There's an ongoing debate as to whether a signature will really provide that added layer of security, since chip terminals don't verify in real-time that a signature belongs to the person using the card. The signature used by somebody committing fraud could be helpful in a subsequent investigation of fraud (using handwriting analysis), or a fastidious sales clerk might ask to see another card or form of identification to compare signatures.
A PIN is considered unique, but it can be stolen, even by a thief who watched a cardholder type in a PIN on a terminal before stealing the card. (That kind of theft is rare in the U.S. ) Some merchants want to avoid the added cost of terminals that have keypads, but nearly all the terminals being installed will have them. Another potential problem is that people who have never used PINs might have trouble remembering them.
Several industry officials said that MasterCard has indicated support for chip-and-PIN security with credit cards, while Visa has supported the chip-and-signature approach in various public remarks. However, an official at Visa recently told Computerworld that Visa has no official preference, and some analysts consider MasterCard neutral on the matter. Some banks that issue both types of cards have been issuing MasterCard chip cards with a PIN requirement and Visa chip cards with a signature requirement.
The jury is still out on signature vs. PIN, and banks will be weighing preferences of consumers in coming months. In other words, it is entirely possible that come Oct. 1, average customers might not know if their cards require a PIN or a signature unless they're informed by their banks. It's possible that some may not find out until they're in line to make a chip-based purchase for the first time.
What about when I shop online with a chip card?
The chip in the card offers no improvement in security when you're using your credit card number to shop online. It will be the same as if the card were a magnetic stripe card. If you happen to have a small portable chip card reader, then the enhanced security could come into play, assuming the seller on the other end could accept that kind of data. An artist selling paintings or a small merchant using chip-reading technology provided by Square or another vendor would still need to read an actual chip card in person, even though the transaction would almost seem to be online.
What's the significance of this Oct. 1 deadline?
Banks and card companies set Oct. 1 as the day when the liability for losses from card fraud will be transferred from banks to merchants, or the party with the least-secure technology.
The liability shift means that if a someone tries to buy a $500 espresso machine with a stolen card that doesn't have an embedded chip, and the merchant accepts the card, the merchant would take the loss, not the bank.
There's really no deadline for consumers, who will continue to be protected by banks against liability due to fraud. Consumers will still need to report lost or stolen cards, of course.
Major merchants that are making the conversion and are worried about their newfound liability will likely require shoppers to use chip cards after Oct. 1. It isn't clear how much backlash will come from customers who aren't prepared. People who have only magnetic strip cards will probably be permitted to complete their transactions with a normal swipe. In such situations, the liability would fall back onto the bank that issued the noncompliant card, according to Jordan McKee, an analyst at 451 Research.
It's possible that some small merchants who have been accepting magnetic strip cards but don't have the ability to process chip cards will stop accepting cards and will insist on payment by cash or check. A number of companies, like Square, sell chip card readers for small businesses, and PayPal is expected to offer one this fall.
Come on, isn't this conversion to chip cards going to be a breeze?
The process of converting to chip cards would seem to be easy, but perhaps only to technically minded people. Americans have used magnetic swipe cards for decades and the practice is entrenched. And store clerks might, or might not, be trained to help customers use the new chip card payment terminals.
"Never underestimate how difficult it is to change entrenched behaviors," said McKee of 451 Research. "Card issuers are already uneasy about the change in the process from swiping a card [with a magnetic stripe] to dipping [inserting]" a card with a chip.
To show how the transaction process could work with chip cards, Computerworld recently attempted to make a large purchase using a Bank of America MasterCard debit card with a chip at a new chip-enabled terminal in a Wal-Mart in Harrisonburg, Va. After three failed attempts to pay by inserting the card into the chip reader, the transaction was successfully completed with a swipe of the card's magnetic stripe. The clerk said it should have worked as a chip card.
Wal-Mart and Bank of America didn't respond when asked to comment about the incident in the Virginia store, but there are still about seven weeks until Oct. 1, when theoretically Wal-Mart expects to be ready for chip transactions and meet the liability deadline. Or, perhaps, that simple test is a foreshadowing of problems to come.
"The U.S. is transitioning to chip cards during the onset of the holiday shopping season," McKee noted. "The combination of long queues, impatient shoppers and a new process for card transactions will not be pretty. Chaos will ensue ... It will be messy."
In interviews, officials at both Visa and MasterCard have indicated that they hope their public information campaigns through GoChipCard.com and other venues will enhance public understanding of the conversion.
Carolyn Belfany, senior vice president of U.S. product delivery at MasterCard, said in an interview in late June, "We certainly don't think that the consumer should fumble through" using a new chip card.
The GoChipCard.com site was designed to provide clear, simple instructions -- such as the caveat to resist the impulse to remove the card quickly, she said. Variations in the way chip card terminals work should be apparent. "Hopefully that stuff will be minimized, but we'll still have variation," she said.
It's safe to say that merchants, banks, card companies and consumers will all have their collective fingers crossed in coming weeks as the advent of chip cards approaches.
This story, "What you need to know about chip-embedded credit cards" was originally published by Computerworld.