The payments industry has heard the card brands’ pitch. Without EMV smart card adoption in the U.S., the brands say, criminals will will focus their attacks on this country because it will become a weak link in the world’s data security chain.
What many may not have heard as often is that even if most issuers meet the card brands’ EMV migration deadline of October, 2015 for smartcard preparedness, fraudsters will assault a “honey pot” of issuers lagging behind.
A recent MasterCard Advisors web seminar addressed that “weak link within the country” scenario and other risks, citing potential financial losses estimated as high as $400 million a year for issuers that delay EMV adoption.
“A lot of people have a lot of things to sell for EMV adoption, but we want to drill it down to what is important to issuers in the U.S.,” says Mark Rennie Davis, principal of U.S. chip and point of interaction for MasterCard Inc.
While the case has been made about security risks for non-EMV countries, issuers also have to determine potential financial losses if their cardholders still carry mag-stripe cards into countries that will no longer accept them, Davis says.
When a country reaches 60% to 70% EMV penetration, fraudsters begin to move to other targets, Davis says. “Soon, Brazil and Russia (countries known to suffer fraud problems) will reach that 70% mark, and the migration of fraud will increase to the U.S.,” he says.
Such a migration of fraudsters to the U.S. would manifest itself in different ways. The country would see an increase in criminals in foreign countries creating counterfeit mag-stripe cards to use at U.S. terminals, as well as an increase in counterfeit mag-stripe cards for use at any foreign terminals still accepting them, Davis says.
In addition, criminals would increase attention on hacking into mag-stripe-only payment terminals in the U.S., he says.
“It’s really about when fraud could reach millions of dollars in potential losses, not if it is going to happen,” Davis adds.
MasterCard estimates that issuers could reduce the risk of financial losses by $25 million if they start the EMV migration in 2013, rather than near the 2015 deadline. If those issuers begin EMV migration early rather than wait far past the deadline, they reduce potential losses by $95 million, Davis says.
If the apparent risks are not enough to spark an issuer into quicker EMV adoption, Davis says those banks should also think about the potential of losing a high-net customer who would not be able to do business or initiate transactions in Europe without a smart card.
“There are some newer merchants in Europe who may have never seen a mag-stripe card,” Davis says. “It may be a small percentage, even just 1% of cardholders affected, but they represent more than 1% of your transactions and are a real value to the bank.”
In addition, banks that are not EMV-compliant risk being excluded from new EMV-mature payment market opportunities, no matter where they arise, he adds.
“EMV is the prerequisite for other opportunities,” Davis says.
The payments industry can’t be certain about when Near Field Communication mobile pay will emerge, but “it would be huge if it emerged quickly, and (non-EMV) issuers would have little time to respond,” Davis adds.
Even if an issuer feels it could skip EMV and just wait to go straight to NFC and mobile, the bank runs the risk of being hit with counterfeit attacks while waiting, Davis says.
“You can’t wait on mobile development anyway, because there will always be those consumers who prefer plastic cards,” he says.
Jeff Stroud, MasterCard's senior managing consultant for global payments and emerging markets, says the card brand is encouraging issuers and merchants to prepare for EMV cards and NFC readers at the same time.
“We believe the dual interface for cards and NFC will position the merchants well for the future,” Stroud says.
With more NFC mobile pay initiatives unfolding, the number of NFC handsets and devices steadily increases, Stroud says.
“We know those NFC handsets are coming, so now we need terminalization for EMV and NFC to take hold,” he adds.