GO

In your view, which of the following initiatives will have the greatest impact on the European payments market? This poll is closed.

 

EPC Newsletter
Issue 10 - April 2011

SEPA for Cards

The Magnetic Stripe: Why it is Hard for Americans to Say Good-Bye In the US, clinging to old-fashioned payment methods is more than just a bad habit

21.04.11 By Bob Sullivan

INTRODUCTION AND SUMMARY

As reported in the January 2011 edition of this newsletter, the European Payments Council (EPC) approved in December 2010 the resolution 'Preventing Card Fraud in a Mature EMV Environment'. EMV is an industry standard to implement chip and personal identification number (PIN) security for point of sale (POS) card transactions. At the end of 2010, 81 percent of cards, 89 percent of POS and 96 percent of automatic teller machines (ATMs) in SEPA were EMV-compliant. Card fraud is now migrating rapidly to points of least resistance, i.e. countries which have not implemented chip and PIN technology. Much to the frustration of European banks, the US is one of them. The US cards market continues to rely on magnetic stripe  technology which allows fraudsters to 'skim' (copy) data stored on the magnetic stripe. To-date, EMV-compliant cards issued in Europe continue to carry the magnetic stripe. European banks are therefore increasingly liable for losses resulting from European card holders falling victim to fraudulent card payments made in the US with counterfeited cards. The EPC resolution seeks to limit the potential impact of an incomplete migration to EMV outside SEPA based on the EMV chip-only option. In other words, European banks might consider issuing cards without the magnetic stripe in the future. Bob Sullivan, a US-based payments journalist, explains why Americans seem so reluctant to add any new security features to their old-fashioned magnetic stripe payment cards.

Key Information in this Article

US banks generally perceive fraud losses to be less than the cost of upgrading the card infrastructure to comply with EMV standards. Until those lines cross, there are no incentives for the US financial system to engage in such a dramatic change.

It might however be worth the while to do the math again. Some US card industry observers recently indicated that losses due to fraudulent card transactions in the US might already exceed the costs of EMV migration.

It should not be expected that the US government will enforce migration to EMV.

US consumers are satisfied with the fraud fighting measures other than chip and personal identification number (PIN) technology, which are currently in place. In their view, having to enter a PIN when making a card payment creates a ‘solution in search of a problem’.

More could be done however to enlist consumers as fraud-fighters and to convince them of the added value of chip and PIN technology. US travellers whose magnetic stripe cards are increasingly refused as a means of payment in Europe, could be the first to ask for change.

It will take a combination of consumer education, ease of use, cost-saving technological advancements, clearer fraud accountability and government enticements to break down the Americans’ loyalty to the magnetic stripe card.

 

***
Readers are invited to share their thoughts on topics discussed in the EPC Newsletter.
Scroll to the end of the page and post a comment. Go to comments.

A brief history of the magnetic stripe credit card - and the American affection for it

The European experience of EMV migration in the cards market seems to present a clear-cut case: less fraud, more account holder peace of mind, a step into the 21st century. So - what's not to love? Plenty say American consumers and banks, who seem to be clinging to their old-fashioned magnetic stripe credit cards as if their banking system depended on it. Chip and personal identification number (PIN) is old hat on the European side of the pond, but US banks - and consumers - are no closer to upgrading their card infrastructure than they were in 1999, when American Express first tried selling Americans 'Blue' smart cards. This is hardly the first time Europeans and Americans have seen things differently. It is clear that some people in Europe are at their wit's end about the Americans and for anyone anxious to change it is difficult to understand why the Americans seem to try so hard to keep things the same. For starters, in some ways, the banking system here does depend on the old ways.

An ingenious technology of its time, the magnetic stripe was invented in the 1960s by adding tape-recorder-like magnetic tape to a payment card. Magnetic tape itself was a remarkable invention, with its roots in the 1920s, when it was first used by musicians to record audio. In the 1950s, computer scientists began using it to record data, setting the stage for the 'magnetic stripe card'.

In the 1960s, credit card fraud was skyrocketing and clerks were stuck manually comparing account numbers embossed on cards with printed lists of accounts linked to fraud. The addition of the magnetic stripe allowed cashiers to automate this process - one swipe and the number could be recognised by a computer. More importantly, the account number could be transmitted over a phone line to a centralised list of fraudulent accounts. Back in those days, the magnetic stripe had fraudsters on the run for quite a while.

As this technology approaches its 50th anniversary however, it is looking as outdated as the IBM Selectric typewriter, which was introduced at about the same time. Criminals figured out how to circumvent the magnetic stripe's fraud-fighting features by the mid-1980s, when IBM killed the Selectric in favour of the Wheel Writer.

If Europeans are both frustrated and confused by America's fondness for magnetic stripe technology, it is understandable.

"European card issuers have been fed up since the Heartland Payment Systems1 breach, where the mega-million dollar investments they made in chip cards were defeated by their cardholders shopping, traveling and eating out in the US using their magnetic stripe enabled credit (and debit) cards that were processed by Heartland," said Avivah Litan, a prominent payments analyst at research firm Gartner. "European issuers have been talking about stopping their cardholders from using the mag stripe on their plastic cards since that time, and they are still fed up."

Up until now, EMV-compliant cards issued in Europe continue to carry the magnetic stripe currently important for access to terminals. The European Payments Council (EPC) resolution 'Preventing Card Fraud in a Mature EMV Environment' seeks to limit the potential impact of an incomplete migration to EMV outside the Single Euro Payments Area (SEPA) based on the EMV chip-only option. In other words, the EPC recommends that card schemes grant card issuers in SEPA the option to issue chip-only cards or to allow them to refuse magnetic stripe transactions if they so wish. These options are subject to contractual communication with the cardholder. European merchants might increasingly opt not to accept magnetic stripe cards.

The EPC resolution is a bold step. Its impact on the US market however will be limited - let's just say Europe coughed, but America didn't catch a cold. Why the stubbornness? Let me try to explain.

The factors driving fraud fighting activities and related costs are different in Europe and the US

In some ways, the reason for American resistance can be summed up in one word: money. When speaking privately to any fraud analyst, the admission will come rather quickly. US banks generally perceive fraud losses to be less than the cost of upgrading the old magnetic stripe infrastructure. Quite simply, until those lines cross, no rickety coalition of banks or retailers would seriously consider such massive restructuring - at least not without government intervention. If you're wondering when that might come, you'll be wondering a long time. Banks hold wide-ranging power in Washington D.C., a reality highlighted by the meagre financial reforms imposed in the wake of the 2008 financial meltdown. In fact, US banks are already out in full force to roll them back. Washington will not impose the massive cost associated with EMV implementation on banks. The market will therefore have to dictate when magnetic stripe cards will finally die, and that market is taking its sweet old time deciding.

The divergence of fraud-fighting systems on  both sides of the Atlantic - and the US' 50 year old loyalty to the magnetic stripe - is less crazy than it sounds, comments Benjamin Jun, Vice President of Technology at Cryptography Research, a firm that helps banks protect data. In the 1980s, as fraud-fighting efforts developed, international long-distance phone calls across Europe were very expensive. At the time it was standard practice to verify cardholder data by calling a centralised database. In an effort to reduce related costs, European banks made their credit cards secure on their own by developing a decentralised, self-contained system. That led to placing tiny computer chips on each card that were smart enough to be used for validation without the need to call a central bank. Instead, users enter PIN codes that can be checked against data on the chip for authenticity.

In the US on the other hand, national telecommunications costs were relatively inexpensive, so it made sense for American banks to maintain their centralised fraud systems and continue to have merchants 'phone home' with each transaction.

"In the US it costs 25 US cents to clear a transaction. In Europe, the costs were much higher. So they solved the problem by throwing more money at it", Jun adds. "Their system has been upgraded more quickly because their fraud rates required it".

It might however be worth the while to do the math again. Some US card industry observers recently indicated that losses due to fraudulent card transactions in the US might already exceed the costs of EMV migration.

False starts: efforts to put smart plastic into the hands of US consumers have so far failed

The efforts made so far to put smart plastic in the hands of US consumers have been tepid at best. In the mid-1990s, American Express dived into the smart card end of the pool with its 'Blue' card. The card offered dual use - both magnetic stripe and chip authentication - but virtually no consumers used the chip for anything. This is because the chip had nothing to talk to. The card was vaguely aimed at helping consumers feel better about online shopping, but American Express required them to buy their own smart card readers, which could be attached to their home computers while surfing on the Internet. In retrospect, it was a bad misinterpretation of the market, as nobody would even pay five US dollars for this smart card reader. Ultimately, consumers have since then realised that US law capped their loss liability at 50 US dollars, and most banks waived even that amount when fraud occurred, they had no desire to pay anything to feel safer about credit card use. In fact, as we'll see later, consumers have indicated they wouldn't do 'anything' for added security.

Smart card enthusiasts then went in the opposite direction looking for patrons and got Target on board, the nation's second largest retailer. In the early part of the last decade, the store announced it would begin a major pilot programme installing smart card readers at checkout terminals around the country, as well as adding chips to its Target-branded credit cards. Without participation from major banks however, very few consumers carried smart cards - and Target's smart card readers remained lonely, too. The pilot never really got off the ground.

These failed efforts show that it's not quite accurate to say that money is the simple cause of US sluggishness. It's more accurate to say that there is simply no solid value proposition for anyone in the payments chain to engage in EMV migration due to costs relating to fraud losses. Consumers aren't losing money, so they won't pay. Banks have figured out how to minimise losses using clever back-end tools, so why should they pay? And finally, large retailers collect electronic signatures to protect themselves from high card-not-present fraud losses, while small retailers have no interest in cluttering up their tills with another machine that brings monthly fees and maintenance costs. 

In business, and in life for that matter, change almost never occurs until the current circumstances are so uncomfortable they force it. No one in the US is really that uncomfortable with the magnetic stripe.

Consumer behaviour beats all

There is an untapped source for this discomfort possibly to materialise, however - consumer perceptions. Negative consumer sentiment will be the driving force behind any future change. For the past five years an estimated ten million US adults say they have been victims of identity (ID) theft. As a result, concern about this mysterious crime runs so high that millions pay roughly 10 US dollars every month for ID theft prevention services that offer little actual value. Yet none of that 'angst'2 - both real and exaggerated - has led to consumers clamouring for more secure credit cards.

Bitterness at banks has reached an all-time high in the US, in the wake of costly taxpayer bailouts and aggressive foreclosures. Bankers now rank with lawyers and journalists as the most disliked professionals, yet, there is one type of bank communication consumers surprisingly enjoy - the 'we think your card is being used for fraud' warning call.

Developed by Falcon more than ten years ago, banks search for patterns in purchasing behaviour that fall well outside the norm. For example, if a 1,000 US dollar-a-month spender in Seattle suddenly buys a 3,000 US dollar diamond ring in London, the unlikely purchase triggers a flag, which then triggers a call to the consumer (the cardholder).

Results from numerous surveys reveal that consumers are greatly comforted by these calls, which make them feel that for once, the bank is on their side. Banks are loathed to give them up, as they can also create upsell opportunities, plus consumers would miss them. More importantly however, behaviourists report that consumers have become 'used' to the calls. By some counts, half of all US adults have received such a call at least once in their lives. Once upon a time, fraud warning calls might have been disturbing. Now, they barely register them. In other words, credit card fraud is seen as part of life to the US consumer. They will not be crying out for new fraud-fighting tools any time soon.

US consumers are also seen as creatures of habit. Banks know that the average US consumer holds around ten credit cards and the vast majority will only make one attempt before switching to another form of payment. Who wants to be first out the gate with a card that could introduce even the slightest hassle? Swiping is easier than entering a PIN code. Pulling out a card that requires a PIN will feel a bit like adding an extra 'u' to words like favour and behaviour - 'it's just a nuisance, but why do I have to take this extra step?'

That makes smart cards the dreaded 'solution in search of a problem', in the US.

What will it take?

Payments experts know that this attitude does not reflect reality; the problem can be spotted on balance sheets everywhere. US consumers are also encountering new frustrations when they travel outside the US as they find more and more locations - such as automated train ticket booths in Ireland - that simply won't take their supposedly trusted magnetic stripe cards. As more European retailers and banks follow the measures set out in the EPC resolution on card fraud prevention in a mature EMV environment, US consumers might even more often experience that their magnetic stripe cards are not accepted as a means of payment. Jilted US consumers will surely bring their frustrations back with them when they go home. That's a start.

Perhaps the slow-but-steady march toward global standards in the mobile phone industry might also be instructive here. For years, US travellers looked on with jealousy as GSM phone carrying Europeans called friends seamlessly from either continent, while US travellers were stuck renting disposable phones at European airports. The moment US shoppers are forced to rent a European smart credit card, or have any experience remotely similar, would certainly inject some urgency into the conversation they will have with their card-issuing bank.

But at some point, an element of morality should be injected into this discussion: no one should simply glance the other way at crime. It might be hard at first for US banks to adopt the moral high ground and enlist consumers in a fight against crime. All parties might however be surprised at the willingness of consumers to be deputised in an effort to fight still-rampant identity theft. Convince them that they are losing this fight because they are using the equivalent of an old typewriter, and that they could instead be using the payment world's equivalent of an iPad, and you might have them clamouring for a new kind of credit card upgrade.

It will however not be easy, and it will not happen soon. It will surely take a combination of consumer education, ease of use, cost-saving technological advancements, more clear fraud accounting and government enticements to break down the Americans' loyalty to the magnetic stripe. Only then will they send it off to its rightful place, which is right next to the IBM Selectric typewriter in the history museum.

Bob Sullivan is a reporter for msnbc.com and author of three books dealing with consumer payment issues, including New York Times best sellers 'Gotcha Capitalism' and 'Stop Getting Ripped Off'.

Related links:

To read Bob Sullivan's blog 'The Red Tape Chronicles' on msnbc.com, follow this link: redtape.msnbc.com

EPC Resolution: Preventing Card Fraud in a Mature EMV Environment

Related article in this issue:

Time to Prepare the Eulogy - 'Six Feet Under' for the Magnetic Stripe in SEPA. Eurosystem recommends migration to chip-only cards

Related article in previous issue:

Work in Progress. The EPC approves update of the SEPA Cards Standardisation Volume and a new resolution 'Preventing Card Fraud in a Mature EMV Environment' (EPC Newsletter, Issue 9, January 2011)


1Heartland Payment Systems® is a US-based company providing debit / prepaid / credit card processing, online payments, check processing and payroll services.

2The German term 'angst' means 'fear'.

Article175




Comments

If you would like to comment on this article, please identify yourself with your first and last name. Please note that your name will appear next to your comment. Email addresses will not be published. Please note that by accessing or contributing to the discussion you agree to abide by the EPC Newsletter Terms and Conditions, so please read them carefully before doing so.

Blog Posts

Read us on EPC Blog

23.10.14
The New European Commission: a Closer Look at President Juncker’s Vision for the EU Internal Market and Economic and Monetary Union

Tweets

Follow us on Twitter

Mission letter @JunckerEU to VP @EU_Commission Valdis Dombrovskis responsible for #Euro and Social Dialogue. #SEPA http://t.co/xTm9bteSuL
24/10/2014
Tweets

Join us on LinkedIn


Leave this field empty

Mail this article to a friend

Enter the below data in order to send a link to this page.

Your name:
Your email:
Name of your friend:
Email of your friend:
Your comment:
Close
Leave this field empty

Send feedback

Enter the below data in order to give feedback on this page.

Your name:
Your email:
Your comment:
Close