We hear a lot about EMV technology these days. In the U.S. alone, 13,000 U.S. financial institutions issue EMV-enabled cards and 450 million EMV cards were in use as of last year. EMV technology—which stands for Europay, Mastercard, Visa, the developers of the chip technology—was created to help reduce card fraud, which was a growing threat every year.
Committing card fraud by duplicating somebody's card data located on the magnetic strip on the back of the card was/is a relatively easy thing to do. With the right equipment and a little know-how, a criminal could quickly and easily capture someone's information at ATM or merchant locations with card skimmers. It's a practice that continues to rise in frequency. A recent FICO report found that the number of compromised U.S. ATMs and merchants rose 39% in the first six months of 2017, compared to the same time in 2016.
With the advent of EMV technology on more and more cards, scammers are looking for and finding weaknesses at gas stations and merchant locations that haven't converted over to chip-enabled card readers. The National Association of Convenience Stores (NACS) estimates that it will cost the industry an estimated $4 billion to replace card readers, which, in some cases, necessitates completely replacing pumps and system hardware and software. The benefit is that card terminals will be more difficult to hack. It's a move that Visa and Mastercard expect to better protect consumers, companies, and banks.
Gas stations are an important piece of the card fraud prevention movement and a piece financial institutions should pay attention to. Visa and Mastercard are demanding that gas stations make the switch from magnetic strip card readers to EMV readers at pumps by October 2020. Gas station operators who don't meet the deadline may incur penalties, with fraudulent charges liability transferring from financial institutions to station owners.
How EMV Card Technology Works
Let's talk about how EMV chips work. Basically, when you "dip" your chip-enabled card into a reader to make a purchase, the chip communicates in a language that the chip reader understands. The communication being sent contains your account and card information but is hidden behind a crypto key to help protect against fraudulent charges.
If someone were to hack into the card terminal to retrieve transaction information and use it to make other illegal purchases, the criminal would not be able to make any purchases. That's because the key that the EMV chip sent to the card terminal at the store is a one-time use code. So as soon as the code is generated and used to validate the purchase, it's no longer valid and your information is secure.
This differs from magnetic strips on cards, where all the information is essentially stored on the same technology that was used to put music on cassette tapes back in the day. The information on magnetic strips is static, not dynamic like the EMV chips. So if that same crook from before hacked the terminal where you used a card with a magnetic strip and pulled all the transaction data, your personal and bank information would be exposed since there's no key protecting the data.
Will EMV Solve All Card Security Issues?
Bad news: EMV will not solve all our card security problems. EMV technology protects from scenarios as described above, but it doesn't stop a criminal who's stolen a wallet or purse. That criminal could take the card and make purchases just as you would and there's nothing to stop it. Other than the victim calling the bank or credit union and canceling the card, which many financial institutions now offer as a self-service option via a smartphone app, there are no other authentication protections currently available in the U.S.
With 55% of U.S. storefronts now accepting EMV cards, data from a VISA USA Infographic show that counterfeit fraud dollars have dropped by 66% for merchants who have completed the upgrade to chip card readers. Mastercard reports a 54% decrease in counterfeit fraud costs at merchants using EMV. Hopefully the trend will continue, especially as gas station operators convert their pump card readers.
In Europe and otherwise outside the U.S., magnetic strips on cards are rarely used. EMV chip technology has become the new standard, and the U.S. is making progress to follow. Overseas customers also use a PIN with their chip cards. This adds another level of security that could one day make it to the U.S. The PIN is the layer of security currently missing from cards in the States. This level of protection should significantly reduce fraudulent charges on stolen cards, since a stolen EMV card would be useless without the associated PIN for in-person transactions. Further developments in transaction security mean that future EMV transactions used as card-not-present (CNP) could require additional authentication means, according to the PCI Security Standards Council.
Card security is improving. And an increase in security benefits financial institutions, which hold most of the liability for reimbursing stolen and counterfeited cards. In just two and a half short years, we'll see how great of an impact updated card readers at gas pumps have on card fraud.
Discover how one financial institution used SWBC's AutoPilot Payments to power its payment center and increase transactions.