EMV: Where the Merchants Are
Big and small merchants are handling the shift to chip cards, but mid-sized merchants are lagging—and retail groups are pointing fingers
By Ed McKinley
Some of the nation’s largest and smallest merchants were prepared to accept chip cards by October 1, the date when liability for fraudulent EMV payment transactions shifted to them. It’s the medium-sized businesses that continue to struggle with tech problems, according to multiple industry players with a stake in payments issues.
The big players—Walmart and Target come to mind—had enough resources and market power to make the transition. Some had already experienced the shift in other countries. In addition, the biggest had their own IT departments and didn’t have to rely too much on third-party vendors. When they did have to go outside for help, they had the financial clout to jump to the head of the line. Meanwhile, small merchants that didn’t have sophisticated POS systems were able to simply obtain a new card reader or reprogram the unit already sitting on the counter. Many businesses with just one or a few locations could even persuade their acquirers or ISOs to provide the new equipment at little or no cost because of competitive pressure.
But most of the merchants in the middle—think of regional supermarket chains or pizza parlors with five locations scattered around town—have neither the resources of the big players nor the simplicity of the small players. As a result, medium-sized players have been caught unprepared for chip cards. They haven’t been able to integrate transactions with their loyalty programs, inventory control, payroll, and employee scheduling.
Lumped together, 37 percent of the nation’s small, medium-sized, and large merchants had EMV terminals by January 2016, according to Jared Drieling, business intelligence manager for The Strawhecker Group, a payments consulting firm. Based on the firm’s research, he has projected that half would have them by June of this year and three quarters by year’s end. Those percentages are based on quarterly surveys The Strawhecker Group has been conducting for about a year with 92 companies, mostly acquirers, ISOs, and industry service providers (ISPs), Drieling says. The respondents work with 4 million merchants—about half of the 8 million American merchants that accept electronic payments, he notes.
However, as Drieling explains, those numbers tell only part of the story. That’s because the surveys count all the terminals that are capable of accepting EMV transactions but have not necessarily been activated or certified to receive those transactions, he notes. In other words, the terminals could handle chip card purchases but may not be doing it.
Barriers to EMV
A number of hurdles are preventing some retailers from switching to EMV. For many merchants, Drieling predicts those problems may continue in the months ahead because they arise from what he views as a variety of sources.
First, as demand outpaces supply, retailers may have trouble obtaining terminals capable of handling EMV cards. “Right now, there’s a rush of merchants trying to get their hands on EMV terminals,” Drieling observes. “Even if they’ve made the decision to now migrate to EMV, they’ve reached out to their acquiring partner or terminal vendor and been placed in a queue.”
What’s more, a lot of independent middleware providers are overworked, and some processors simply aren’t ready to certify the terminals and other parts of the POS systems, Drieling explains. Stated another way, demand for certification services has grown larger than supply. “They’ve gotten their hands on the hardware, and then they’re thrown into another queue” for certification, he says of merchants laboring to accept EMV. “Imagine the frustration.”
Staff training represents a third hurdle in merchants’ EMV transition, according to Drieling. Even some large retailers that got their EMV-related equipment working early have failed to teach employees to use it. “In some cases, the staff will instruct you to just go ahead and swipe the card,” he notes.
Drieling also thinks that a lot of merchants simply got a late start on EMV because they didn’t believe the card networks would adhere to their timetable for the transition. “There was a feeling in the merchant community, and the merchant acquiring community, that this may be pushed back,” he says. “Why do this right before the holidays?”
Whatever challenges merchants have faced in making the switch to EMV, those who still can’t accept chip cards now have to shoulder the liability for any fraudulent transaction that EMV could have prevented, observes Mark Horwedel, CEO of the Merchant Advisory Group, a payments-oriented association of retailers that includes 19 of the nation’s 20 largest merchants.
High-Voltage Chargebacks
As a result of the shift, chargebacks to retailers have doubled on average, and some retailers have seen fivefold increases, according to members of ETA’s Risk, Fraud, and Security Council. That new burden has come as a shock to many merchants. Horwedel explains that merchants legitimately didn’t know the volume of chargebacks they could expect with the liability shift because the issuers and cards brands didn’t publicize the numbers in advance.
A restaurant owner, for example, might have known about two chargebacks to her business in the course of a year while unknowingly accepting another 500 fraudulent transactions during that period. Until the liability shift, issuers were dealing with the problem. That failure to comprehend the scope of chargebacks may have led some retailers into postponing action on EMV. On the other hand, perhaps they should have known what was in store for them. EVO Payments International, for example, was receiving reports from Visa and MasterCard before the shift that detailed its fraud cases, says Domnico Cirone, the company’s vice president of chargeback processing.
Either way, the sudden increase in chargebacks after the shift has been large enough to lead some retailers to claim that issuers are using their new ability to issue chargebacks that aren’t eligible for the liability shift, says Andy Pitts, president of MLS Direct, an Austin, Texas-based ISO.
Council members, however, do not believe this is happening. “We investigated hundreds and hundreds of cases of issuer abuse, and every single case we looked at was a stolen or counterfeit card,” says one member who specializes in loss prevention for a major processor. In one case, a restaurant owner insisted that the cardholder was an excellent customer who had frequented his establishment for five years and that the chargeback must therefore be false. The processor asked the restaurateur for receipts and found the names on the cards and receipts didn’t match. The customer’s “good reputation” was based on counterfeit or stolen cards.
Moreover, the chargebacks don’t make sense as a business model because they wouldn’t bring adequate return on investment over a $5 tab, say council members. While inconsistencies may occur, they are not the rule. Moreover, federal regulators would apprehend issuers indulging in such practices, says Cirone.
At the same time, retailers are reacting to chargebacks according to their individual circumstances. Criminals often use cards fraudulently to make off with pricey jewelry or big-ticket flat-screen TVs, and retailers in those high-risk categories long ago saw the value in becoming proactive with switching to EMV, notes Drieling. But those retailers are still experiencing “heartburn” as they learn the fundamentals of chargeback management. Merchants win about 60 percent of the time when they dispute chargebacks, he maintains.
Attention to detail can neutralize a lot of chargebacks, Cirone says. It often comes down to a consumer checking two contradictory boxes on a form or an issuer committing some other type of error in the paperwork, he says. Preventing fraud itself also prevents chargebacks, Cirone points out. For example, software should prompt a cashier when a card without a chip has data in its magnetic stripe indicating that it should have a chip. That card has just been identified as counterfeit, he notes.
Where Chargebacks Arise
The retail category experiencing the highest number of chargebacks these days is petroleum, but the fraud is occurring inside the stores, not at the pumps. Next on the list is bars and restaurants, followed by vending machines. While fraud at vending machines might seem surprising, it happens because thieves are testing fraudulent cards in the machines, not just stealing a soft drink.
Because they are not making off with big-ticket items, perpetrators may think paying for a meal or drinks with a bogus card is a victimless crime, says Cirone. In fact, hackers on college campuses sometimes sell fraudulent cards for $5 each, resulting in a rash of almost “free” restaurant and bar binges. Besides feeling the theft of dinner and drinks ranks as a mere prank, students know they’re less likely to face the consequences of their actions in a restaurant than they are in an electronics store packed with surveillance cameras and security personnel, notes Cirone.
As higher-risk retailers improve their responses to fraud through EMV, some perpetrators of fraud are moving downmarket to grocery stores and fast-food restaurants, according to Drieling. Even for small-ticket merchants, the cost of chargebacks can mount up over time, he says. Other merchants, such as a one-off corner shop selling coffee and donuts, don’t have much exposure and their fraud losses wouldn’t justify upgrading to EMV-compliant systems, says Craig Shearman, vice president for government affairs public relations for the National Retail Federation.
Chip, PIN, and More
Sources from various merchant groups say the use of chip and signature instead of chip and PIN continues to be a hot-button topic for merchants. The point of contention centers on the decision to not require PIN in the United States. Chip cards and PINs each address a different type of fraud, according to SellSafeInfo.org, a consumer-facing website of the ETA. With or without a PIN, chip cards prevent counterfeit fraud while the PIN prevents lost and stolen fraud. In 2014, counterfeit fraud accounted for $3 billion in losses, while lost/stolen fraud accounted for $800 million, according to data from Aite Group reported by Statista.
While proponents of chip and PIN EMV cards contend that most of the world uses that system instead of chip and signature, Drieling says that is a misconception. “When we look at EMV adoption around the globe, it’s almost evenly split between PIN and sig,” he contends. Signature prevails in Spain, Italy, Portugal, Germany, Turkey, and most of Southeast Asia, while chip and PIN holds sway in Canada, the United Kingdom, Ireland, and France.
Ultimately, Shearman predicts that consumer demand for PIN might persuade issuers to change their preference. If one big bank made the change and marketed its PIN cards effectively, competition could push others to follow suit, he says.
But reissuing EMV chip and signature cards as chip and PIN doesn’t strike Drieling as likely because of the expense. The issuers say they chose signature because some merchants don’t have PIN pads and because some consumers might find entering a PIN too much of a change from signing their name. Their opponents, however, note that consumers are already accustomed to punching in PINs when using debit cards.
Another concern is that the banks and card brands didn’t spend enough to familiarize consumers with EMV, Horwedel claims. In addition, plans for debit card transactions weren’t decided until so late in the EMV transition that retailers had little chance to get ready for the two-option approach to routing, Horwedel complains.
However retailers feel about EMV, the technology seems certain to proliferate and in the process become less problematic. Yet, sources agree that as the perpetrators of fraud become more sophisticated, the way the industry uses EMV will change to meet the new challenges.
Ed McKinley is a contributing writer to Transaction Trends. Reach him at [email protected].