Oops, my EMV card did not work!

Pratima H

USA: The transaction stalled or delayed. The cashier instructed to swipe the card instead of inserting it into the reader. Multiple attempts at reading the card were required. The card reader froze. The transaction was declined.

Believe it or not, these surfaced as some of the top consumer complaints for first using EMV Chip cards, as per a new study.

Chip-and PIN or Chip-and signature or EMV or the credit card and debit card payments based on chip technology initially created by Europay, MasterCard and Visa has seen a series of deadlines that usher in a liability shift in case of card-frauds. The idea is that micro-processor chips that hold and protect cardholder data are better than magnetic stripe cards. For instance, with dynamic authentication compared to earlier static ones. Or new barriers to skimming and reading cards with criminal devices.

They are apparently harder to clone and they lean on the premise of a more cost-effective contact interface. They also reflect a move to contactless as a substantial value proposition for leading smart card and secure IC players, as per ABI Research’s observations.

And MasterCard executives have underscored in a report that Chip technology reflects an essential upgrade to better protect consumers and businesses.

But even then, and despite a deadline of October 2015, 42 per cent of retailers were spotted as failing to update payment terminals to be EMV compliant. What was more glaring in this Cardhub study, which incidentally also reminded about $8 billion fraudulent card purchases each year in the U.S, that 43 per cent of retailers who have confronted sort of data breach in the past five years have not made the technology yet.

With over one billion chip-cards in use already all around the world, the US is interestingly, one of the few developed nations, to make the shift.

Could retailers be balking because of equipment upgrade investments, displacing existing systems, re-training staff, lack of hybrid systems (which allow for mag stripe too in cases of such cards), customer experience worries, check-out delays, implementation hassles, or CNP (Card Not Present) environments?Why is EMV still not 'there'?

To top that, there is competition brewing from more secure, encrypted, and tokenized transactions in form of digital wallets, NFC mobile and contactless EMV payments. Forrester has argued that that more secure forms of payments could be eking out a larger share of volume transactions than EMV chip-and-PIN and EMV chip-and-signature card payment transactions by 2025.

What cannot be ignored at this cusp of challenges and possibilities is that the EMV smart payment cards standard with EMV card issuance in the U.S hit 600 million units in 2015. With the market penetration expected to 100 per cent over the next two years with fast migration, as per what ABI Research gleans.

How would this emphasis on transition play out for consumers though? Easy, wrinkled or full of skepticism?

When October 2015 marked the official liability shift deadline for U.S merchants and card processors to adopt EMV, making it elbow out the erstwhile mode of the magnetic, Walker Sands took an effort to gauge the ground-view six months later. It wanted to examine how consumers are responding to the change and surveyed 575 of them. Titled, 'The Switch to EMV', this study, consequentially, assessed consumer sentiment toward the new chip card experience.

What it churned out was worth long thought and quick remedial actions. The problems were not just about consumer-readiness but ironically the retailers and ecosystem not being prepared enough. It was seen that retailers and card processors have been slower than expected to roll out new card readers, inform customers and thoroughly train front-line staff, leading to more than a few bumps in the customer experience.

The study notes how in the months leading up to the EMV deadline, Americans were encouraged to switch over to the new technology and received newly-minted chip cards from their banks and retailers via the mail. Yet, the EMV chip card usage is off to a slow start in-store. While most U.S consumers received EMV enabled cards in advance of the deadline, 17 per cent have never made an in-store purchase using a chip card reader.

Look further and we find that consumers don’t always have access to EMV chip scanners in-store, despite the push for compliance and adoption, with a mere 10.3 per cent using EMV chip card readers every time they make a purchase in-store. Not surprising then to spot why this may leave some consumers with the notion that EMV isn’t a priority and to continue swiping cards — ultimately putting themselves at risk for fraud.

The study, among other things, recommends that retailers, banks and other financial services organizations attempting to maintain a loyal customer base or reach new customers shouldn’t let user experience suffer as a result of the EMV liability shift. All staff members (especially cashiers and other customer-facing staff) should be trained on how the EMV card readers work, common missteps and how to answer potential questions they might receive from customers, the study-authors underline. They add how a set of instructions should also be included at cash registers and other POS terminals.

This is understandable when we see that 27.3 per cent users did not receive adequate instructions on how to actually use the cards, as per the study.

The highlights captured here become pronounced when we look at what lies ahead – another set of shift deadlines through 2016 and 2017 for ATMs and self-service fuel dispensers.

It’s a good time to ask Andrew Cross, Vice President and Partner at Walker Sands,  as what it quintessentially means when he says that the switch to EMV is no easy move. Let’s get going.

What would be the topmost concern in your reckoning, which can explain the delay and confusion over EMV Shift? Training issues, ecosystem readiness, customer psychology, holiday season, wait-and-watch risk stance, authentication mode or something else you can highlight?

The confusion throughout the EMV shift can be attributed to a perfect storm of several factors: inadequate consumer education as new cards were received, a painfully slow roll-out and activation of new POS hardware, and in many cases where new hardware is up and running, a lack of training for front-line employees.

Your report captures usage-related issues as well. Were they specific to a particular segment of users, merchants or retailers? Also anything else worth highlighting or elaborating when we look at failed/delayed transactions? Specially for this one: More than 1 in 3 (37 per cent) consumers have encountered a non-working reader at time of checkout.

Our research didn’t segment by type of user or merchant, and I haven’t seen any data on traction or lack of parsed by industry category. I think anyone who often pays with a credit card has encountered the piece of tape or paper covering the insert slot, with staff instructing customers to swipe instead.

“Do I swipe or insert?” Stand in a long checkout line at a store, and you hear it again and again. It’s become the new ritual when checking out.

How do HCE (Host Card Emulation) and SE (Secure Element) stack up when wondering about user privacy?

From a technology standpoint, the secure element has a head-start on HCE, given that it’s based on EMV technology that’s already decades old in Europe. And with SE, the fraud potential is limited to a single device at a time. Meanwhile SimplyTapp, Sequent, Bell ID and others are making progress with HCE embedded in practical use cases. As this plays out we may see that it’s not an either/or proposition in terms of HCE vs. SE, and that both may play a critical role in terms of mobile payments security.

Andrew Cross

Retail industry frauds have gained a lot of attention so does that fear cast a shadow over mobile payment technology as well? Are mobile wallets arriving too early or too late?

When you look at some of the most publicized retail breaches of note over the past several years, including Target and Home Depot, mobile payments really weren’t a factor. So I don’t think consumers are avoiding mobile payments for that reason. But the major players in the industry haven’t done a great job articulating mobile as a more secure alternative to plastic.

The technology is now in a good place. The consumer adoption isn’t there yet because the user experience hasn’t been significantly better than cash or card. Whether EMV introduces enough friction into the process for consumers to switch to mobile payments isn’t clear yet. We’ll be watching that closely over the next six months.

So, 39 per cent consumers had to update online accounts or recurring billing after receiving EMV cards, and some 9.4 per cent consumers had missed or failed payments as a result. What do all these findings augur for ATM and self-service terminal shifts imminent this year and next?

When you look at the self-service and ATM market, user experience is paramount. EMV for self-service machines really isn’t anything new. Diebold has had EMV-capable readers in some machines as early as the 1990’s. So there’s a blueprint. But if there’s anything to be learned from this study, it’s that consumer education is critical.

Would things be different if the shift came in a mandate flavor instead of a liability-one?

A lot of the issues with this EMV liability shift have been due to the slow nature of the roll-out. When not all consumers have chip cards, not all merchants have new POS terminals and not all new POS terminals are live, confusion results. I think we would have seen the same thing if it were a mandate instead of a liability shift, because you still would have seen the changes taking place over some significant period of time.

Overall, would EMV switch really help convenience and fraud-mitigation, in your opinion? Does the study or some other study glean any insight on consumer sentiment or readiness as a big picture?

EMV technology is significantly more secure than traditional mag stripe technology. The risk, however, stems from the fact that many merchants have not yet made the transition, so even chip-enabled cards are still at risk during swipe transactions. From a convenience standpoint, EMV transactions are much slower than swipe transactions. Consumers need to re-set their expectations for how long it takes to complete a card transaction.