New microchip-enabled credit cards could still be vulnerable to exploitation.
Now that the EMV deadline has come and gone, merchants have been upgrading technology to accept the new EMV payment cards. But the FBI has issued a strong warning that the new microchip-enabled credit cards should be supported with PIN authentication to help prevent fraud. The warning states that “While EMV cards offer enhanced security, the FBI is warning law enforcement, merchants, and the general public that no one technology eliminates fraud and cybercriminals will continue to look for opportunities to steal payment information.”
Although EMV cards do provide greater levels of security than traditional magnetic strip cards, the FBI reminds users that the chip does not prevent the use of lost or stolen cards in stores or for online or telephone purchases in card-not-present transactions. Data on the magnetic strip of an EMV card can also be stolen if merchants have not yet upgraded to EMV terminals and it becomes infected with data-capturing malware. The FBI is urging consumers to use the EMV feature of their credit cards whenever possible to reduce exposure of sensitive data.
The FBI is also encouraging merchants to approach EMV card transactions and their accompanying data with the same security precautions they used for standard credit cards, as well as urging the adoption of additional security measures for sales completed via telephone or Internet to insure that the cards and users are authentic. The FBI warning stated, “At a minimum, merchants should use secure servers and payment links for all Internet transactions with credit and debit cards, and information should be encrypted, if possible, to avert hackers from compromising card information provided by consumers. Credit card information taken over the phone or through online means should be protected by the retailer to include encrypting digital information and securely disposing written credit card information.”
Most banks issuing chip cards have argued that PINS are an unnecessary line of defense for the new cards. VISA continues to contend that “it’s the chip, not the PIN” that is essential for card security.
“Retailers have long-argued that PINs are essential to providing cardholders with the security that they deserve,” Brian Dodge, executive vice president of the Retail Industry Leaders Association, said in a statement. “The FBI’s alert should be a wake-up call to the banks and card networks that continue to stand in the way of making PIN authentication the standard in the U.S. just as it has been around the world for years.”
“Retailers have invested billions to implement new chip-enabled card readers in stores nationwide. Now, retailers are asking banks and credit unions to meet that commitment by issuing new chip cards with PINs,” Dodge said.
RILA said in a statement that, “It is high time for banks and credit unions to heed the words of both the FBI and the Federal Reserve and issue consumers the most secure standard of payment—chip-and-PIN cards.”
The FBI’s “warning states what retailers have been saying all along, which is that the new chip cards issued by banks need an accompanying PIN. Retailers have consistently urged banks and credit unions to ditch the signature and adopt the PIN. US banks and credit unions have argued that the chip is enough, and will prevent counterfeit charges from being made,” according to the RILA statement.
