Obama Uses His Bully Pulpit To Push Cybersecurity—and Endorse PIN-Based EMV

By Jim Daly

President Barack Obama on Friday signed an executive order committing the federal government to offer and accept Europay-MasterCard-Visa- (EMV) chip cards. A retailer trade group quickly praised Obama for endorsing the chip-and-PIN variety of EMV when others in the payment card industry would make do with chip-and-signature cards or EMV cards with no added cardholder authentication.

Obama signed the executive order after announcing the federal government’s new “BuySecure” initiative designed to prevent and mitigate identity theft as well as improve payment security. The president made his announcement during a brief ceremony at the Consumer Financial Protection Bureau—a regulatory agency created by 2010’s Dodd-Frank Act and bitterly opposed by Republicans. Obama praised CFPB staff for thwarting fraud and rooting out shady business practices involving credit cards, student loans, and mortgages.

In his remarks, Obama called on Congress to pass comprehensive cybersecurity legislation. He said more than 100 million consumers had information about them compromised in data breaches last year. “You should be able to buy the things you need without risking your identity, your credit score, or your savings,” he said.

The president highlighted efforts by retailers, card networks, and banks to improve data security and prevent or lessen the effects of ID theft. American Express Co., he noted, is committing $10 million to support small businesses upgrading their point-of-sale terminals for chip acceptance. Visa Inc. is launching a program to educate consumers and merchants about chip and other secure technologies and will send experts to 20 cities in a national public-service campaign, according to a White House release. And MasterCard Inc. is providing its cardholders with free identity-theft monitoring and resolution support. Obama also mentioned efforts by Home Depot, Wal-Mart, Target, and Walgreens to accept chip cards.

“I’m happy to say the private sector is already deeply engaged in this effort,” said Obama, who also said he will require federal law-enforcement agencies to share more data-security information with companies.

Through various banks, the federal government offers millions of credit and debit cards under a variety of programs. They include SmartPay commercial cards for government workers to pay for travel expenses, and the Direct Express prepaid cards issued by Comerica Bank for Social Security recipients who do not use direct deposit.

Under the executive order, cards for federal programs will be required to convert to EMV and use PIN authentication. Conversely, federal agencies that accept payment cards must install terminals that can accept EMV cards and read PINs. The White House said replacement of existing federal cards would begin Jan. 1.

Randy Vanderhoof, executive director of the Princeton Junction, N.J.-based Smart Card Alliance trade group, said in a statement that “federal payment-account data can be stolen in a data breach just as easily as any other credit or debit card, but chip cards and terminals will provide additional security for cardholders. It is a good move by the president to make the federal government a leader as the U.S. transitions to EMV chip cards.”

The Washington, D.C.-based National Retail Federation reacted favorably to the White House’s endorsement of PINs to secure chip card transactions. Some card-issuing banks favor chip-and-signature, arguing static PINs are not needed with EMV technology and risk confusing consumers accustomed to signing for credit card payments. But chip-and-PIN is common in many countries.

“We applaud the administration for taking proactive and positive steps by adopting PIN-and-chip technology for government-issued debit and credit cards, among other things,” the NRF said in a statement. “As the world’s largest retail trade association, NRF continues to work with our members and other stakeholders on practical and comprehensive solutions that are less about process and more about progress toward how we collaboratively prevent and combat this criminal activity.”

It was not immediately clear if Obama’s actions would change how issuers and merchant acquirers that work with the federal government plan to meet the card networks’ October 2015 liability-shift deadline. The shift will assign liability for counterfeit card transactions to the party—issuer or merchant—that does not support EMV protocols.