As EMV (Europay MasterCard Visa) is being rolled out in the U.S., one of the main questions revolves around its true effectiveness as a security tool against payment card fraud. Will it work as advertised and how well will it work?
The October 1, 2015, “liability shift” (fraud liability assessed to the party that did not enable the EMV transaction) imposed by Visa, MasterCard, American Express and Discover has helped push adoption from conception to imminent. No doubt, though, the U.S. is a latecomer to the EMV world, with EMVCo reporting in May 2015 that there are 3.4 billion EMV cards in global circulation, a year-over-year increase of 43 percent.
Still, U.S. industry observers need look no further than to their northern neighbor to see how EMV chip cards may perform domestically. David Hooper, Vice President, Strategy and Innovation for Everlink Payment Services of Markham, Ontario, Canada, described the significant benefits EMV has brought to Canada’s financial services industry in an October webinar sponsored by the company’s majority owner, CO-OP Financial Services of Rancho Cucamonga, California.
Hooper pointed out that fraud losses for counterfeit and lost/stolen transactions fell from $245.4 million in 2008 – when EMV was initially adopted in Canada – to $111.5 million in 2013, according to the Canadian Bankers Association.
EMV Has Its Challenges
Canadian adoption of EMV has been smooth on the whole, but nothing on earth is perfect. While card-present fraud has decreased, Everlink reports that card-not-present fraud (credit) has increased from 60 percent of all fraud transactions in 2011 to 68.2 percent in 2014. “EMV only works for card-present transactions; card-not-present transactions are still vulnerable,” said Hooper.
To further reduce the opportunities for fraud, Hooper says Interac, Canada’s national debit network, instituted operating regulations that had dates for the migration of all debit cards to EMV chip as well as all ATMs and POS devices. Essentially, Canada’s financial services industry and merchants no longer accept magstripe transactions from domestic-issued cards. One significant benefit of moving to chip and PIN is that the incidents of domestic credit card counterfeiting fell from 21 percent of payment card fraud in 2011 to 7.7 percent in 2014. What’s more, debit card fraud fell from $142.3 million in 2011 to $16.2 million in 2014.
No Single Method is Fail Safe
No single security system is an absolute guard against fraud, said Hooper and fellow webinar panelist Michelle Thornton, Director, Product Development, for CO-OP. Both stressed that a holistic approach is necessary, with EMV most effective when combined with other technologies such as tokenization, analytics and card control apps that allow consumers to aid in the fight.
“EMV has had the intended impact on skimming and counterfeit fraud, which continues to decrease,” said Hooper. “The beauty of the chip is that it can’t be recreated and it integrates nicely with tokenization,” the base technology for Apple Pay and other digital wallets.
Though there are many similarities between the Canadian and U.S. financial services industries, there are also important differences – starting with their size (the former nation is the 11th largest economy in the world, the latter is the largest).
Canada has approximately 400 credit unions and banks while there are 15,000 in the U.S., which has 403,000 ATMs compared to Canada’s 60,000. Huge differences also exist between the number of payments cards (134 million in Canada, 1.2 billion in the U.S.) and POS terminals (766,000 compared to 10 million).
An additional difference is of a regulatory nature – EMV adoption was made mandatory by Interac, Canada’s debit transaction system; but EMV adoption for credit cards in Canada was based on a liability shift and therefore voluntary, just like in the U.S.
The move to EMV in Canada began in 2005 with the payment brands committing to EMV chip and PIN. All players – issuers and acquirers – began their preparations between 2006 and 2009 with aggressive rollouts between 2010 and 2012. During that time almost all credit and debit cards and ATMs were converted to EMV, and many POS devices were made compliant. The last of the POS devices must be EMV compliant by the end of 2015 or be removed from service. It has been a 10-year journey to get to EMV compliance in Canada.
U.S. adoption will hopefully be quicker, but it will take several years.
Lessons to be Learned
Nevertheless, Thornton believes EMV implementation is highly scalable and there are lessons to be learned from Canada’s experience.
“For EMV adoption, there are more parallels to Canada than Europe as the Canadian model is more like the U.S,” said Thornton. “Based on what we see in Canada, EMV adoption will reduce fraud, but keep in mind that at the same time that EMV was reducing card-present fraud in Canada, card-not-present fraud rose. This is similar to what happened in other markets and it is expected that CNP fraud will increase in the U.S. as the EMV adoption process moves forward.”
Hooper and Thornton agree that fighting fraud is a never-ending proposition to ensure the best possible guard against the ever-evolving perpetrators of payment card theft.
“Plan on EMV implementation taking longer and costing more than you expect, but the good news is that it is worth it – and, more than that, it’s absolutely necessary,” said Hooper.
Learn more about the migration to EMV now in progress in CO-OP’s EMV Common AID white paper.