EMV Technology In Credit and Debit Cards Reducing Counterfeit Fraud, Says Visa (usatoday.com)

An anonymous reader cites an article on USA Today: The new chip-enabled cards flowing into the U.S. marketplace have already made a dent in fraud, with some of the biggest merchants seeing a dip of more than 18% in counterfeit transactions, according to Visa. Among the 25 merchants who were suffering the most instances of counterfeit fraud at the end of 2014, five that began processing credit and debit cards equipped with the new EMV technology saw those infractions fall 18.3% as of the final quarter of 2015, says Stephanie Ericksen, vice president of risk products at Visa. Meanwhile, five of those merchants who were not yet equipped to handle chip-enabled cards saw an increase in fraudulent transactions of 11.4%. "We're seeing EMV is having a positive impact on counterfeit fraud," Ericksen says. "Merchants who implement chip, their counterfeit fraud is going down, while those still finalizing plans, their counterfeit fraud is going up."Also from the report, "Visa on Tuesday also announced a software upgrade that will shave the amount of time spent on chip card transactions. With 'Quick Chip,' consumers can dip their chip cards into the terminal and withdraw it in two seconds or less, instead of waiting until their purchase is authorized. The consumer can 'put the card in the terminal and put it right back in your wallet and . . . move to get their coffee, or hamburger or start bagging their groceries,' Ericksen says. Ars Technica has more details.

Comments

I'm more impressed

[BigU 03C0in]

With the potential speedup. I intentionally avoid/bring cash to places that have the chip slot enabled because it typically takes 5 times as long to process the transaction.

Re:I'm more impressed

[Aighearach]

I don't really care that much about the theoretical security. I avoid this technology because it shifts liability onto me, that with swiping the card the old way rests with the bank.

I don't want to take on a smaller liability to save the bank from the larger old one. It isn't like the savings pass through to me.

Re:I'm more impressed

[PRMan]

unless they bring the mobile POS to the table and you enter the tip directly in it.

Sounds like the perfect solution to me.

Re:I'm more impressed

[s.petry]

IMHO this is why we see articles like TFA which intentionally omit the largest section of fraud. Sure, retailers see some credit card fraud but the majority of fraud is wire based fraud, not card in hand at merchants. Smart chips do nothing to prevent wire fraud.

Re:I'm more impressed

[Anonymous Coward]

Chip+sign is more secure than swipe+sign. Here's why:

In order to process a card-present transaction with a magstripe card, the terminal must be able to read the CVV1. That's the Card Verification Value #1, which is embedded into the magstripe, but not seen anywhere else. (Note: This is not the CVV2! The CVV2 is a completely different value and is only printed on the card. That value is used to validate card-not-present transactions, not card-present ones.) If you clone the magstripe, you clone the CVV1 with it. Security was not even imagined when this was invented, as many stores still kept carbon-copy impressions of the raised numbers on the card at that time.

In order to process a card-present transaction with a chipped card, the terminal must be able to power the chip and run the CVV-generator algorithm that the chip provides. The generated card-present CVV will not be the same twice in a row. Thus, "cloning" the card is impossible, as there's no way to clone the exact algorithm the chip uses (it introduces a hardware randomization factor) when generating the card-present CVV. (Again, the CVV2 is unchanged on these cards, because it's for card-not-present transactions.)

The signature only provides a legal assurance that you acknowledge and accept the terms of the sale, not of the card transaction. The cardholder agreement that you accepted when you signed the back of the card is what governs the acceptance of any and all card transactions not fraudulently performed against the card/account. You did that, didn't you? Or did you put something moronic like "See ID" or "CID" (yes, really, I've seen that done) and invalidate that agreement, making the card invalid as well? That's not there for the cashier to check your signature against. The cashier does not give even a single shit. That signature is there so that when you go to court, you can legally say that, yes, you did accept the terms of the cardholder agreement, and you are the legal cardholder, and you are not committing fraud in your own name.

Chip+sign is secure enough. Chip+PIN is just annoying, inconvenient, and anti-cardholder.

Re:I'm more impressed

[Mousit]

But that is also a difference that US and Canadian ATM's have as well. US ATM's generally make you swipe the card and then put it back in your wallet, while you complete the transaction. Canadian ATM's hold onto the card until you tell the ATM that you're done.

Curious. Now, I admit I never use third-party ATMs so maybe those are different, but among first-party bank ATMs, I haven't encountered a swipe one in a good 25 years. Ever since the early 90s, and having been a customer of several different U.S. banks, all I've encountered are insert-and-hold-card ATMs.

Re:I'm more impressed

[radarskiy]

"because you can't tip Chip & Pin unless they bring the mobile POS to the table and you enter the tip directly in it."

Bringing the POS to you is the point. It works perfectly fine for damned dirty communists in Europe.

Re:I'm more impressed

[GNious]

I'd not trust a location that takes your card out of your sight.

Re:I'm more impressed

[mjwx]

I don't really care that much about the theoretical security. I avoid this technology because it shifts liability onto me, that with swiping the card the old way rests with the bank.

I don't want to take on a smaller liability to save the bank from the larger old one. It isn't like the savings pass through to me.

Then fix your shitty government.

In Australia and Europe, the liability still rests with the bank. In fact merchants have gotten rid of swiping only terminals because it's the other way around (and should be) that the merchant can be liable for not having the updated terminals where as with Chip and Pin, the bank is liable.

Welcome to the World

[Ashe Tyrael]

Most of the rest of the world has had EMV for about 10 years, often wondered why it never caught on sooner over there.

Re:Welcome to the World

[Fnord666]

Most of the rest of the world has had EMV for about 10 years, often wondered why it never caught on sooner over there.

Because none of the parties involved in the transactions were losing enough to fraudulent transactions to justify the expense of implementing EMV across the ecosystem. It took a shift in the liability mandated by Visa and MasterCard to drive any real change.

18% less fraud....

[ganjadude]

what does that translate into reduced fees for us????

oh wait....

Re:18% less fraud....

[superdave80]

What fees are you paying on your credit card? Outside of foreign transactions fees, I've NEVER paid for a credit card in any way.

Re:18% less fraud....

[Anonymous Coward]

Please share with us your list of merchants who are not passing the transaction fees on to the consumer.

Still, some are certainly paying more because of their credit card habits.

More room for improvement

[twotacocombo]

In my experience, they could speed things up a lot if they'd start putting the chip slot on top. I'm 6'3", and can't see those stupid slots on most of the current local checkout terminals. I swipe my card by default, only to have the machine tell me to stick it in some hole I didn't even know was there because the thing is at waist level with the slot on the front of it. I have to bend over and search for the damn thing, and start over. If the slot was on top, I'd know it was there and would just do that from the get go. It also doesn't help that some of these same models of machines don't have the chip reader installed, but do have the slot that's filled with a plastic blank; It's anybody's guess at this point.

Re:That's nice

[bloodhawk]

What utter ignorant total bullshit. Most countries all over the world have had this as standard in everything from your local coffee shop to huge retailers for the last few years. It saves time and money for retailers, making checkouts faster, the hardware is cheap and reliable.

WTF is EMV?

[Megane]

It would have been nice if TFS or TFA had explained what EMV is. I only this past month got my first chip card (I'm in the U.S.) and had never seen the acronym before.

And yes, it is annoying to have to leave the card in there for so long, not to mention the card slots that are placed where they are hard to see. Even more annoying is that before I got the chip, I basically was never asked to sign for amounts less than $50. Now I'm sometimes being asked to sign for smaller amounts. I don't mind the industry wanting more security, but maybe they could think about the user experience side of things a bit more?

Re:WTF is EMV?

[Cimexus]

Well unfortunately the US took the half-assed approach of moving to chip, but still requiring signature. Everywhere else it's chip + PIN. By the time you've typed the 4-6 digits of your PIN, the chip reading part of it is generally done and the whole transaction is generally quicker than the whole 'cashier hands you annoying piece of paper and a pen and you sign' rigmarole.

Even better, most places outside the US these days have contactless payments available at most merchants. For smaller amounts ($100, $50, varies by country), tap your card on the reader and you're done. Takes literally 1 second.

Re:It's just so slow!

[Qzukk]

The old auths used to take us about 5 seconds, but now they take over 45 seconds.

The old auths used to take us about 30-45 seconds too, but the person didn't have to stand and stare at it their with their card in the machine, so it didn't feel like you were waiting 30 seconds.

It gave me a chance to put my card back in my wallet and my wallet back in my pocket before the cashier could try and shove the receipt into my occupied hands.

Inertia

[Solandri]

The country where something is developed first is saddled with a large installed base of the older tech. Countries which hop on the bandwagon later benefit from the experience of that trailblazer, and get the better tech right off the bat. Other examples include:

• African countries lead the world in ratio of cellular vs landline phones - they just skipped landlines almost entirely.
• Digital cell phones came to the U.S. last because the U.S. was first with analog cell phones - not only did U.S. companies have to build a digital cellular network, they had to transition all their analog customers to digital and dismantle the old analog network.
• Japan initially led the world in HDTV technology. The government pumped billions of dollars into R&D to insure the HDTV standard would be the Japanese standard. But their tech was based on analog broadcasts. In the mid-1990s, computer technology became advanced enough to allow real-time digital decompression of a HD-resolution video signal, and the U.S. leapfrogged Japan and set all the digital HDTV standards we use today.

Re:Inertia

[dave420]

Analogue cell phones were first deployed in Japan, and then in the Nordic countries. Clearly your argument is nonsense. I'm sure it's a great weight off your mind to hand-waive the US's technological short-comings away by simply shrugging, mumbling "frist!", but it has no foundation in reality.

Re:Inertia

[Ash-Fox]

The country where something is developed first is saddled with a large installed base of the older tech. Countries which hop on the bandwagon later benefit from the experience of that trailblazer, and get the better tech right off the bat.

We know however that credit card PoS systems were always more popular in the UK and France initially than the USA (1960s). Yet, the USA still can't really compete with the UK and France as far as PoS systems go.

Re:just do it

[PRMan]

So why go through it twice then?

Heh, if only it worked

[infinite9]

I'm a US citizen living outside the US. Let me tell you that these chip cards are a nightmare for us. They work about 50% of the time, with no rhyme or reason as to when they'll work or why. Trying the card a second time sometimes works. Sometimes the machines ask for PIN codes when there isn't one, other times not. When this happens, I can enter any random number and the transaction goes through. A card will work at a particular gas station one day, then not the next, then works again the following day. The cards will usually work in one store, or almost never work in another store.

Locals with the new machines have no idea what they're doing. Sometimes they swipe cards with no magnetic stripe. Sometimes they pull the card out before the transaction is done. Sometimes they argue with me telling me it's a debit card when it's a credit card.

And in all cases, whenever the card doesn't work at a purchase, the error message is "declined".

My chip Visa ATM cards work in almost no machines here, while the magnetic stripe cards did. Some give the wrong menu options on ATM machines, allowing "savings account" as the only option when I have only a checking account. Others work or don't at random. The error message is useless. Or sometimes I get different error messages depending on whether I select english or spanish at the ATM. In general, I have about a 1 in 5 chance of extracting some amount of money from a machine. When I call the customer support number on the back of the card, they swear up and down the card works just fine.

I'm slowly removing myself from a reliance on banks and even money in general. These idiotic chip cards are only encouraging me to hasten my exit.

I'm convinced this is about 10% pilot error at the point of sale, and 90% a technical problem on the bank servers in the US. The development was probably outsourced to the lowest bidding indian consulting firm.

Re:Heh, if only it worked

[Cimexus]

I would suggest getting a chip card from a local bank wherever you are. The technology works great in most places I've been (Canada, Europe and yes even the US), but then, my home bank is in Australia where chip + PIN has been established standard for well over 10 years. The US cards are kinda 'frankenstein' because they have the chip but generally no PIN (i.e. the US went with the weird hybrid approach of having a chip but still requiring signature).

Re:Completely agree.

[pacman on prozac]

Doesn't sound like you've got the same kind of card units we have in Europe, here they're integrated handset-sized boxes which do all the card interactions and are either wireless or cabled into the POS. They can usually be picked up for use or are mounted high up, some do have swipe slots but I've no idea why as I've not had a card that could be swiped for over a decade.