Problems Hinder EMV Use in US

Joe Stanganelli, Founder and Principal, Beacon Hill Law | 12/22/2011 | 9 comments

Joe Stanganelli
Despite the stupidity they regularly encourage, Americans' credit cards are on the verge of becoming a whole lot smarter.

EMV cards -- also known as "smartchip" and "chip and PIN" cards -- are credit cards that use smartcard technology instead of the "swipe-the-stripe" standard invented in the 1960s.

Americans are almost exclusively familiar with magnetic stripe credit cards. Meanwhile, people in Europe, Asia, and, well, pretty much the rest of the world use credit cards with EMV ("Europay, Mastercard, Visa") technology.

Unlike magnetic stripe cards, EMV-enabled cards uniquely encrypt transaction data for each use. This makes them substantially more secure, because it is much harder for skimmers to steal the card data.

What's more, most EMV-enabled cards are dually enabled with magnetic stripes, accommodating people from other countries traveling in the US. Meanwhile, US travelers often have difficulties using their credit cards abroad.

These compatibility issues may soon be a thing of the past if major financial service multinationals have their way.

Since this past summer, credit card companies have been making a huge push to encourage US retailers and ATMs to accept EMV cards over the next few years. Visa is being particularly aggressive, offering to waive fees for US retailers that accept EMV-enabled cards -- while refusing to offer fraud protection to those that do not switch over by 2013. By 2015, all US retailers accepting Visa will have to accept EMV cards. (At least, that's Visa's goal.)

Banks, too, are going along with the EMV push in the US. Wells Fargo, JPMorgan Chase, and US Bank already offer EMV-enabled cards to qualifying American customers who travel abroad. A month ago, Bank of America Merrill Lynch announced that it will begin offering EMV-enabled credit cards early next year to US customers who travel abroad.

Historically, however, Americans have been reluctant to do things the way the rest of the world does them (for example, the metric system). And here, too, there is some resistance.

Part of the reason is security. It may have advantages over magnetic stripe cards, but EMV is far from a perfect technology. It has several security weaknesses of its own. In 2010, a group of researchers at the University of Cambridge released devastating findings in a paper called "Chip and PIN is Broken." In the paper, the Cambridge researchers reported multiple EMV security vulnerabilities. Perhaps most appallingly, they found that "the proceedings of the PIN verification step are never explicitly authenticated."

The researchers went on to discuss myriad attacks on the UK's chip and PIN system that succeeded by way of a man-in-the-middle device that intercepts communications signals and tricks the terminal into acting as if the customer's PIN were verified. Little evidence of these attacks is typically available by the time a cardholder reports the fraud. These security issues are compounded by problematically bureaucratic dispute resolution processes. Many defrauded UK cardholders have their refund requests denied by card issuers, whose records show -- quite incorrectly -- that the cardholder's PIN was used and verified. These findings are hardly encouraging.

According to the researchers, the US Federal Reserve should resist pressure from banks to move to EMV until a satisfactory solution to EMV's security woes is published. "It’s not reasonable for the smart card industry to foist a broken framework on the US banking industry and then leave it to individual issuer banks to come up with patches."

Infrastructure is another obstacle to widespread US adoption. NFC technology is still fairly nascent for US retailers, and it could take a lot of time for loyalty programs to convince US consumers to accept a new EMV standard. Julie Conroy McNelley, a senior analyst at Aite Group's retail banking practice, says "there's no way" Visa can reach its 2015 EMV goal.

It remains to be seen precisely how EMV adoption will go and, given the weaknesses, whether a different technology could come along in the US or elsewhere to fix the EMV problems. But as Conroy McNelley concedes, "EMV is a heck of a lot better than what we have right now."

View Comments: Newest First | Oldest First | Threaded View
Skr2011   Problems Hinder EMV Use in US   1/8/2012 8:52:04 PM
Re: Why not
yeah they were. I don't know why it didn't take off.
nasimson   Problems Hinder EMV Use in US   12/25/2011 11:04:01 AM
Re: Why not
@SKR2001. Those were there? I thought these never existed. Never heard of those. Why it didnt take off?
Skr2011   Problems Hinder EMV Use in US   12/24/2011 12:51:56 PM
Re: Why not

EMV Resources


Increasing counterfeit card fraud led the financial industry to move to smart chip technology for bank cards and to develop the global EMV standard for bank cards based on chip card technology. The EMV specification, first available in 1996 and managed by EMVCo, defines the global interoperable standard for smart bank cards.

Financial institutions in the United States, Europe, Latin America, Asia/Pacific and Canada are issuing contact or dual-interface EMV smart cards for credit and debit payment or migrating to EMV issuance. According to EMVCo, approximately 1.2 billion EMV cards have been issued globally and 18.7 million POS terminals accept EMV cards as of Q1 2011. This represents 40.1% of the total payment cards in circulation and 71% of the POS terminals installed globally.

EMVCo developed its specifications to ensure global interoperability–so that any EMV-compliant card can be accepted at any EMV-compliant point-of-sale anywhere in the world. The EMV specifications not only define how chip cards can be used for fraud prevention but how they can be used by issuers to offer additional features to cardholders such as multiple payment applications on the same card. Chip cards can carry security credentials that are encoded by the card issuer at personalization. These credentials, or keys, are encrypted and impervious to access by unauthorized parties. These credentials therefore prevent card cloning, one of the common ways magnetic stripe cards are compromised and used for fraudulent activity. In practical terms, this means that chip card-based payment account information cannot be skimmed, which increases the level of security to prevent fraud.

Fraud prevention technology in chip-based EMV payment cards (which can be contact, contactless or dual-interface cards) complements post-fraud detection mechanisms by providing an additional layer of intelligence to protect consumers. Issuers, acquirers and merchants in a large number of markets around the world have decided to implement full EMV technology. Some programs are signature-based and others use a PIN, commonly known as "chip and PIN," to combat fraud.

About EMV


The EMV Integrated Circuit Card Specifications are managed by EMVCo, which is currently operated by American Express, JCB International, MasterCard International, and Visa International. EMV specifications were first issued in 1996 and active working groups have provided updates and revisions. In December of 2000, EMV 4.0 was released which is also known as EMV 2000. The current version of EMV is release 4.2.

At the heart of EMV is the underlying security framework that provides fraud protection for both offline and online transactions. The security is a combination of symmetric and asymmetric key technology. First, EMV leverages the security found in chip cards and requires symmetric authentication keys to be submitted to gain access to the chip card's memory. In addition, asymmetric keys and certificates, also known as public key infrastructure (PKI), are incorporated to facilitate card authentication in offline transaction environments.

EMV and the U.S. Market


The United States is one of the last countries to migrate to EMV. In August 2011, Visa announced plans to accelerate chip migration and adoption of mobile payments in the United States, through retailer incentives, processing infrastructure acceptance requirements and counterfeit card liability shift. Within the U.S., the contactless credit and debit cards that are being issued already include some EMV security features.

U.S. credit and debit card issuers who are issuing or who have announced plans to issue EMV payment cards include: Citi Commercial Cards; Jack Henry & Associates Payment Processing Solutions; JP Morgan Chase; PSCU Financial Services; Silicon Valley Bank; the State Employees Credit Union; Travelex; the United Nations Federal Credit Union; U.S. Bank; Wells Fargo
nasimson   Problems Hinder EMV Use in US   12/24/2011 2:54:04 AM
Re: Why not
Special pouches sound an interesting tool to prevent fraud. Never heard of them earlier. Taimoor, can you share a link for the same?
Skr2011   Problems Hinder EMV Use in US   12/23/2011 11:08:11 PM
Re: Why not
@ Sara a few years back retaliers were "encouraged" to add technology that allowed people to waive their credit card in front of a scanner. Needless to say we spent a lot of money and the whole thing did not catch on. However EVM sounds like something that has a much greater benefit.
Taimoor Zubair   Problems Hinder EMV Use in US   12/23/2011 2:08:45 AM
Re: Why not
Rather than revamping the entire system and replacing the magnetic technology with EMV, I think they should go about using hybrid cards which cater to both technologies. As far as the security issues are concerned, I read about special pouches for credit cards which would block the access to cards and prevent them from being read without user's consent.
fbpmt   Problems Hinder EMV Use in US   12/22/2011 10:15:24 PM
emv and tokenization
What is the effect on security with employing tokenization in emv cards? More favorable results than mag striped cards?
User Ranking: Blogger
Sara Peters   Problems Hinder EMV Use in US   12/22/2011 3:57:31 PM
Why not
I can understand why we shouldn't have EMV "foisted upon" retailers and customers, if there are legitimate security concerns. However, it isn't as though magnetic stripe cards are 100% secure either. Regardless of what Visa demands of retailers however, I don't see why banks wouldn't start issuing dual-purpose cards as a matter of course, instead of some special service for international travelers.
EyeTee   Problems Hinder EMV Use in US   12/22/2011 1:10:38 PM
EMV
Good article, Joe. I do agree with McNelley's assertion that there's no way the 2015 goal is possible, certainly.

EMV is better than what we have now, but is it good enough? I'm not certain. I just have a feeling that this is going to be skipped over in the US in favor of some other, superior, more US-centric tech. As you mention, Americans tend to like to do things their own way and tend not to be too enthusiastic about adapting to worldwide (especially European) standards.

So I'm not really sure how successful adoption would be. I would tend to be pessimistic. But I suppose we'll see!


The blogs and comments posted on EnterpriseEfficiency.com do not reflect the views of TechWeb, EnterpriseEfficiency.com, or its sponsors. EnterpriseEfficiency.com, TechWeb, and its sponsors do not assume responsibility for any comments, claims, or opinions made by authors and bloggers. They are no substitute for your own research and should not be relied upon for trading or any other purpose.

More Blogs from Joe Stanganelli
Joe Stanganelli   11/20/2013   58 comments
The Internet may be global, and we may call what we see in our browsers the world wide web, but about 70 percent of the world doesn't have Internet access -- the part that's covered by water.
Joe Stanganelli   10/10/2013   62 comments
"Passwords are dead," a Google information security manager decreed at last month's TechCrunch Disrupt. Other pundits have come to the same conclusion. However, these reports are greatly ...
Joe Stanganelli   9/11/2013   83 comments
Nietzsche said, "That which does not kill me can only make me stronger." Scientists have recently discovered that this may be literally true in the case of plastics, and it could be a real ...
Joe Stanganelli   4/24/2013   28 comments
Big-data is a perennial concern at Boston's annual Bio-IT World Expo because of the sheer volume of information the life sciences industry must contend with. The pain points expressed at ...
Joe Stanganelli   4/30/2012   28 comments
Last week, I wrote an article about how keynote speaker Martin Leach presented a convincing argument to Bio-IT World Conference 2012 attendees here in Boston as to why the biggest obstacle ...
Latest Archived Broadcast
Ist Ihre Infrastruktur auch veraltet und nicht zukunftsfähig? Das Arbeiten in der Cloud wäre die Lösung, aber viele Firmen haben den Übergang zur Virtualisierung und die Cloud verpasst.
E2 IT Migration Zones
IT Migration Zone - UK
Why PowerShell Is Important
Reduce the Windows 8 Footprint for VDI
Rethinking Storage Management
IT Migration Zone - FR
SQL Server : 240 To de mémoire flash pour votre data warehouse
Quand Office vient booster les revenus Cloud et Android de Microsoft
Windows Phone : Nokia veut davantage d'applications (et les utilisateurs aussi)
IT Migration Zone - DE
Cloud Computing: Warum Unternehmen trotz NSA auf die „private“ Wolke setzen sollten
Cloud Computing bleibt Wachstumsmarkt – Windows Azure ist Vorreiter
Like Us on Facebook
Twitter Feed
Enterprise Efficiency Twitter Feed
Site Moderators Wanted
Enterprise Efficiency is looking for engaged readers to moderate the message boards on this site. Engage in high-IQ conversations with IT industry leaders; earn kudos and perks. Interested? E-mail:
moderators@enterpriseefficiency.com
FRENCH ASSETS
GERMAN ASSETS
VIDEOS
WINDOWS CLIENT
WINDOWS SERVER
A Video Case Study – Translational Genomics Research Institute
e2 Europe Video


On the Case
TGen IT: Where We're Going Next

7|11|12   |   08:12   |   10 comments


Now that TGen has broken new ground in genomic research by using Dell's storage, cloud, and high-performance computing solutions, the company discusses what will come next for it and for personalized medicine.
On the Case
Better Care Through Better Communications

6|6|12   |   02:24   |   12 comments


The achievements of the TGen/Dell project could improve how all people receive healthcare, because they are creating ways to improve end-to-end communication of medical data.
On the Case
TGen IT: Where We Are Now

5|15|12   |   06:58   |   5 comments


TGen is breaking new ground in genomic research by using Dell's storage, cloud, and high-performance computing solutions.
On the Case
TGen IT: Where We Were

4|27|12   |   06:45   |   10 comments


The Translational Genomics Research Institute wanted to save lives, but its efforts were hobbled by immense computing challenges related to collecting, processing, sharing, and storing enormous amounts of data.
On the Case
1,200% Faster

4|18|12   |   02:27   |   12 comments


Through their partnership, Dell and TGen have increased the speed of TGen’s medical research by 1,200 percent.
On the Case
IT May Improve Children's Chances of Survival

4|17|12   |   02:12   |   8 comments


IT is helping medical researchers reach breakthroughs in a way and pace never seen before.
On the Case
Medical Advances in the Cloud

4|10|12   |   1:25   |   5 comments


TGen and Dell are pushing the boundaries of computing, and harnessing the power of the cloud to improve healthcare.
On the Case
TGen: Living the Mission

4|9|12   |   2:25   |   3 comments


TGen's CIO puts the organizational mission at the heart of everything the IT staff does.
On the Case
TGen Speeding Up Biomedical Research to Save More Lives

4|5|12   |   1:59   |   8 comments


The Translational Genomics Research Institute is revamping its computing to improve speed, storage, and collaboration – and, most importantly, to save lives.
On the Case
Computing Power Helping to Save Children's Lives

3|28|12   |   2:13   |   3 comments


The Translational Genomics Institute’s partnership with Dell is enabling them to treat kids with neuroblastoma more quickly and save more lives.
Sara Peters
Cloud SLAs a Mystery to Users

2|28|13   |   1:15   |   10 comments


A credit card may buy your users cloud services, but it doesn't buy them an understanding of SLAs and privacy compliance.
Sara Peters
Date Set for Next McKinnon Extradition Epic Fail

9|10|12   |   3:11   |   16 comments


The next episode in the 10-year saga of the "UFO hacker" extradition battle will happen Oct. 16.
E2 Interview
Can IT Help Fix the Global Economy?

6|8|12   |   02:32   |   2 comments


We ask CIO Steve Rubinow whether today's IT can help repair the global economy (and if IT played any role in the economy's collapse).
Ivan Schneider
The Infrastructure With the Dragon Tattoo

7|21|11   |   2:54   |   1 comment


Nasdaq OMX is being investigated by Swedish competition authorities as to whether it pressured Verizon to keep a competing exchange called Burgundy from collocating in the same datacenter as its biggest customers.