A Contact Sport

Hoping for contactless chip cards? Not likely any time soon. The contact version of EMV is emerging as the clear issuer choice as October’s liability shift approaches. Here’s why.

It’s show time for chip cards.

With the payment card networks’ so-called liability shift now just eight months away, U.S. general-purpose credit and debit card issuers in 2015 will be cranking out hundreds of millions of plastic cards that include a chip meeting the Europay-MasterCard-Visa (EMV) specifications, along with a back-up magnetic stripe.

This conversion to chip cards from the tried-and-now-not-so-true mag-stripe-only card that has dominated U.S. payments for decades will continue far past the liability shift taking effect in October, according to researchers and card-industry executives.

In part, that’s because some issuers didn’t start preparing early enough, or they’ve made a calculated decision that they can absorb whatever counterfeit fraud is deemed to be their responsibility during the transition.

Issuers, however, are now getting into high gear. Predictions about chip card issuance vary, but they all involve big numbers.

Based on figures from the Princeton Junction, N.J.-based International Card Manufacturers Association, Digital Transactions estimates that U.S. credit and debit card issuers will send 578.5 million financial EMV cards to their customers this year and 854.4 million next year. “That’s the first year chip exceeds mag,” says Al Vrancart, ICMA founder and industry advisor.

Popularity Contest

All of this is the result of the card networks declaring that the party to a point-of-sale payment card transaction that does not support EMV—merchant or issuer—will bear the liability for any resulting counterfeit fraud, to which mag-stripe cards are highly vulnerable.

An embarrassing and expensive string of data breaches, most notably Target Corp.’s in December 2013, quashed any issuer and merchant hopes for a delay in the liability shift, first announced by Visa Inc. in 2011. To avoid liability on their end, merchants and merchant acquirers are scrambling to install POS terminals that can read EMV cards. (Fuel pumps have until October 2017 to convert.)

A key decision in this multifaceted conversion involves the type of EMV card issuers choose. The two major choices are the contact card, in which the card is inserted, or “dipped,” into an EMV terminal, or the dual-interface card, which has a single chip that supports both contact and contactless EMV transactions. Or, issuers could go with a pure contactless card.

Few issuers will take that third option, most experts say, given the unpopularity of contactless cards in earlier trials, except in special cases such as general-purpose prepaid cards that do double duty as transit-fare cards.

Indeed, there is little doubt about which flavor of EMV card is winning the popularity contest.

“Issuers are moving predominantly to the contact card,” says Peter Muroski, director of card production at Total System Services Inc. (TSYS), a Columbus, Ga.-based processor that produces cards for 80 issuers.

It’s the same for a TSYS rival, Atlanta-based First Data Corp., which provides processing for 4,000-plus financial institutions, the majority of which avail themselves of First Data’s card-production services.

“The vast majority of our customers are issuing contact only,” says Gay Rich, senior vice president and general manager of output services.

Comments to Digital Transactions from industry executives mostly reflect findings by Aite Group LLC from a survey last spring of a small group of leading card issuers, in which a strong plurality favored contact cards in EMV’s early going.

And there is little doubt about why issuers prefer contact chip cards. “It’s driven by the price of the card,” says Rich.

On average, contact chip cards are 20% to 25% less expensive than dual-interface cards, according to Vrancart. “The issuers, like anybody else, want to find the most cost-effective way to get into the market, and contact is cheaper,” he says.

A conventional mag-stripe card might cost the issuer 35 cents. Any upgrade to EMV is going to cost a lot more. The contact card, however, with a price range of 90 cents to $1.40 depending on volume, according to ICMA, is the lowest-cost entry point into the new technology.

Dual-interface cards are the most expensive option, costing a high-volume issuer about $2.00 per unit, and more for smaller issuers.

‘Additional Complexities’

Some issuers’ EMV card decisions, however, won’t be cut-and-dried choices driven by price. These decisions also can be influenced by what banks and credit unions perceive their customers want, the rise of mobile payments, and how issuers assess the acceptance landscape.

Beginning about a decade ago, a few issuers, including JPMorgan Chase & Co., offered some of their cardholders mag-stripe cards that also had contactless chips, but consumers showed little interest in them. Yet with mobile payments now the focus of intense development by tech companies, processors, and some financial institutions, there is new interest in contactless transactions.

This new interest, however, is not translating into a revival for standalone contactless cards, even though they cost less than dual-interface cards. That means that the vast majority of contactless EMV-compliant transactions soon will be generated either by dual-interface cards or by smart phones.

One argument for the dual-interface card is that using its contactless feature mimics the process at the point of sale when a customer is using a smart phone equipped with a virtual wallet and near-field communication (NFC) technology. Such devices include Apple Inc.’s new iPhone 6 and 6 Plus and the popular Samsung Galaxy S5.

With these phones, as with contactless and dual-interface EMV cards, the customer taps, or passes the device very near, a contactless EMV terminal to complete a transaction.

Contactless EMV transactions on dual-interface cards seemingly would reinforce with consumers a payments process in which mobile devices are a new form factor. But industry executives say that while mobile payments and EMV card payments have areas of overlap, neither is dependent on the other.

“Obviously, EMV is being driven by the mandate and just some of the prior [data] breaches we’ve had,” says First Data’s Rich. “We are seeing interest in mobile payments, but I don’t think that alleviates the need for EMV.”

In addition to their higher price, dual-interface cards place more technical demands on issuers, according to Muroski. That factor is also making contact-only cards more popular as issuers race to get cards out ahead of the liability shift. “Dual interface has additional complexities,” Muroski says. “Very few [issuers] are showing interest in dual interface.”

‘The Other Axiom’

Issuer choices also are influenced to some degree by their perceptions of card acceptance. If issuers conclude, for example, that most merchants won’t have terminals that read contactless chips, they have even fewer reasons to issue dual-interface cards.

When Apple unveiled its Apple Pay mobile-payments service in October, the U.S. reportedly had about 200,000 merchant locations that could accept contactless payments.

That number, already small relative to the total U.S. merchant count, quickly fell by thousands because some merchants, notably the Rite-Aid and CVS pharmacy chains, turned off their NFC systems. They took this action to avoid violating an exclusivity provision from a rival mobile-payments program they support, Merchant Customer Exchange (MCX), known as CurrentC.

“Acceptance was the other axiom,” says Philip Andreae, vice president of field marketing for North America at France-based chip card provider Oberthur Technologies S.A. “Before Apple we were talking about 200,000 terminals, now post-Apple we’re talking about less than 200,000 because some retailers turned them off.”

(Besides shunning Apple Pay, the CVS and Rite-Aid actions had the effect of shutting out other NFC-based mobile-payment systems such as the telco-backed Softcard and Google Inc.’s Google Wallet. MCX has since backed away from its exclusivity policy.)

The perception of limited contactless acceptance could change, however. Paul Galant, chief executive of leading U.S.-based POS terminal maker VeriFone Systems Inc., told analysts in December that about 90% of the products VeriFone shipped in the U.S. in fiscal 2014 supported EMV, though he did not give a contact/contactless breakdown.

About 70% of large, what Galant called Tier 1, merchants have EMV terminals, and he expects about 90% will by late 2015. EMV penetration among mid-size, Tier 2 and 3 merchants is about 35% today and should be about 55% in a year, he said.

Only about 22% of small merchants have an EMV-capable terminal, Galant added. He said he expects that number to “more or less double by 2015, which is a tall order” since the group consists of 7 million merchants with 9 million devices.

Another factor issuers must consider: Just because a merchant has an EMV terminal doesn’t mean the device yet has the proper software or has had its chip-reading functionality turned on.

A Second Look

But even if banks and credit unions go with contact-only cards to start with, that doesn’t mean they may not reconsider their issuance strategies as the U.S. terminal base converts to chip card readers. Some issuers, for example, could take a second look at dual-interface cards as the first round of chip cards reach their expiration dates.

“There’s definitely interest,” says Muroski of TSYS. “Issuers are saying, ‘I will likely make changes to my program over time.’”

Adds his TSYS colleague Sarah Hartman, senior director of consumer payments: “I do think things will keep evolving.”

John J. Sala Jr., marketing manager at St. Charles, Ill.-based card producer Perfect Plastic Printing, says that while they’re mostly taking the contact route at first, his issuer customers are keeping the potential linkages between mobile payments and dual-interface cards in mind.

“The largest issuers seem to be thinking about this and are including dual interface in their purchasing decisions,” he says by email.

Another ongoing EMV debate affecting card issuance centers on chip-and-PIN versus chip-and-signature authentication, an issue banks and merchants were hoarse from debating long before The Wall Street Journal put the controversy on its front page early last month.

There’s not much new: Issuers don’t want to force credit card holders, who sign for purchases, to change their familiar ways of paying, so most are issuing chip-and-signature credit cards.

With debit cards, issuers also are sticking with existing protocols. Since debit cards may require the cardholder to enter a PIN at the point of sale, the coming EMV debit cards will be chip-and-PIN cards.

There’s another reason for PIN-based EMV debit cards. The Durbin Amendment in 2010’s Dodd-Frank Act requires that cards provide access to the PIN-debit networks in addition to the Visa and MasterCard networks to give merchants transaction-routing choices. But the 20-year-old EMV specifications were not developed with such multiple-network access in mind.

To solve the problem, the networks have agreed on so-called common application identifiers (called common AIDs), but the technical work involved to route transactions properly has been considerable.

Retailers, however, argue that all EMV transactions, whether credit or debit, should be authenticated by PIN, as is the case in all other regions in the world where EMV has been introduced. They insist that the ongoing EMV conversion is the right time to add PIN authentication, which is indisputably more secure than a signature, to all cards.

But issuers say that the chip alone offers much more protection than the mag-stripe card and that chip-and-PIN isn’t necessary for credit transactions. “The issuers are trying to avoid a negative experience for the cardholder at the point of sale,” says Muroski.

Julie Conroy, a payments-security analyst and research director at Aite, says “merchants are certainly rattling the cages, but at the end of the day, issuers are going to do what’s best for them and their customers, not what merchants want.”

‘Doing Double Time’

What’s clear is that fairly soon we’re going to have more than 1 billion EMV payment cards in circulation, and most will be dipped into terminals and use long-established cardholder authentication protocols.

What’s not quite so clear is the exact pace of the conversion.

Some issuers began giving EMV cards to the frequent international travelers in their portfolios at least two years ago so they could use their cards abroad. Depending on whom you ask, issuers have now begun giving chip cards to larger cardholder segments or even converting their programs in one fell swoop.

“Most are doing mass portfolio-wide replacements,” says Sala of Perfect Plastic.

In any case, business has been good for EMV card producers. It really picked up at Oberthur after the Target breach, says Andreae. “We started getting phone calls fast and furious,” he says. “All of our sales people started doing double time.”