At last there is finally an ATM EMV liability shift in the USA!

The MasterCard EMV liability shift for Maestro debit cards at US ATMs is good news for the rest of the world, where card issuers have long had to put up with huge counterfeit fraud losses in the USA.  According to Europol around 80% of non-EU fraud against EU payment cards is committed in the US.  Criminals like cash, and ATMs that are not EMV compliant (i.e. perform transactions on magnetic stripes, rather than Chips) allow cash withdrawals on counterfeit EMV cards. 

Europol busts international cross border skimming operation

Europol has just had a resounding success in the fight against organised criminals conducting international card skimming operations.  An operation code-named Operation Night Clone has resulted in 61 arrests in 5 countries - including 2 in the USA.  It is estimated that the criminal group targeted caused losses of €50 million as a result of card skimming in the EU, with the majority of these losses occurring outside the EU.  Both Europol and the European ATM Security Team (EAST) have been bringing focus onto the fact that as long as magnetic stripes remain on EU payment cards, these cards will remain vulnerable to skimming.  Both organisations have also noted that an increasing number of skimming related losses from compromised EU cards are now occurring outside the EU, with a growing percentage being seen in the USA.

Will US actions to counter card skimming be too little, too late?

Cindy Merrit, Assistant Director of the Retail Payment Risks Forum of the of the Federal Reserve Bank of Atlanta in the US, has just published an article in the blog 'Portals and Rails' headed 'Stemming the rising tide of card breach incidents: PCI compliance or chip-and-pin?  It is a well written blog and is part of an increasing amount of coverage being given to the topic of chip and PIN (EMV) in the US. 

EMV, a view from America.....

A lot is heard about EMV from those countries that are embracing it, but what about the view from the US?  The European Payments Council have today published their latest news letter.  In it there is a very good article entitled  “The Magnetic Stripe: Why it is Hard for Americans to Say Good-Bye  - In the US, clinging to old-fashioned payment methods is more than just a bad habit”. 

Some key points from the article, which is written by Bob Sullivan, are below:

• US banks generally perceive fraud losses to be less than the cost of upgrading the card infrastructure to comply with EMV standards. Until those lines cross, there are no incentives for the US financial system to engage in such a dramatic change.
• It might however be worth the while to do the maths again. Some US card industry observers recently indicated that losses due to fraudulent card transactions in the US might already exceed the costs of EMV migration.
• It should not be expected that the US government will enforce migration to EMV.
• US consumers are satisfied with the fraud fighting measures other than chip and personal identification number (PIN) technology, which are currently in place. In their view, having to enter a PIN when making a card payment creates a ‘solution in search of a problem’.
• More could be done however to enlist consumers as fraud-fighters and to convince them of the added value of chip and PIN technology. US travellers whose magnetic stripe cards are increasingly refused as a means of payment in Europe, could be the first to ask for change.
• It will take a combination of consumer education, ease of use, cost-saving technological advancements, clearer fraud accountability and government enticements to break down the Americans’ loyalty to the magnetic stripe card

You can read the whole article on the EPC website

Two major US Banks to trial EMV cards....

I have been going on for some time about the need for the USA to take some concrete steps towards the implementation of the EMV standard - as it falls further and further behind the rest of the world.  So it was with interest that I read an article published by the Mail Online a couple of days ago.  It seems that two of the largest U.S. banks, JP Morgan Chase and Wells Fargo will start to trial EMV cards.  The trial will be available to larger business customers and frequent travellers. 

One driver for such change is of course fraud, in particular card skimming, and the US market is likely to become a honeypot for skimming fraudsters as they move there to practise techniques honed in other parts of the world during the shift towards the EMV.  As recently reported by the European ATM Security Team (EAST), losses due to card skimming at ATMs in Europe have fallen for the sixth sucessive six month reporting period, and an  increasing proportion of such losses are now international, i.e. occuring outside the card issuer's country.  It would be interesting to see similar statistics for the USA.

The other driver for change to EMV is of course that the holders of stripe only cards are increasingly unable to use their cards for transactions at Chip only terminals.  The article in the Mail Online quotes a study that has quantified the impact of such lost transactions - according to financial advisory firm Aite Group a 2009 study found that issues with U.S. cards not being accepted abroad cost $4 billion in missed transactions in 2008.  Since then there has been significant further roll out of EMV globally and so I'm guessing that the equivalent figure for 2010 will have been a lot larger.  And then of course there is the matter of reputational risk as disgruntled card holders realise that their bank is issuing them with cards that are not fit for purpose in all markets.

Two of the largest U.S. banks have announced that are to start EMV card pilots, I wonder how long it will take others to follow?

Need more information?  Read the full article on the Mail Online

European ATM fraud losses continue to fall, down by 14%........

The European ATM Security Team (EAST) has just released figures for the full year 2010 which show a second annual fall in European ATM fraud losses - total losses of €268 million were reported (down €44 million from €312 million in 2009 - see the table at the end of this post).  This is the second successive annual drop, following on from the 36% fall reported for 2009 and is very good news for the region.

EAST also reports that the majority (82%) of ATM related card skimming losses are now international with most occurring in countries outside of Europe, and states that that the significant investment made by the European banking sector into EMV technology, as well as into anti-skimming devices at ATMs, is now really starting to pay off.  Well so it should!  European ATM deployers and card issuers have been investing into EMV technology for at least 8 years now, and this drop in losses is a further return on that investment. 

From leader to laggard...the USA and the death of magnetic stripe card technology

For a long time now many of us in Europe have been aware that magnetic stripe card technology is becoming increasingly archaic in a world of smart cards (Chip and PIN or EMV) - yet it seems that those countries that have made a significant investment into this technology have had to grit their teeth and, for various reasons, continue to put up with magnetic stripes on their payment cards.  Belgium recently hit the headlines when the Belgian banks publicly stated that from 17 Jan 2011 Belgian Maestro cards can no longer be used outside of continental Europe.

There is a sense of frustration that just because the USA is not moving towards EMV, the world is being held back in this particular battle against fraudsters - magnetic stripes are relatively easily compromised and the data then used to create cloned or counterfeit cards.