Components: Pen vs. PIN

Jane Adler

Visa and some card issuers are pushing signature authentication for EMV chip cards, but merchants prefer PINs. So who will win?

As financial institutions slowly roll out smart cards in the United States while processors struggle to meet looming deadlines for acceptance, a heated industry debate over authentication methods continues to boil. Some industry stakeholders prefer authentication of a so-called EMV smart card transaction with a personal identification number. Others favor a customer’s signature.

Visa Inc. says the best alternative is what it calls dynamic authentication, which would use real-time, one-time transaction identifiers for EMV card transactions. But among the established authentication methods, Visa is tilting toward the signature, though it says it will continue to support PINs too. MasterCard Inc. isn’t taking sides, but its initial EMV plans for the U.S. give the PIN more status than Visa’s roadmap.

Issuers are split. Some like the security of a PIN. Others fear Americans won’t easily use a credit card that requires a PIN, a sharp departure from decades of signing for credit card purchases.

Merchants are lining up on the PIN side of the debate, arguing it’s the best way to reduce fraud and the costs associated with chargebacks and retrieval requests. Electronic signature-capture devices for point-of-sale terminals could be eliminated, another potential money saver. Retailers must also consider whether to go with contactless card readers, keeping in mind that mobile payments are on the horizon.

“There are a lot of moving parts here,” says Paul Tomasofsky, president at Two Sparrows Consulting, Montvale, N.J. “The adoption of chip cards is bringing up issues that haven’t been thought about before.”

Slow Adoption

The United States is the last major card market that hasn’t yet adopted smart payment cards. EMV—an acronym for MasterCard, Visa and Europay—is the global standard for chip card technology introduced by the bank card networks in 1994.

EMV cards contain a microprocessor that stores cardholder data, making the cards less subject to fraud than the magnetic-stripe cards that dominate the U.S. Smart cards also run software applications.

There are currently about 1.5 billion EMV cards worldwide, according to EMVCo, a cooperative that includes American Express Co., Japan’s JCB card company, MasterCard, and Visa. Western Europe has the highest EMV card adoption rate at 84%.

Industry analysts estimate the cost to introduce EMV in the U.S. at about $8 billion. The annual cost of card fraud is about $8.6 billion, a figure that makes EMV look like a good deal. Even so, EMV technology has been slow to catch on here, though it’s widespread in Canada.

For the past couple years, however, a handful of issuers have offered chip cards, mainly to customers who travel overseas. The total number of EMV cards in the U.S. is hard to tally, but at the end of June, Visa issuers had an estimated 1.5 million or so EMV cards in the market. Most are credit cards.

Slow EMV adoption is due to several factors. Magnetic-stripe technology has deep roots, and fraud losses, though much criticized, are tolerable. The U.S. also has a robust telecommunications infrastructure that allows for real-time card authentication and purchase approval.

Other countries with less-developed land lines quickly embraced EMV technology as a way to leapfrog to a better payments system, akin to the way overseas markets were faster than the U.S. to adopt cell phones because of the scarcity of land lines in many places.

Countries that quickly embraced EMV also got a push from regulatory agencies. That’s not the case in the U.S., where no government agency is mandating EMV.

“It’s up to market forces and companies in the industry here to make this work,” notes Tomasofsky.

Still, a rollout of EMV in America is finally starting to inch forward. U.S. financial institutions targeted overseas travelers for the first EMV cards, in part because their mag-stripe cards are becoming harder to use in some countries. Now issuers are taking tentative steps toward expanding their EMV card base.

Bank of America Corp. announced in July that several of its credit cards would carry an EMV chip along with the traditional mag stripe. Wells Fargo & Co. announced in April 2011 an EMV pilot credit card program with signature authorization for customers who travel overseas.

Wells Fargo ramped up efforts again in August when it launched a new Visa Signature chip credit card for customers of its private bank and Wells Fargo Advisors units.

The Wells Fargo pilot is generating a “strong” number of transactions, according to Peter Ho, product manager at Wells Fargo Consumer Credit Solutions Group, San Francisco.

JPMorgan Chase & Co. has the EMV chip available on the J.P. Morgan Palladium Card, the J.P. Morgan Select Card, British Airways Visa Card, and Hyatt Credit Card. U.S. Bancorp started to issue EMV signature credit cards about a year ago to its customers who travel.

“We’re watching how the market evolves,” says Dominic Venturo, chief innovation officer of payment services at U.S. Bank, Minneapolis.

State Employees’ Credit Union, with 1.7 million members, was among the first financial institutions stateside to roll out an EMV product, a debit card. Now the credit union plans to introduce a chip credit card by the end of this year.

“We are seeing some chip [transaction] activity in the U.S.,” says Leanne Phelps, senior vice president of card services at SECU, Raleigh, N.C.

Phelps figures monthly chip transactions at merchants with chip-enabled POS terminals are only about 1% of SECU’s total. Authentication of chip transactions can be by signature or PIN, whatever the merchant supports, though signature transactions have been more common so far.

Even so, Phelps prefers PIN over signature transactions. “PIN is always more secure,” she says.

‘Absolute Waste of Time’

Visa announced its EMV implementation roadmap in mid-2011. The leading card network’s plan includes carrots and sticks to encourage adoption. Processors must be able to handle EMV transactions by April 1, 2013. And, in October 2015, merchants without a chip-enabled POS terminal will be liable for fraudulent transactions—a big motivation for merchants to become EMV compliant.

In addition to dynamic authentication, the Visa roadmap supports either PIN or signature authentication, though Visa prefers signature. Signature cards involve less cost for issuers and are less complex to manage, according to Stephanie Ericksen, head of authentication product integration at Visa in Foster City, Calif.

Consumers also aren’t accustomed to using a PIN with a credit card. Cardholders prompted to use a PIN might not remember it, says Ericksen. “The transaction would be declined,” she says.

There are a lot of misconceptions that EMV cards require a PIN, Ericksen adds. “All EMV terminals should accept a signature as valid,” though she admits merchants overseas may be less familiar with signature cards.

Signature authentication overseas hasn’t resulted in problems at Wells Fargo. “All merchants want is approval,” says Ho.

Issuers tried credit cards with PINs in the 1980s, according to consultant Tomasofsky. “It was not successful,” he says.

Consumers had trouble with the numbers, and few point-of-sale terminals at the time were PIN-enabled, he explains. Many more terminals can process PINs today, but Tomasofsky thinks consumer behavior will present a “speed bump” to EMV adoption.

MasterCard has its own roadmap, and like Visa, plans to accept both PIN and signature verification, though the second-largest network is friendlier than Visa toward the PIN.

“We do have a preference for PIN authentication,” says Colin McGrath, vice president of U.S. market development at MasterCard, Purchase, N.Y. “It’s the most secure approach.”

Processor First Data Corp. has handled only a smattering of EMV transactions at its U.S. merchant locations, mostly from overseas cardholders. The company’s issuer clients so far seem to prefer signature EMV cards, according to Dom Morea, senior vice president, advanced solutions and innovation, at Atlanta-based First Data.

Morea isn’t sure if that preference for signature cards is a trend yet or not. First Data is ready to support online and offline PIN transactions, as well as signature transactions. But he also believes real-time PIN authentication is the superior security approach.

And Wal-Mart Stores Inc. executive Jamie Henry thinks chip card authentication should be with a PIN or nothing at all. Prior to the implementation of the Durbin Amendment in 2010’s Dodd-Frank Act that set limits on debit card interchange, card issuers earned much more revenue on signature transactions, notes Henry, senior director of payment services at the world’s largest retailer.

“Banks were incenting customers through rewards to use their ‘pen, not their PIN,’” says Henry. “Signature is an absolute waste of time, a useless form of authentication.”

Promoting PIN

For years, signature-based debit interchange more than compensated issuers for the higher fraud losses versus PIN sales. But the Federal Reserve’s interchange price controls for issuers regulated by the Durbin Amendment, those with $10 billion or more in assets, make no distinction between PIN and signature.

That means regulated issuers, which account for about two-thirds of the market, have a new incentive to promote PIN sales because of their lower expenses (“The Great Debit Network Reshuffle,” page 34).

Addressing concerns that consumers won’t remember a PIN with a credit card, Wal-Mart’s Henry says: “Consumers are capable of using a PIN.” He notes that consumers use PINs—which he says are nothing more than passwords—to check voicemail, access e-mail, and view bank accounts online.

“We don’t buy that argument,” Henry says, adding that Wal-Mart ideally would like to eliminate signature-capture devices altogether at the point of sale.

Wal-Mart currently accepts EMV cards in Canada, Brazil, Mexico, and the United Kingdom. The retailer also is accepting them in a limited pilot program here in the U.S. Henry won’t reveal the test locations, but he says the stores are in border towns and spots with a lot of foreign travelers, such as Orlando, Fla.

In addition, POS terminals at all Wal-Mart stores nationwide are capable of accepting EMV transactions when the time comes. In the pilot stores, software codes at terminals were updated for EMV acceptance.

“The pilot has had very good results on fraud reduction,” says Henry, though he declines to provide specific numbers. The amount of chargebacks are close to “nil,” he adds. “It’s a significant improvement from magnetic-stripe cards.”

The Minneapolis-based Merchant Advisory Group (MAG), a payments-issues organization that includes many of the nation’s largest retailers, prefers EMV authorizations using a PIN. The only exception, according to MAG chief executive Mark Horwedel, is for quick-service restaurants that want transactions under $50 with a waiver of either a PIN or a signature.

The MAG cites the experience of the U.K., where chip-and-PIN cards reduced certain types of card fraud, especially for counterfeit and lost or stolen cards, according to a January study by the Federal Reserve Bank of Atlanta. The study did find, however, that fraud increased for online merchants. Fraudsters also moved their operations to markets where magnetic stripes still were used.

‘Cheapest Way Out’

Gemalto NV is a Dutch company that manufactures EMV cards. The use of a PIN adds an additional layer of security for the cardholder, says Philippe Benitez, vice president of marketing for secure transactions at Gemalto’s North American headquarters in Austin, Texas. “The card can only be used by the person who knows the PIN number,” he says.

But implementing PIN authorizations does increase PIN-management costs and complexity for the issuer. “Signature is the cheapest way out,” says Horwedel at MAG.

Merchants were initially very enthusiastic about EMV because it would reduce fraud and their costs to comply with the Payment Card Industry data-security standard (PCI). But retailer enthusiasm has waned as some issuers push for signature EMV cards, says Horwedel.

Merchants had the promise with PINs that chargebacks and retrieval requests would decline. Signature-capture devices could be eliminated, speeding the checkout process for consumers.

But with signature EMV cards, “The elements to help their return on investment went right out the window,” says Horwedel. “All merchants are questioning where to make investments at the point of sale.”

A big unknown for merchants is how the 14 or so remaining PIN-debit networks will function in the EMV market.

“The networks need to figure this out, or they’ll be out of business,” says Henry, who notes that Wal-Mart can’t program 14 different network specs into POS terminals. “We need one standard,” he says. And even though the company’s U.S. EMV pilot is going well, he’s hesitant to move forward until PIN-debit specifications for chip cards are available.

The Secure Remote Payment Council, a consortium of debit networks, has been working with Tomasofsky to coordinate EMV implementation. In April, the group established a task force to tackle the issue. Separately, an industry meeting in Phoenix this October plans to address the problem.

Mobile payments also will play a role as more and more cell phones carry chips that can make payments. “Digital channels will help drive adoption of EMV,” notes McGrath at MasterCard.

Randy Vanderhoof, executive director of the Princeton Junction, N.J.-based Smart Card Alliance, an industry group that promotes the adoption of smart card technology, says it’s too early to tell how all the details, including authentication methods, will play out.

He does, however, predict that large volumes of EMV cards will be issued in the latter half of 2013 and early 2014. Big merchants will enable their infrastructure during this period too.

Vanderhoof expects small-to-medium-size issuers and merchants to lag behind in EMV adoption. But, he predicts, “Late 2014 and 2015 is when the U.S. market will achieve widespread EMV adoption.”