Wednesday, July 28, 2010

What is Chip and Pin?

Will smarter credit cards be in our near future? What is Chip and Pin? Chip and Pin is a UK government-backed initiative to implement the EMV (short for Europay, Master Card and Visa) standard for smart payment cards.


EMV has been adopted in virtually every part of the world, including Canada and Mexico, for the storing of payment-card data. The U.S. maintains a vested interest in magnetic stripe based cards and the devices associated with them. Expense is currently the biggest barrier for US implementation along with liability for fraud loss. Criminals already working around the system also figure into the reluctance to bring it to American cardholders.

Javelin Strategy & Research estimates an EMV roll out across the United States would cost about $8.6 billion including the following:

• POS terminal replacements -- approximately $6.75 billion
• EMV card issuance -- around $1.4 billion
• ATM upgrades -- approximately $500 million
Also to be considered is the fact that the greatest beneficiaries of Chip and Pin are the card issuers with merchants and customers taking the brunt of the losses. The same merchants that will need to pay for most of the upgraded equipment to accept the new devices.

"(Chip and Pin's) main attraction to banks is the 'liability shift,' which is precluded in the U.S. by Regulation E," wrote Ross Anderson, a professor of security engineering at the University of Cambridge, in an e-mail. "This shift means that disputed transactions will be blamed on the customer if a PIN was used and the merchant otherwise. Thus, in theory, the bank would never again be liable.

Such a shift isn't possible in the U.S. because of rules set up under the Electronic Fund Transfer Act of 1978, says Steven J. Murdoch, Ph.D., a security researcher at Cambridge University. This is probably good news for U.S. consumers: Murdoch says that since the standard was fully adopted, it's been next to impossible for British consumers to recover money stolen in fraud.

"The banks get to effectively make up their own rules, and the rule they've chosen is that if your PIN is used, then you must have been negligent about protecting your PIN, therefore you're liable for the fraud," says Murdoch.

With this much uncertainty and these expenses without a return on investment we don't expect Chip and Pin to take over the US soon.