Article
Befuddled and confused about EMV
Those needing to update their infrastructure to support EMV might be befuddled and confused by chip and signature, but wrongdoers have it all figured out.
August 27, 2015 by Richard Buckle — Founder and CEO, Pyalla Technologies, LLC
In the July–August issue of the HP NonStop community magazine, The Connection, OmniPayments Inc. CEO, Yash Kapadia, described how plans for EMV in the U.S. are unfolding: "Most smart cards that are being issued are chip-and-signature cards. They do not require a PIN."
In this article, "The Fraud Blocker: Catching the Wrongdoers," Yash adds that as these chip cards, "only require that a cardholder sign a chit for each transaction ... [and] since the signature can be forged easily, and since retail clerks typically do not ask for identification, chip-and-signature cards provide little protection for lost or stolen cards."
This continues to floor me. The reissue of cards to all Americans holding plastic is no small exercise, and the final bill for producing and then distributing chip cards must be in the tens if not hundreds of millions of dollars. And yet, we are migrating to a half-baked solution at a time when just about anyone can hack nearly any system.
When Secretary of State John Kerry was asked recently whether he thought his emails were being read, he ducked for a moment but finally confessed that, yes, most likely they were being read by agents of foreign countries.
If the leaders of a nation as technologically advanced as the U.S. cannot secure the communications of their own heads of missions to foreign countries, then we much lower down the pecking order appear to have little option other than to assume we will be compromised at some point — likely sooner rather than later. And then how exactly is chip-and-signature going to help?
In the article, "Smarter Credit Cards Befuddle Small Businesses," CNBC cited findings from a quarterly small-business survey by Wells Fargo, saying that, "More than half of small businesses that accept point-of-sale card payments are not aware of a major change in chip card liability coming Oct. 1."
The report went on to say that, "About a fifth of those who are aware of the shift don't plan to make any changes. The reasons cited included: not being concerned about the liability shift; not wanting to pay to upgrade their terminals; and not believing the terminal would impact their business."
Small businesses befuddled? Indeed.
Decades ago, the TV sitcom "Welcome Back, Kotter" was very popular. The antics of a very young John Travolta aside, the real character was that of the oddball and naïve, Arnold Horshack. There wasn't an episode where in which Horshack didn't confess, "Mr. Kotter, I'm so confused!"
I can just hear the very same remark whenever a card issuer makes a pitch to the owner of the local store. Befuddled? Of course they are, and it's easy to understand their confusion. After all, what's in it for them? What's more, in many cases they are much better judges of character than are the big financial institutions they deal with daily, so why spend the money on new devices that do only half the job?
"Why are the U.S. card companies not using chip-and-PIN?"
Yash asks and then answers this question in his Connections article. "It is a competitive issue ... If a cardholder has two cards, one chip-and-PIN and one chip-and-signature, he is more likely to use the latter because it is more convenient."
It is not by accident that we call most corner stores these days "convenience stores." And what most convenience stores proprietors fear most is losing the convenience component. A patron faced with the problem of remembering card PINs in order to make a purchase late at night — after a couple of hours on the town — will simply select the card that can be authorized with a signature.
The sad aspect of all of this is that while those needing to update their infrastructure to support EMV (and technologies to come, such as including NFC and mobile wallets) are befuddled and confused, the "wrongdoers" (as Yash rightly calls them) are not taking a backward step.
Wrongdoing is just too lucrative a field for them, safely entrenched in remote coffee shops tapping away at the keys of their laptops. EMV does hold tremendous promise and the industry is pleased to see this cab leave the rank. But for all intents and purposes — and as an unabashed car guy — it seems to me that our cab is still up on blocks waiting for the wheels to arrive.
photo istock
About Richard Buckle
Richard Buckle is the founder and CEO of Pyalla Technologies, LLC. He has enjoyed a long association with the Information Technology (IT) industry as a user, vendor, and more recently, as an industry commentator, thought leader, columnist and blogger. Richard participates in the HPE VIP Community where he is part of their influencer team.
