In theory, the war to combat credit-card fraud escalated significantly this month with the rollout of new cards containing embedded microchips and pay terminals that can read them.
Consumers should now be using the new cards for their purchases, and when they shop, retailers should have new devices at their cash registers to read the chip-enhanced plastic whose technology makes counterfeiting nearly impossible.
Again, in theory.
The reality is that despite an Oct. 1 target to get the so-called EMV cards — which stands for Europay Mastercard, Visa — into the hands of consumers and the updated readers into stores, the going has been slow for both.
“It’s certainly a mixed-bag everywhere. I think that’s safe to say,” said Matt Schulz, senior industry analyst for CreditCards.com, a website that helps consumers compare credit-card offers.
“From the merchant side, it’s kind of all over the place. I’ve seen some estimates that say only 5 to 10 percent of merchants have EMV terminals now. And I’ve seen others that said it’s 20 to 25 percent,” Mr. Schulz said. “My thinking is the truth might lie somewhere in between.”
The rollout of the cards themselves has been slow too. A recent CreditCards.com survey found that just 40 percent of American credit-card holders have a EMV cards.
“That’s a pretty low number. I think it’s pretty clear that the banks and the merchants have a long way to go when it comes to EMV cards,” Mr. Schulz said.
The problem is one of cost, but also, perhaps, caution on the part of retailers and financial institutions that issue credit cards to their customers.
Upgrading to EMV technology is expensive and time-consuming, and neither side wants to commit fully to upgrades if the other side isn’t willing to do so.
The reward for upgrading is the chance to reduce the estimated $5.5 billion in annual credit-card fraud. The deadline was intended to serve as a nudge — after Oct. 1 the liability for fraud shifts to whichever party, merchant or credit-card issuer, has the inferior technology.
Major players such as Target, Home Depot, Walgreens, and Costco have been leading the change to install EMV reading terminals. Home Depot, for example, said it now has EMV technology in all of its 2,250 locations.
Other large retailers also are scrambling to upgrade.
Kroger, for example, has EMV readers in many of its 2,600 stores, and a spokesman said it “will continue transitioning through the fall and winter months” to complete the changeover.
But locally, many independent merchants and smaller chains have been slow to implement the change.
In most cases, the decision to upgrade hinges on whether the cost to upgrade outweighs the risk of not upgrading.
Bob Lubell, owner of Grand Lubell Photography in Sylvania, said that for his business EMV technology isn’t worth the cost.
“I’m just plain ignoring it. I just don’t see the point,” Mr. Lubell said. “Supposedly I have a higher liability, but I think I know my clients. So I’m gonna take the risk that my clients aren’t going to use phony credit cards.”
An EMV pay terminal costs about $700 to purchase and install.
That may not seem like much, but for a small chain with lots of pay terminals, it’s a sizable investment.
Bill Gase, vice president and controller at Tireman Inc. auto centers, which has 19 locations in the area, said his cost to add EMV terminals will exceed $50,000.
The expense has given the company pause to ponder: How soon do we really need this?
“I think a lot of the fraudulent activity is on Internet transactions. It’s not coming into our store with someone using a phony credit card to buy a set of tires,” Mr. Gase said.
But Tireman hasn’t been free from fraud.
“We’ve had some people hit us with fraudulent cards,” Mr. Gase said. “I guess it really gets down to can the chips be counterfeited? If they can be counterfeited then the cards are worthless. My fear is that two or three years from now we could be right back in the same boat we are in today.”
Still, Mr. Gase said Tireman will add EMV, just not immediately. He’s willing to accept the short-term liability, he said.
“We’ll make the decision most likely to get the readers in the future. We can’t say we’ll have them this year,” Mr. Gase said. “Next year, probably, and a few stores at a time. But the liability is great when you put it on the company.”
Frank Viviano, owner of Bartz Viviano Flowers, said he also is in no rush to add chip-reading technology. “We’re relying on our [point of sale] vendor to supply us with that. We’ll pretty much have to wait until they come out with it,” he said. That will likely be six months, he added.
But like Mr. Gase, Mr. Viviano isn’t sure EMV is worth the extra expense for his business.
“For us, [credit card fraud] is not a huge issue because most of our credit-card transactions are not done with credit cards in hand. They’re taken over the phone, so the chip isn’t much help,” he said.
Mr. Viviano said his stores have caught people attempting to use fraudulent credit cards in the past, but fraud has been a rare occurrence.
“If someone steals a credit card and it goes through, then it’s going to be on us. But most people aren’t interested in stealing a credit card to steal flowers.”
For the financial institutions, which had been bearing all of the liability, the Oct. 1 target was a chance to reduce that liability by issuing EMV chip cards as quickly as possible.
But Martin Sutter, president of Genoa Bank, said the goal of his bank is to implement EMV correctly, not quickly. Genoa Bank is looking at issuing EMV cards early next year to its 2,000 card holders.
“Oct. 1 wasn’t a deadline. All it meant is that the liability shifted. The game changed, and you needed to be in a position with the EMV so you could determine how to proceed. You may, as a company, accept more liability or less liability,” he said.
“I don’t want to rush. I want to do it right. We said, ‘We have the liability now, so lets make sure we’re doing it right and not jump to the first thing out there,” Mr. Sutter said.
Barry Shaner, president and chief executive officer of Directions credit union, said as for retailers, cost is an issue for financial institutions.
A standard magnetic stripe card is about $1.50; an EMV chip card nearly $4. After the cost of mailing and processing, Directions will incur about $5 to issue a traditional mag-stripe card but about $9 per chip-equipped card.
“When you’re looking at 50,000 pieces of plastic to reissue, debit and credit, it’s not cheap,” Mr. Shaner said. “However, the fraud is the bigger bill.”
But Mr. Shaner said EMV should help stop much of that.
“It should eliminate the fraud that occurs as a result of someone making a copy of your card and going to Best Buy and buying a big TV. That should be almost impossible going forward,” Mr. Shaner said.
That extra protection is why some local merchants see the expense as worthwhile.
“You gotta have it. You definitely have to have it,” said Tom Shea, general manager of Joseph’s Beverage Center in Toledo.
“Honestly, in the past it’s just been a minimal amount of bad [transactions], but we were always protected. As long as we had the card in hand, the credit-card company always absorbed the losses. But now they won’t,” Mr. Shea said.
Local J. Foster Jewelers and Pandora stores had EMV terminals installed in June. But the terminals haven’t had much use, owner Phil Kajca said.
“Other than American Express, we’re not seeing any cards with chips on them yet,” he said.
As a practical matter, cases of in-store fraud at his stores have been negligible, the jeweler said.
“To me, [EMV] is a waste because the consumer can still dispute the charge, and I still have to prove that that consumer was in my store making the fraudulent purchase,” Mr. Kajca said.
Plus, EMV doesn’t eliminate the biggest fraud threat — online transactions, he said.
Attempts by criminals to make online credit-card transactions became so pervasive the last several years that Mr. Kajca eventually eliminated all online sales on his J. Foster website.
“Most of the larger sales by people using our website were people trying to use fraudulent credit cards. So we disabled that aspect,” Mr. Kajca said.
Contact Jon Chavez at: jchavez@theblade.com or 419-724-6128.
First Published October 11, 2015, 4:00 a.m.
