s mag stripe. Technicalities aside, it’s fairly easy for crooks to copy your mag stripe data onto a counterfeit card.
One common way the criminals get their hands on your data is by installing a mag stripe reader (called a “skimmer”) on an ATM or other payment device. The creeps have gotten pretty good at making their skimmers look innocent–you may think you’re inserting your card into the ATM’s card slot, but that slot may actually be a skimmer (click here for our recent alert on skimmers). After they’ve captured the data from their victims’ cards it’s a simple process to record the stolen data onto the mag stripe of a fake card.
What happens October 1st?
October 1st is the date that liability for losses shifts to merchants. Previously, when you notify your card issuer about what you suspect is fraudulent activity on your card, the issuer (your bank or credit union, for example) typically has to cover the loss. Europay, MasterCard and Visa developed the new standard (called EMV) and gave everyone time to prepare to shift to EMV compliant chip cards.
Beginning October 1st, liability for fraud losses begins to shift to the less secure links in the payment chain. For example, if a bank hasn’t issued chip cards, liability for fraud losses stays with them. Likewise, if a merchant isn’t ready to accept chip cards, the liability for fraud losses shifts to them. This liability shift is meant to be a powerful incentive for all industry players to upgrade to the new technology.
Is everyone ready?
Nope. While most major banks have made the change, many issuers have resisted the cost and effort required to develop the cards and technology. Likewise, many merchants have not completed their upgrades. You’ve likely seen new terminals in some stores. They work just fine for mag stripe transactions but on many of these terminals, the chip reader is not yet functional.
If your bank chose to issue EMV cards before the liability shift begins, your new chip card should already be in your purse or wallet. Although the new cards still carry a mag stripe and will work at any merchant, at some point merchants will begin to require you to use the chip function of the card.
With chip, you dip
Unlike a mag stripe transaction where your card is swiped through a slot, you insert the left edge of your chip card into a slot in the payment terminal. Again, look at the cover photo–it shows me inserting my Chase Freedom Visa card into a terminal this morning to pay for an oil change. Once inserted, your card remains in the terminal for a few seconds to allow the terminal and card to communicate with the payment network. Don’t forget to pull your card back out and take it with you after the transaction completes! It’s very common for people to forget and leave their card there. EMV may sound clunky, but you’ll get used to it quickly and we’ll all be safer because of it.
What happens next?
Here’s the schedule of the liability shift milestones:
October 1, 2015 – Liability shifts for Visa, MasterCard, American Express and Discover used at most stores you shop at (except pay-at-the-pump gas stations).
October 1, 2016 – Liability shifts for MasterCard used at ATMs.
October 1, 2017 – Liability shift for Visa, MasterCard, American Express and Discover liability used at pay-at-pump gas stations AND for Visa and AmEx used at ATMs.
I’m fortunate that my preferred cards have all been upgraded to chip cards and are ready for EMV. If your cards don’t have a chip, contact your bank or card issuer and find out when you can expect new, more secure cards.
