Visa’s Chip-And-No-PIN Plans For The U.S. Making Some Nervous

Written by Frank Hayes and Evan Schuman
January 19th, 2012

With Visa’s clarification on January 13 that its U.S. EMV deployments will include Chip-and-no-PIN, retailers are trying to decide if this is a good thing or a bad thing. On the good side, the move should certainly make it easier for consumers to use EMV cards and have it feel almost exactly like using magstripe cards. On the bad side, this forces retailers to immediately trust the chip technology perhaps a bit more than they want to.

William Titus, the Loss Prevention VP at Sears, wasn’t overjoyed at the prospect of deploying Chip-sans-PIN, whether it’s on the card directly or embedded into a consumer’s mobile device.

“When I think about secondary validation, that gives me more of a warm fuzzy even though we have people saying that I have a more sophisticated chip and that my smart device has got some protection sitting in it,” Titus said. “I’m really very comfortable and, quite honestly, Europe and everybody else is using Chip-and-PIN. It’s just another step in providing more secure data.”

Actually, although Chip-and-PIN is popular in Europe, PIN-less in Europe certainly exists. PIN-mandating countries in Europe include Belgium, Estonia, France, Finland, France, Ireland, Netherlands, Norway, Poland, Slovakia, Sweden and the UK. Euro countries that are not mandating PIN include Spain, Portugal, Italy, Turkey, Germany and Russia.

In Asia, Japan mandates PIN, China does not mandate PIN and Malaysia doesn’t mandate PIN but it’s slated to start mandating it after 2015. Much of the rest of Asia is mostly signature. New Zealand, India and Australia are all in the PIN optional camps.

In North America, the U.S. is surrounded with a split decision. Northern POS in Canada mandate PIN and Southern POS in Mexico are PIN optional.

In the Visa statement, Visa’s head of authentication product integration, Stephanie Ericksen, said the technology that the U.S. will be deploying makes the PINs unnecessary.

“That’s because, in the U.S., we can rely on online processing where transactions are transmitted in real time to the issuer for approval. With that in place, there’s no need for the offline authentication that was the genesis of Chip-and-PIN,” she said, adding: “As a late adopter of EMV, there’s a great upside for the industry in the U.S., because we can avoid much of the cost and complexity involved in deploying older generation chip cards, while still reaping all of the benefits of reduced counterfeit fraud.”

As a practical matter, though, getting consumers to embrace EMV—unlike, say, how U.S. consumers never even remotely warmed to contactless payment—is all about minimizing any required behavioral changes. And if the transaction can be accelerated at the same time, all the better.

Visa stresses that this can all happen gradually.

“Visa will continue to support a range of cardholder verification methods (CVMs) with EMV chip, including signature, online PIN and no-signature for low-value, low-risk transactions,” Ericksen said. “In the longer term, we expect the industry will reduce or even eliminate its use of static verification methods, such as signature and PIN in favor of new and dynamic forms of cardholder verification.”


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.