Canada’s 6-Month Chip-and-PIN Delay Caused By “Very High (Transaction) Failure Rates,” Says RCC

Written by Frank Hayes and Evan Schuman
September 30th, 2010

Pushed by “very high (transaction) failure rates,” Visa and MasterCard have simultaneously granted Canadian retailers a six-month extension on a key Chip-and-PIN move. The change was announced just weeks before the card brands planned to shift a critical liability. That liability would have made retailers fully accountable for fraud if they chose to not use the card chips and to instead use the older mag-stripe.

The delay is quite significant. Following the U.K.’s shift to Chip-and-PIN back in 2004, Canada’s efforts have been watched closely by retailers in other countries—especially the U.S.—where Wal-Mart has been strongly pushing for national adoption.

Critics of Chip-and-PIN have raised questions about whether EMV is honestly that much more secure than mag-stripe. These concerns mushroomed back in February when a Cambridge University report publicly detailed many security holes in the current implementation.

Even worse, some have suggested the U.S. shouldn’t embrace Chip-and-PIN because it will likely be years-beyond-obsolete by the time it’s fully launched. The U.K., one of the world’s earliest adopters, took less than three years for full deployment—from its May 2003 Northampton initial trial to the January 2005 liability shift. In Canada, which is more similar to the U.S. (although it’s still much smaller), it has taken seven years and it’s still not ready.

Even if the U.S. announced that it would move to Chip-and-PIN in October—and there are no indications that any such announcement is imminent—it’s unlikely the technology could be fully deployed for more than a decade. Critics question how meaningful Chip-and-PIN would likely be to the retail security environment of late 2020.

When Visa and MasterCard separately announced the six-month delay on Friday (Sept. 24), they explained the identical move differently. MasterCard Canada’s statement said the delay was “in response to Canadian market dynamics” and that it was a “six-month extension for Canadian merchants to migrate to Chip-and-PIN point-of-sale technology.”

“The original timeline of October 15, 2010, is now extended to March 31, 2011, at which time MasterCard accepting merchants who have not upgraded to chip-enabled point-of-sale terminals will be liable for fraudulent transactions effected at their points-of-sale,” the statement said.

The MasterCard statement also quoted Oliver Manahan, the brand’s advanced payments VP: “While many merchants have already made the investment in migrating to chip, MasterCard heard through on-going dialogue that some merchants need more time to upgrade their point-of-sale terminals to accept chip-enabled cards. In response, MasterCard is extending the timeline to give them more time to make the necessary infrastructure upgrades.”


4 Comments | Read Canada’s 6-Month Chip-and-PIN Delay Caused By “Very High (Transaction) Failure Rates,” Says RCC

  1. Daniel Beaudoin Says:

    How come you do not talk about France’s experience with that type of cards? They have been the ones coming up with the chip and been using it since the 80s. I think it is very reassuring that when you go to a restaurant for example you do not have to loose your card from your site when paying as it happens here but the waiter comes to the table with the reader.
    Why do we have to reinvent things all the time just like healthcare?

  2. Catherine Johnston Says:

    EMV transactions are processed daily around the world. Given the goal of increasing systemic security, taking the time to investigate the reported problem is prudent. Also, to put it into context, we are changing an entire country’s payment system at the point of sale and that takes significant time. This six month extension is only 1/12th of the initial time lines.

  3. interested observer Says:

    The technical difficulties along with the rule ambiguities mentioned by Mike Beazley will create further groundswell for delaying the liability shift. If the card schemes would simply reduce interchange fees for chip-and-pin transactions, everyone would be pushing their IT staff to convert asap. Won’t the reduced income from reduced fees be more than offset by the inevitable reduction in fraud? If not, why are we being told to convert?

  4. John Holtermann Says:

    We recently returned from a trip to the United Kingdom and discovered, much to our surprise, many retail operations that would not accept our American credit cards because they were not “Chip and PIN” cards. This was particularly true in grocery stores, but also ran into it at one large department store in Ireland. As more organizations take this position you have to wonder what will happen to travel to Europe if Americans can’t use the debit/credit cards!


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.