5 ms·

EMV Switch This Week Could Threaten Many Businesses in U.S

25 points by tanglesome 11y ago

coleca 11y ago
I guess I'm not surprised by the lack of EMV capable card readers I still see in the US. Having worked in this space in the past, I am always checking out the payment terminals at the stored I visit. I've even seen some larger merchants that I frequent upgrade their PIN pads recently but to non-EMV capable models. If the big-box stores aren't getting it done there is little hope for the mom & pop type stores who will be forced to either stop taking cards or accept the liability for fraud since it's unlikely the acquiring banks will want to hold the bag for their customers once the card brands pass it downstream.
- fatman 11y ago
  It's funny - the only two businesses that have made me use the EMV features on my card are the locally owned butcher shop down the street and Wal-Mart.
- heywire 11y ago
  I've actually found more mom-and-pop type places have upgraded than big box stores. The first place I was able to use Google Wallet with my Android phone was a locally owned grocery store. The first EMV transaction I performed outside of Walmart was at my local liquor store on a stand-beside terminal (not directly integrated with the point of sale). I work in this space, and while both the software and hardware have been ready for some time, retailers are just really slow to change. When you're talking about potentially hundreds to thousands of new card readers at nearly $1k each, followed by many hours of testing new software versions, piloting and rolling it out, etc., it is a significant investment for them to add support for EMV. That said, it's not like this was on short notice. They've had plenty of time (and incentive) to get this done.
- larzang 11y ago
  The business I work for uses Square, who are rolling out EMV+NFC readers soon and are covering liability in the meantime, which is nice. Weirdly a couple months ago my local 7-11 upgraded to readers which have the physical EMV slot but those slots are non-functional.
  - heywire 11y ago
    Most retailers started with the hardware upgrade, which generally has to be followed up by a software upgrade to enable the processing of an EMV transaction. Depending on the level of integration with the payment network, the software changes required at the Point of Sale can actually be pretty complex.
- cpwright 11y ago
  Yesterday, for the first time Home Depot's reader required inserting my card as opposed to just a swipe.
  - JoshGlazebrook 11y ago
    Same here. I just relocated to Austin and have been making frequent trips to Home Depot and they must have just turned it on because one day I could swipe, the next I had to insert.
    - deleted 11y ago
      [deleted]
amalag 11y ago
So there is zero incentive to replace a non-emv reader. Once you have to NOT use the stripe. It is a big problem for stores. Credit cards have both so stores have to force only those transactions to the EMV. The machines need to be smart enough to figure out if the card has both and not allow the stripe transaction.
- QUFB 11y ago
  The local Walmart setup chip & signature a couple of months ago. Magstripe transactions are denied by default on my card that has the chip.
  - amalag 11y ago
    OK I haven't experienced that.
  - wnissen 11y ago
    The first few times it was really slow, but recently it's only added a couple seconds to the transaction. I really think this will be a non-issue in a couple months.
    - MrRadar 11y ago
      It seems to me like it's only going to get worse as more people get chip cards. The cafeteria at the office where I work replaced their card machine earlier this year with a model that accepts EMV cards and since we have a lot of employees that travel internationally a good chunk of the people that work here pay with an EMV card (myself included). The increased card processing time has resulted in a noticeable increase in the wait time at the register, commonly backing up the line by 1-3 people. I recently figured out the terminal also supports NFC payments so now I use my phone with Android Pay (since it only takes 1-2 seconds vs 10-15) but I'm the only one who uses it so far and I'm not sure anyone else knows.
  - irl_zebra 11y ago
    I noticed this recently as well at Walmart. Tried to swipe my card and it didn't work, swiped again and it didn't work. Finally bothered to read the error message, which was "Insert Card into Slot at Bottom of Terminal." My experience in Europe has been with Chip and PIN, I wonder why we're gravitating toward Chip and Signature.
brianjolney 11y ago
I'm pretty sure the article has it completely backwards. If a retailer has a chip reading terminal, they aren't responsible for fraud. It incentivizes retailers to update their hardware, or face shouldering the fraud risk for chip enabled cards that they end up swiping.
- xenadu02 11y ago
  You're correct. If the merchant has the EMV reader but the bank card only has a mag stripe the bank eats any fraud, period. The merchant is completely off the hook.
  - weaksauce 11y ago
    What happens if the reader is an EMV one but the fake bank card looks like it has a chip and it was swiped instead of using the chip? I have a debit card with the chip but I can still swipe it at the hybrid terminals. Who owns liability in that case?
    - cbhl 11y ago
      Once I used my chip cards in a reader in the US, and was told, "this is a chip card, please insert it into the bottom" so there's definitely a bit that can be set in the magstripe to tell the PoS that a chip should be available in case you clone just the magstripe.
- heywire 11y ago
  Agreed. The simplest way I've heard it described is that whoever has the lowest level of EMV support is liable. So if the bank hasn't issued you a chip card, but the retailer supports it, the bank is liable. Likewise, if you have a chip card, but the retailer doesn't have the EMV readers, the retailer is now liable -- and that is where the change is.
creshal 11y ago
It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years. For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions above a $20 limit) will require chip+PIN verification, which seems to cut down fraudulent transactions for now.
- pjc50 11y ago
  Indeed. There were a bunch of security objections to the system by Ross Anderson et al at launch; it has turned out that EMV is not at all the weak link compared to online transactions, which are where most of the fraud is. Or skimmed ATMs, which don't seem to use the chip.
  - creshal 11y ago
    As far as I can tell, skimmers in Germany still copy the (fallback) magnet stripe and PIN, to use those in countries that don't require EMV. It's far easier than trying to break EMV chips.
    - davb 11y ago
      This is the case in the UK too. When it became more difficult to use cloned magstripe-only cards in the UK, banks relied more heavily on behavioural profiling and risk analysis ("has this card been used in this country in the past?", "does this cardholder travel frequently?", "is this vendor known to have weak cardholder verification processes?").
    - toomuchtodo 11y ago
      Can I wipe my magstrip so only the EMV chip can be used?
- darkr 11y ago
  More like 10 years. UK + Europe rollout of chip+pin/EMV + incentivised liability shift was around 2005/2006, and has reduced card fraud by around 70% in most countries. Contactless/NFC payment facilities have been pretty widespread (at least in the UK) since 2010 or so, and since the last couple of years or so are pretty much ubiquitous. I suspect that America being so backwards in this respect has a lot to do with the power and influence wielded by corporate lobbyists in congress.
stevep98 11y ago
It seems to take a couple of extra seconds to process the transaction, compared to a swipe. I'm surprised that this bothers me so much. I might use Apple Pay more often if this doesn't get improved.
- MrRadar 11y ago
  That's my experience too. Fortunately most of the EMV-activated terminals I've run into also accept NFC so I've just been using Android Pay to avoid the extra hassle.
Aardwolf 11y ago
Yep had chips for decades already in Europe (it's not called "EMV" here though, just a chip afaik). I don't know who is liable in Europe for fraud (shop or bank), but, about the article, I find it odd, the chips should be more secure, so why are banks giving the responsibility of fraud to merchants while not for the insecure magstripes? The banks should be able to trust their own chips right?
- davb 11y ago
  It is indeed called EMV here, it's just not marketed as such. EMV stands for Europay, Mastercard and Visa - the original consortium who agreed the smartcard payment standard. In the UK it's marketed as "Chip and PIN", but it's all EMV. The specifications are all available online too [1] and make for an interesting, if involved, read. EMV are responsibly for a number of specifications, including "Chip and PIN" style payment, contactless (NFC) and CAP (Chip Authentication Program - a two factor system where users are given self-contained challenge/response card readers with which virtually every EMV card is compatible). https://www.emvco.com/specifications.aspx https://www.emvco.com/specifications.aspx
quux 11y ago
EMV cards are a big improvement for security but the UX is a step big back from mag swipes. Here's an example from a recent stop at the ATM. * I dipped my card and then was told to reinsert the card and leave it in for the duration of the transaction. I wonder how long it will take for me to insert/leave by default instead of dipping. * The machine mechanically locked my card into the slot until I had taken my cash, I wonder how more frequently people are going to leave their cards in the ATM now. Also, what happens if the power goes out or the machine crashes? * It seems that some EMV cards have multiple "Applications" on them and it's impossible to tell which one should be used in which context. When I inserted my card, the ATM presented me with a menu asking be to select between "US DEBT" and "VISA DEBT" I had no idea which one to choose, and had to pick one, try to make a withdrawal, fail, and then choose the other one to take out cash. I don't remember which one worked, and if that's the one I should use in other locations.
- slashink 11y ago
  1. I understand coming from only swipe but in my mind (Sweden) you insert your card while you perform the entire transaction as a identifier compared to swiping. That's at least how me and my friend think about it after asking him. 2. Machines in Europe has been doing this for a long time and it's never been an issue. I guess in the rare case power goes out (aren't these machines on UPS?) it you just call the provider hotline, cancel that card and get a new one in the mail the day after. 3. I have never seen this but i agree this is an issue. That is a unnecessary UX roadblock.
  - davb 11y ago
    1) I agree - I think this is a regional thing. In the UK, ATMs almost always lock the card in place (typical non-corner-store ones take the entire card into the machine). 2) In the UK, most machines make you take the card out before dispensing the banknotes. Bank-owned (non-corner-shop) ATMs "spit out" the card and beep until you take the card. Only then do they dispense the cash. 3) I don't think many UK card issuers use multiple applications for the same context. That is to say, if you put your card into an ATM, only one application is likely to be compatible with that profile. There may be other applications for travel (ITSO, for example, is a travel card standard built on Global Platform). I think every EMV terminal has support for application selection menus (usually in the form of little buttons along the side of the screen) but they're virtually never used in the UK. In my experience while travelling, US payment terminals are the most unusual.

25 points by tanglesome 11y ago

I guess I'm not surprised by the lack of EMV capable card readers I still see in the US. Having worked in this space in the past, I am always checking out the payment terminals at the stored I visit. I've even seen some larger merchants that I frequent upgrade their PIN pads recently but to non-EMV capable models. If the big-box stores aren't getting it done there is little hope for the mom & pop type stores who will be forced to either stop taking cards or accept the liability for fraud since it's unlikely the acquiring banks will want to hold the bag for their customers once the card brands pass it downstream.

fatman 11y ago
It's funny - the only two businesses that have made me use the EMV features on my card are the locally owned butcher shop down the street and Wal-Mart.
heywire 11y ago
I've actually found more mom-and-pop type places have upgraded than big box stores. The first place I was able to use Google Wallet with my Android phone was a locally owned grocery store. The first EMV transaction I performed outside of Walmart was at my local liquor store on a stand-beside terminal (not directly integrated with the point of sale). I work in this space, and while both the software and hardware have been ready for some time, retailers are just really slow to change. When you're talking about potentially hundreds to thousands of new card readers at nearly $1k each, followed by many hours of testing new software versions, piloting and rolling it out, etc., it is a significant investment for them to add support for EMV. That said, it's not like this was on short notice. They've had plenty of time (and incentive) to get this done.
larzang 11y ago
The business I work for uses Square, who are rolling out EMV+NFC readers soon and are covering liability in the meantime, which is nice. Weirdly a couple months ago my local 7-11 upgraded to readers which have the physical EMV slot but those slots are non-functional.
- heywire 11y ago
  Most retailers started with the hardware upgrade, which generally has to be followed up by a software upgrade to enable the processing of an EMV transaction. Depending on the level of integration with the payment network, the software changes required at the Point of Sale can actually be pretty complex.
cpwright 11y ago
Yesterday, for the first time Home Depot's reader required inserting my card as opposed to just a swipe.
- JoshGlazebrook 11y ago
  Same here. I just relocated to Austin and have been making frequent trips to Home Depot and they must have just turned it on because one day I could swipe, the next I had to insert.
  - deleted 11y ago
    [deleted]

amalag 11y ago

So there is zero incentive to replace a non-emv reader. Once you have to NOT use the stripe. It is a big problem for stores. Credit cards have both so stores have to force only those transactions to the EMV. The machines need to be smart enough to figure out if the card has both and not allow the stripe transaction.

QUFB 11y ago
The local Walmart setup chip & signature a couple of months ago. Magstripe transactions are denied by default on my card that has the chip.
- amalag 11y ago
  OK I haven't experienced that.
- wnissen 11y ago
  The first few times it was really slow, but recently it's only added a couple seconds to the transaction. I really think this will be a non-issue in a couple months.
  - MrRadar 11y ago
    It seems to me like it's only going to get worse as more people get chip cards. The cafeteria at the office where I work replaced their card machine earlier this year with a model that accepts EMV cards and since we have a lot of employees that travel internationally a good chunk of the people that work here pay with an EMV card (myself included). The increased card processing time has resulted in a noticeable increase in the wait time at the register, commonly backing up the line by 1-3 people. I recently figured out the terminal also supports NFC payments so now I use my phone with Android Pay (since it only takes 1-2 seconds vs 10-15) but I'm the only one who uses it so far and I'm not sure anyone else knows.
- irl_zebra 11y ago
  I noticed this recently as well at Walmart. Tried to swipe my card and it didn't work, swiped again and it didn't work. Finally bothered to read the error message, which was "Insert Card into Slot at Bottom of Terminal." My experience in Europe has been with Chip and PIN, I wonder why we're gravitating toward Chip and Signature.

brianjolney 11y ago

I'm pretty sure the article has it completely backwards. If a retailer has a chip reading terminal, they aren't responsible for fraud. It incentivizes retailers to update their hardware, or face shouldering the fraud risk for chip enabled cards that they end up swiping.

xenadu02 11y ago
You're correct. If the merchant has the EMV reader but the bank card only has a mag stripe the bank eats any fraud, period. The merchant is completely off the hook.
- weaksauce 11y ago
  What happens if the reader is an EMV one but the fake bank card looks like it has a chip and it was swiped instead of using the chip? I have a debit card with the chip but I can still swipe it at the hybrid terminals. Who owns liability in that case?
  - cbhl 11y ago
    Once I used my chip cards in a reader in the US, and was told, "this is a chip card, please insert it into the bottom" so there's definitely a bit that can be set in the magstripe to tell the PoS that a chip should be available in case you clone just the magstripe.
heywire 11y ago
Agreed. The simplest way I've heard it described is that whoever has the lowest level of EMV support is liable. So if the bank hasn't issued you a chip card, but the retailer supports it, the bank is liable. Likewise, if you have a chip card, but the retailer doesn't have the EMV readers, the retailer is now liable -- and that is where the change is.

creshal 11y ago

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years. For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions above a $20 limit) will require chip+PIN verification, which seems to cut down fraudulent transactions for now.

pjc50 11y ago
Indeed. There were a bunch of security objections to the system by Ross Anderson et al at launch; it has turned out that EMV is not at all the weak link compared to online transactions, which are where most of the fraud is. Or skimmed ATMs, which don't seem to use the chip.
- creshal 11y ago
  As far as I can tell, skimmers in Germany still copy the (fallback) magnet stripe and PIN, to use those in countries that don't require EMV. It's far easier than trying to break EMV chips.
  - davb 11y ago
    This is the case in the UK too. When it became more difficult to use cloned magstripe-only cards in the UK, banks relied more heavily on behavioural profiling and risk analysis ("has this card been used in this country in the past?", "does this cardholder travel frequently?", "is this vendor known to have weak cardholder verification processes?").
  - toomuchtodo 11y ago
    Can I wipe my magstrip so only the EMV chip can be used?
darkr 11y ago
More like 10 years. UK + Europe rollout of chip+pin/EMV + incentivised liability shift was around 2005/2006, and has reduced card fraud by around 70% in most countries. Contactless/NFC payment facilities have been pretty widespread (at least in the UK) since 2010 or so, and since the last couple of years or so are pretty much ubiquitous. I suspect that America being so backwards in this respect has a lot to do with the power and influence wielded by corporate lobbyists in congress.

stevep98 11y ago

It seems to take a couple of extra seconds to process the transaction, compared to a swipe. I'm surprised that this bothers me so much. I might use Apple Pay more often if this doesn't get improved.

MrRadar 11y ago
That's my experience too. Fortunately most of the EMV-activated terminals I've run into also accept NFC so I've just been using Android Pay to avoid the extra hassle.

Aardwolf 11y ago

Yep had chips for decades already in Europe (it's not called "EMV" here though, just a chip afaik). I don't know who is liable in Europe for fraud (shop or bank), but, about the article, I find it odd, the chips should be more secure, so why are banks giving the responsibility of fraud to merchants while not for the insecure magstripes? The banks should be able to trust their own chips right?

davb 11y ago
It is indeed called EMV here, it's just not marketed as such. EMV stands for Europay, Mastercard and Visa - the original consortium who agreed the smartcard payment standard. In the UK it's marketed as "Chip and PIN", but it's all EMV. The specifications are all available online too [1] and make for an interesting, if involved, read. EMV are responsibly for a number of specifications, including "Chip and PIN" style payment, contactless (NFC) and CAP (Chip Authentication Program - a two factor system where users are given self-contained challenge/response card readers with which virtually every EMV card is compatible). https://www.emvco.com/specifications.aspx https://www.emvco.com/specifications.aspx

quux 11y ago

EMV cards are a big improvement for security but the UX is a step big back from mag swipes. Here's an example from a recent stop at the ATM. * I dipped my card and then was told to reinsert the card and leave it in for the duration of the transaction. I wonder how long it will take for me to insert/leave by default instead of dipping. * The machine mechanically locked my card into the slot until I had taken my cash, I wonder how more frequently people are going to leave their cards in the ATM now. Also, what happens if the power goes out or the machine crashes? * It seems that some EMV cards have multiple "Applications" on them and it's impossible to tell which one should be used in which context. When I inserted my card, the ATM presented me with a menu asking be to select between "US DEBT" and "VISA DEBT" I had no idea which one to choose, and had to pick one, try to make a withdrawal, fail, and then choose the other one to take out cash. I don't remember which one worked, and if that's the one I should use in other locations.

slashink 11y ago
1. I understand coming from only swipe but in my mind (Sweden) you insert your card while you perform the entire transaction as a identifier compared to swiping. That's at least how me and my friend think about it after asking him. 2. Machines in Europe has been doing this for a long time and it's never been an issue. I guess in the rare case power goes out (aren't these machines on UPS?) it you just call the provider hotline, cancel that card and get a new one in the mail the day after. 3. I have never seen this but i agree this is an issue. That is a unnecessary UX roadblock.
- davb 11y ago
  1) I agree - I think this is a regional thing. In the UK, ATMs almost always lock the card in place (typical non-corner-store ones take the entire card into the machine). 2) In the UK, most machines make you take the card out before dispensing the banknotes. Bank-owned (non-corner-shop) ATMs "spit out" the card and beep until you take the card. Only then do they dispense the cash. 3) I don't think many UK card issuers use multiple applications for the same context. That is to say, if you put your card into an ATM, only one application is likely to be compatible with that profile. There may be other applications for travel (ITSO, for example, is a travel card standard built on Global Platform). I think every EMV terminal has support for application selection menus (usually in the form of little buttons along the side of the screen) but they're virtually never used in the UK. In my experience while travelling, US payment terminals are the most unusual.