Getting Ready for EMV
Converting to chip cards is one way CUs will bolster card security.
Oct. 1, 2015, will be a pivotal date for credit unions and other financial institutions, card processors, and retailers. That’s when the major card companies will implement a “liability shift ” for point-of-sale card purchases. To prepare, most credit unions with card programs are converting to the EMV (Europay, MasterCard, and Visa) chip standard.
The U.S. is one of the last countries to convert to this global standard, which originated in 1994. EMV cards have considerably curtailed fraud in card present transactions in Europe, Australia, Brazil, and Canada, among other countries, and could cut losses by 40-60% in the U.S., according to PSCU, a card services provider.
The October date means that responsibility for losses in domestic point-of-sale transactions will shift to the “least secure” entity—for example, card issuers if the merchant device is EMV-compliant and issuers’ cards aren’t. Other deadlines related to the EMV chip standard will follow.
EMV isn’t a panacea for fraud—it doesn’t address card-not-present and online transactions—but it’s a more secure format than magnetic stripe cards for several reasons, according to EMV Connection:
• The embedded microprocessor chip stores information securely, performs cryptographic processing during a transaction, and carries security credentials the card issuer encodes at personalization. These credentials prevent card skimming and card cloning.
• The card is authenticated and the cardholder is verified during EMV transactions. Those steps guard against unauthorized transactions using lost or stolen cards.
• EMV transactions create dynamic data, so fraudsters can’t use captured data to execute additional transactions.
Four stages of readiness
Credit unions fall into four stages of readiness in converting to the EMV standard, including:
1. Early adoption. That includes credit unions such as $4 billion asset United Nations Federal Credit Union in Long Island City, N.Y. It began issuing EMV cards years ago to serve its membership, which relies on smartcard technology when traveling abroad.
2. Staggered migration. The $456 million asset Sun Federal Credit Union in Toledo, Ohio, and $87 million asset Georgetown (S.C.) Kraft Credit Union are among those implementing phased rollouts, either already in progress or starting early this year. Many credit unions have staggered credit and debit release depending on which poses more fraud risk for their members.
3. Strategy development. Credit unions such as $27 million asset PA HealthCare Credit Union in Sewickley, Pa., have yet to finalize EMV conversion details. They’re waiting on production timelines or pricing options from vendors, so their conversions will extend beyond the liability shift date.
4. Wait-and-see. That label applies to as many as 31% of credit unions that don’t plan to convert to EMV in the next two years, according to CUNA’s 2014 Technology Spending Survey. That’s either because the credit unions have limited fraud risk—as is the case at $13 million asset North East (Pa.) Welch Credit Union, which suffered just $85 in fraud losses in 2014—or they have limited resources.
Compared with major banks, “credit unions are behind on issuing and converting cards to the EMV format,” Russell Palmer, card services manager at Spokane (Wash.) Teachers Credit Union, says in a new CUNA Operations, Sales & Service white paper. The $1.9 billion asset credit union released EMV-enabled credit cards to its international travelers, and plans to reissue all cards in that format this summer.
Less than 5% of credit unions have completed the conversion, and more than half likely will miss the liability shift deadline, according to payment processing firms. But by year-end 2015, the Aite Group estimates 70% of credit cards and 41% of debit cards issued in the U.S. by all financial services institutions will be EMV-enabled.
“It’s still early in the adoption process for the U.S., with a small but growing percentage of issuers using EMV,” says Michelle Thornton, manager of core products for CO-OP Financial Services.
The silver lining to a staggered migration? Credit unions that encounter obstacles can seek advice from those further down the road to EMV conversion, the white paper suggests.
“Other credit unions are in the same place, and others are ahead of and behind you. Reach out and learn from your peers,” says Dean Stewart, senior director of self-service product management at Diebold Inc., a CUNA Strategic Services alliance provider, in the white paper.
NEXT: The ‘Target’ effect
Although EMV wouldn’t have prevented last year’s high profile data breaches at Target and Home Depot, many credit unions adjusted conversion timelines to bolster card security and reassure members. For example:
• Georgetown Kraft Federal moved up its March 2014 start date for credit card conversion by two months so it could provide EMV cards immediately to members whose cards showed up on compromised lists, rather than reissue magnetic stripe cards.
• Andrews Federal Credit Union in Clinton, Md., with $1 billion in assets, began issuing EMV-enabled credit cards to all new accounts in September 2014 and will replace its entire portfolio by the first quarter of 2015.
• Sun Federal decided last year to fast-track conversion on its credit card portfolio by serving as an EMV pilot for its processor.
Notably, Sun Federal and Spokane Teachers have yet to finalize EMV conversion for debit cards, because the debit networks and Visa haven’t agreed yet on the platform. But both aim to complete their debit card issuance plan by October.
Currently, card issuers largely absorb point-of-sale counterfeit fraud losses at approximately 3 cents per swipe, according to CO-OP Financial Services. EMV aims to lessen that cost.
“The liability shift is an advantage and will assist in reducing card-present fraud,” says Dawn Krueger, vice president of operations for Sun Federal. “That’s a win win for the credit union and our members.”
Card designs and testing
Sun Federal’s project team, which included staff from operations and marketing, began the transition early last year. The credit union developed a new card design to accommodate the chip, and tested each prototype for EMV, swipe, ATM, and Internet transactions. The card producer then introduced a new chip, so the credit union soon will complete testing on the new technology, and begin issuing EMV credit cards this quarter.
“Our biggest investment has been our time,” Krueger says.
Of course, EMV conversion requires an initial and ongoing financial investment, too. The price of chip cards has been dropping but they still cost about 2.5 times as much as magnetic stripe cards. Sun Federal intends to offset some of that cost by extending card expirations by eight months. Also, during each EMV transaction, credit unions absorb a fractional transaction fee set by each processor.
The credit union’s marketing department adapted a Visa mailer that explains EMV’s security advantages and instructs members on the three-step “chip and dip” (no swipe) process required during a transaction. Members will receive the mailer with their smartcards. The credit union’s board members will be among the first to receive EMV cards.
“Our board members are highly engaged, and this year we educated them on the EMV advantages,” Krueger says.
Sun Federal also updated the ATM hardware and soft ware Diebold requires to process EMV transactions, even though staggered ATM liability shift s don’t start until 2016, with the majority in effect by October 2017. But the credit union must wait for its ATM processing vendor to complete the certification required to drive its EMV-enabled ATMs.
NEXT: Small CU challenges
CUNA Operations, Sales & Service Council:
Diebold, Inc., a CUNA Strategic Services alliance provider:
CO-OP Financial Services:
EMV Migration Forum:
The EMV conversion process remains daunting for many credit unions—particularly smaller ones with limited staff and financial resources to tackle a project of such scale and cost.
Paul Fero, CEO of PA HealthCare, appreciates providing members a tool that allows them to operate seamlessly while abroad. And after proactively reissuing about half of his card portfolio in 2014 to protect members whose accounts might have been compromised by various merchant breaches, he also knows the industry needs to find better ways to combat card fraud.
But EMV still isn’t a project he looks forward to. “It’s going to be expensive, time-consuming, and painful to implement and educate our members. And in the end, members will get a little better security protection.”
FIS, the card processor that serves PA HealthCare through the Pennsylvania Credit Union Association, estimates the credit union’s conversion will cost $20,000. The total cost exceeds other recent PA Health- Care investments that Fero believes carry more cache with members, such as mobile banking.
“Smaller financial institutions lose the economies of scale because of the large initial fixed cost,” Fero says. And for credit unions like his, that could mean the difference between profit or loss.
Fero typically is very busy in the first quarter, completing employee reviews and goals for his staff of four full-time employees and preparing for the credit union’s annual meeting. This year, he’s also tackling a server conversion.
So PA HealthCare won’t start the roughly six-month EMV transition process—which includes re-establishing reporting and processing systems— until spring.
This fall, the credit union plans to issue EMV chip cards in phases, starting with its heaviest users and its international travelers, per industry recommendations. PA HealthCare has a 2,200-card portfolio, of which 1,300 are credit cards.
Formal efforts to educate members about the changes will begin this summer, but Fero won’t pass up an opportunity to talk about the issue before then. He emphasizes to members that EMV won’t stop all fraud, but offers incremental security improvement while the payments landscape continues to evolve.
“If anything, we’ve seen that magnetic stripe technology isn’t the best way to do it,” Fero says. “Maybe EMV makes it a little bit better, and then we can try again.”