October 1, 2015 was the deadline for the transition of financial responsibility surrounding credit card fraud and breaches. A recent Software Advice study found that some 80 percent of small to midsized retailers had not yet adopted EMV-ready systems as of mid-September, and nearly a quarter of non-compliant retailers believe that EMV is “unnecessary.” Additionally, almost two-thirds of consumers have not yet been issued EMV cards.
That may leave a number of questions about EMV-ready systems and their impact on retail. Mike Buratowski, VP of Cybersecurity Services at Fidelis Cybersecurity provides some insight into the switch and its repercussions.
Of course, most retailers who embrace the EMV system believe that it should curb credit card breaches. But as Buratowski explained in an email, “"Unfortunately, switching to chip enabled cards won't curb credit card breaches, but what it may do is reduce the amount of credit card numbers that can be used after the data is stolen. What this means is if a million credit cards are stolen, there will be a percentage of them that will not be able to be used to commit a fraudulent transaction.”
According to Buratowski, EMV is just the first step to making credit card transactions more secure. While chip enabled cards will make a significant dent in the fraudulent "cloning" of traditional magnetic strip cards and make it substantially more difficult to manufacture cards that can be presented in person, they only help prevent fraud when used in conjunction with merchants who only accept chip enabled cards.
He explained, “Many companies may not upgrade their equipment due to the cost and a perceived lack of risk. The new EMV cards will continue to have the magnetic strip that will allow the consumer to still use the card. Additionally, most cards will still only require the presenter to provide a signature to complete the transaction. While this is a good first step, the switch will not address fraudulent transactions done online or other ‘Card Not Present’ transactions.”
Another crucial piece of the security equation is the introduction and use of 2-factor authentication such as a PIN or other identification factor. According to Buratowski, “Multi-factor authentication has been urged by the security community for some time. Most of the time "two factor" authentication is discussed. The factors used fall in to three main categories. Something you have, such as the chip enabled card, something you know, such as a PIN, or something you are, like a fingerprint. By rolling out the EMV cards and not implementing another factor, the industry is missing an opportunity to implement much stronger security. Using the EMV card and the signature of the presenter is still essentially a single factor authentication. Most retailers don't check the signature or compare it to a form of ID such as a driver’s license."
And while Chip enabled cards have enjoyed some success in Europe, cutting down on counterfeit card transaction, there has also been a marked increase in “card not present” transactions. That means that “the malicious actors who commit these types of crimes are determined and resourceful. We need to be bold in our efforts to implement better security for payment cards. Taking half steps will not solve this problem," Buratowski asserted.
