Retailers who missed chip card deadline eye lawsuit

Walmart is well ahead on chip credit cards, but still doesn’t take chip debit cards

walmart registers
Mike Mozart (Creative Commons BY or BY-SA)

U.S. retailers are contemplating lawsuits against banks and credit card companies over the slow rollout of chip-based card technology and the possible financial liability merchants began facing that started Oct. 1.

Retailers that did not install newer chip-enabled point of sale terminals in stores, restaurants and hotels as of Oct. 1 have to pay an extra fee to cover counterfeit fraud. Before Thursday, banks were liable for consumers' use of magnetic stripe credit and debit cards. The liability shift deadline on Oct. 1 was set by banks four years ago to prompt the use of more secure chip technology to help lower the cost of fraud.

The passing of the Thursday deadline didn't apparently cause any significant problems for store operations, according to comments from five national retail and credit card officials. That's partly because consumers can still use magnetic stripe cards and might not even possess the newer chip cards.

For merchants, the situation is often more dire. Many retailers -- with the notable exceptions of Walmart and some other big chains -- have complained of backlogs of six to nine months in getting card companies to certify their new card terminals for use. Without the certification, retailers can't use their new chip card payment terminals and face extra costs for fraud insurance.

The backlog is unfair to retailers, and is likely to lead to a lawsuit by one or more of the affected merchants, said Mark Horwedel, CEO of Merchant Advisory Group. MAG has 97 members, including some of the nation's largest retailers, that collectively represent $2.6 trillion in annual sales.

"We've been the leading complainer about how the card brands are implementing [chip] cards in the U.S.," Horwedel said in an interview. Card providers and banks "picked the Oct. 1 date without providing a blueprint to merchants on how to process debit transactions with chip cards."

Even though the Oct. 1 date was announced four years ago, it took until last year for banks and card companies to create and clarify specifications for processing chip debit cards, which forced a backlog in seeking terminal certifications, Horwedel said.

Banks and credit-card issues "said you have to do this conversion by this Oct. 1 date and did not give directions on how to do it and dragged their feet and didn't get a plan underway soon enough," Horwedel said. The chip conversion expense was "shoved down retailers' throats... This change [in debit processing] is why there's a backlog. I'm not a lawyer but that factor could be the subject of a lawsuit."

Horwedel added: "Some retailers, especially the smaller ones, are mad as hell about the chip conversion. They are saying things like, 'I helped bail out these big banks in 2008 and now I'm getting their bill for this.'"

He explained that when the specifications for using debit chip cards first were announced four years ago, merchants were forced to pick one debit card processor instead of having the two processor choices that were previously allowed with magnetic stripe cards.

The threat of a merchant lawsuit against banks and card companies is nothing new.

Big merchants have battled Visa and MasterCard in the courts over the costs for credit and debit card processing costs for years, going back to at least 1996, after which credit card companies paid a group of large retailers $3 billion in an antitrust settlement in 2003.

Officials at Visa and MasterCard didn't comment on the possibility of a new lawsuit. But a spokeswoman from MasterCard did say in an email, when asked about possible legal action,: "MasterCard reiterates that security is not a destination; it's a journey, and the evolution to chip technology won't happen overnight."

Walmart's been prepping for chip cards for nine years

Walmart said Thursday it has been processing chip credit cards -- but not chip debit cards -- since last November when thousands of terminals in 4,600 stores had been converted. The process started nine years ago, said Walmart spokesman Randy Hargrove in an interview, because the company does business in other countries that are already using chip cards and saw the trend coming to the U.S.

"We've been well ahead of the game on this," he said. The retail chain posted a blog Thursday with a video explaining how to insert a chip card into one of its terminals.

While Walmart has already had the ability to accept chip credit cards, it still has not yet turned on the ability to accept chip debit cards. (A Computerworld reporter tested a chip debit card recently at a Walmart in Harrisonburg, Va., and it failed to work on three tries, although the card did function when used as a traditional magnetic-stripe card.) Hargrove said the debit capability will be possible later this year, but didn't specify a date. "Debit cards are coming soon," he promised.

Walmart also supports heightening chip card security with the additional use of a PIN supplied by customers. Earlier this week, Visa officials argued against the use of PIN, saying use of chip cards with a customer's signature instead of a PIN is the growing trend in Europe and Canada, contrary to the findings of many U.S. retailers.

Analysts expect merchant lawsuits

While Walmart seems to be on top of the chip card conversion, MAG and analysts have said there are many large, medium and small businesses that are not ready.

Given the complexity of the conversion and concerns about fairness with liability, lawsuits seem inevitable, analysts said.

"There's no shortage of animosity and confusion by retailers, although I haven't heard of anything specific with another lawsuit by retailers against Visa and MasterCard," said Avivah Litan, an analyst at Gartner.

Any lawsuits are most likely to come from retailers smaller than the biggest 10 chains. Big hotels, mid-sized merchants and big restaurant chains are the most likely to bring lawsuits, she said.

She agreed with Horwedel and others in retail that the backlog in certifications has been unfair for retailers and was caused by the card companies' delays in setting debit chip-card processing specifications. "That's completely unfair that merchants should be liable for the lag time caused by card providers and I'd imagine the merchants would win damages," she said.

Jordan McKee, an analyst at 451 Research, agreed that lawsuits will come. "The liability shift certainly hasn't helped to ease already uncomfortable tensions between retailers" and banks and card providers, he said. "As has long been the case in this industry, lawsuits are seemingly inevitable."

This story, "Retailers who missed chip card deadline eye lawsuit" was originally published by Computerworld.

Copyright © 2015 IDG Communications, Inc.

7 hot cybersecurity trends (and 2 going cold)