By Steve Ruwe
As we near the first anniversary of the October 2015 EMV liability shift, in which liability for card present fraudulent transactions shifted to the merchants that have failed to convert to EMV, we have solid analytics to assess its impact.
As an industry, this deadline was a major milestone. However, we are not done with EMV. Not by a long shot.
Ten months past the shift deadline, many financial institutions are still in the process of issuing EMV-enabled plastics, but PSCU credit unions have been extremely proactive. Over 80% of PSCU’s credit card accounts and 58% of debit card accounts are now EMV enabled. On the merchant side, only 22% of merchant locations currently have EMV-enabled terminals. A “location” in this case refers to a merchant, and many of the merchants currently up and running represent some of the bigger merchants, such as Wal-Mart. It is projected that by the end of 2017, 57% of merchant locations will have active EMV terminals, again representing some of the biggest merchants out there. Some smaller, low risk merchants – doctors’ offices, dentists – will likely be very slow to convert to EMV-enabled terminals, making the effective percentage even higher than the projected 57%.
While counterfeiting remains a concern, early adopting credit unions that have issued chip-enabled cards are starting to see a decline in counterfeiting/card present fraud. And fraudsters are beginning to steer clear of those merchants with EMV-enabled terminals, focusing their attention instead on merchants that have not yet converted.
Lower Losses
Since the liability shift last October, PSCU has processed more than $4 million in EMV liability chargebacks on behalf of its members, indicating that the incentive to issue EMV is real. This total represents nearly 14% of recovered dollars by PSCU since the October 2015 liability shift. It is anticipated, however, that the opportunity for issuers to charge back non-compliant EMV transactions will decrease as more merchants certify for EMV. Beyond charge back opportunities, EMV chip cards will continue to produce benefits in the form of lower counterfeit fraud losses.
Internationally after EMV implementation, we have witnessed an increase in card not present fraud as fraudsters focus their efforts on the path of least resistance. This was true when Europe converted to EMV years ago, as well as in Canada. Interestingly, Canada did not see an increase in card not present fraud for about three years following its conversion to EMV. While it is too soon to tell what will happen to card not present fraud in the U.S., it is most definitely something to monitor and for which to actively prepare. There will no doubt be multiple tools used to combat card not present fraud, including tokenization, Verified by Visa, MasterCard SecureCode, and others.
From a consumer perspective, right now the EMV check out process feels slower. Visa and MasterCard have both recognized the difficulties associated with this perceived POS delay and are actively pursuing ways to engineer around it. Quick chip and M-chip were created by Visa and MasterCard, respectively, to improve the speed of transacting. Instead of keeping the card inserted in the POS terminal until the transaction is complete, cardholders will be able to insert and quickly remove the card, similar to swiping in the old mag stripe environment.
As the first anniversary of the liability shift approaches, the next two stages of EMV implementation are on the horizon: ATM and Automatic Fuel Dispenser (gas pump) terminals. ATMs must be EMV-certified before October 2016, followed by gas pumps in October 2017. No doubt both of these stages will come along with their own set of challenges.
Asking Ourselves Questions
Over time, the issues currently associated with the EMV process for issuers, merchants and consumers will likely be resolved. Transactions will get faster, and things will go back to business as usual. This process is not unlike the challenges that occurred when terminals with mag stripes were first installed!
We have seen different risks come and go over the years, each with its own special set of risk management issues. Let us say that EMV is successful and indeed results in a drastic decrease in counterfeiting and the resulting fraud losses. Unfortunately there will be another generation of risk right on its heels. Take, for instance, mobile phones: when people start paying more frequently with their phones instead of plastic, there are bound to be more risk management issues that accompany this shift in consumer behavior.
As leaders in the payments industry, it is our job to continually ask ourselves what is the next problem, and what is the solution? PSCU will continue to remain vigilant, always on guard against the next category of risk, ready to support, ready to provide whatever tool is necessary to make sure fraudsters do not get the last word.
Steve Ruwe is Chief Risk Officer for PSCU and leads the enterprise-wide risk management strategy for PSCU, with a focus on preventing fraud and minimizing risk in the credit and debit card portfolios of Member-Owner credit unions.