The technology that is touted as a credit card thief's worst enemy is here and is already in use, with Omaha at the epicenter of what is forecast to be the biggest shift in point-of-sale payments since the demise of the sliding manual card imprinter.
It is called chip technology, so named for the microchip processors embedded in the surface of new credit and debit cards — electronic wonders that carry all of the customer information now contained on the magnetic stripes on card posteriors. Chip info, however, is many times more difficult for thieves to copy, which industry experts say shields cardholder information in myriad ways the old magnetic stripes cannot.
U.S. consumers, retailers and card issuers hope the new chip-equipped cards, long popular in Europe, will thwart massive criminal use of customer information such as that at Target in December, when thieves purloined data from up to 110 million customers. Some of the card information was later found on counterfeit cards.
Issuers are already sending out chip-equipped cards when new cards are mailed to existing customers.
The technology is scheduled to become dominant by October 2015. The major card issuers have informed retailers that after that date the retailers are responsible for fraudulent purchases if they are using a card-reading technology inferior to the new chip standard. Up to now, card issuers have been responsible for refunding fraudulent purchase amounts to customers.
The switch won't be cheap. In the United States there are 9 million “cash points” — sales registers and similar points-of-sale — said Tom Litchford, vice president of retail technologies at the Washington-based National Retail Federation. Only 18 percent are equipped to read microchip cards.
The cost of new hardware, software, training and other goods and services required to get up to speed?
“We think it will be from $1,000 to $1,500 per terminal,” Litchford said. “We are talking about billions of dollars.”
Replacing cards compromised by fraud is also expensive. It has cost about $10 each to replace cards compromised by the Target breach, said Tom Crosson, a spokesman with the Consumer Bankers Association. That includes call center time and costs other than the plastic, he said. About 17.2million cards were replaced by card issuers related to Target, he said, at a cost of about $172 million.
Omaha's role in the shift toward chip-embedded debit and credit cards is indisputable. Omaha is home to one of the largest companies producing finished cards for banks and other issuers, First Data Corp., which is also the largest processor of electronic payments.
About 5,000 people work for First Data at offices and plants all over town, tracking balances for hundreds of card issuers and their customers, manufacturing cards and mailing statements. In Omaha alone, the Atlanta-based company produces more than 100 million debit and credit cards a year.
Also in town is First National Bank of Omaha, one of the dozen or so of the largest U.S. credit card issuers. Almost 45 years ago, First National was the first company to partner with stores and other banks for credit card collaborations.
The company now issues cards for 600 partners, from other banks to retailers such as Omaha's Scheels and national companies such as Detroit's Chrysler. The company has 3 million credit card accounts.
As the big change gets set to take effect, Omaha is at center stage, positioned to be a major part of the next big shift in point-of-sale payment technology. Remember the “knuckle-buster” of years past, so dubbed for the peril the sliding mechanism posed for hurried sales clerks as it made an ink-and-metal-plate impression of each credit card on a paper sales slip?
The new technology is also known as EMV, short for Europay-Mastercard-Visa, the main card issuers behind it. Europe gets a lot of kudos for earlier adoption of the technology. European nations began adopting the technology in the 1990s as European Union anti-fraud measures ramped up; France's anti-fraud agency says EMV has cut the most common type of card fraud by 80 percent. There are already about 1.6 billion cards in the world equipped with microprocessors.
The conversion to chip-equipped First National cards is underway. The company's First Bankcard division employs about 1,000 workers producing credit cards in the metro area.
“Starting this year, all replacement cards we send to our customers will be chip cards,” said Steve Eulie, president of First Bankcard. “We are currently in the process of starting work on building a new card-embossing facility in the Omaha area to meet demand. Omaha is where it's at.”
The new-era cards better safeguard customer information, Eulie said. Magnetic stripe cards are easy to counterfeit and embed with stolen account numbers; all it takes is easily obtained scanning devices to put stolen account numbers hacked from retailer databases or other sources onto blank hotel card keys, Eulie said.
Not so with chip cards. With them, the customer information is contained within the microchip, which is electronically locked and encrypted, or subject to a series of mathematical calculations that make digital information unreadable to unauthorized parties. Even if the customer information is stolen — which will not be easy, as it is encrypted while in transit across the electronic payment network — it cannot be cheaply and reliably transferred to a counterfeit card.
“Unlike a magnetic stripe card, it is virtually impossible to create a counterfeit EMV card that can be used to conduct an EMV payment transaction successfully,” reads a statement from the Smart Card Alliance, a coalition of companies dedicated to the technology.
The standard envisioned for October 2015 by most industry experts is “chip-and-PIN,” meaning a face-to-face transaction will require the insertion of a chip-equipped card into a reader, followed by the punching in of a PIN to authenticate, said Barry McCarthy, president of First Data's financial services division.
Other scenarios, he said, envision “chip-and-signature,” which requires the customer to sign after the card is read. Also available are touchless systems that will read card info the same way wireless devices work.
“Magnetic stripe technology is 40 years old,” McCarthy said. “The information on them is easy to steal, read and replicate.”
Chip-equipped cards are nothing new at First Data, which operates a plant in a quiet corner of Omaha that takes blank credit and debit cards delivered from manufacturers nationwide and turns them into purchasing power.
The plant produces 104 million cards a year for customers from American Express to small Midwestern furniture stores, seamlessly matching up blank cards with the proper name, account number, mailing envelope and personal details such as the photos of the family kitty or kids soccer games many folks now emblazon on their cards.
These days, the blank cards come already equipped with microchips, said Rick Burns, First Data's operations director at the factory.
“We have about 500 employees here,” he said. “And it is going to be a very busy time as the October 2015 deadline gets closer.”
The moneymakers at the plant are the card-embossing machines, hip-high tubes that stretch across the plant floor and resemble the overhead luggage compartments on passenger aircraft.
Inside, there are wonders. As blank cards move along a conveyor-type system in the machine, names and numbers get stamped in, via a link with computer servers containing the relevant info. A tiny mechanical hand gloms onto the chip, unlocks it and impregnates it with the data that, with a swipe, will be accepted worldwide for everything from groceries to concert tickets.
Eulie, the bank card president at First National, said there is nothing — not microchips, or anything else — that will stop all fraud. Criminals are by nature clever and dishonest.
He also said it is important to remember that customers have not been responsible for data breaches or fraudulent charges, and still won't be under any of the EMV scenarios.
In any case, fraud is rare, Eulie said, accounting for just $5.6 million of the $13 billion charged annually on First National credit cards.
“Situations such as Target generate a lot of interest,” Eulie said. “But it is important to remember that industry-wide, fraud just isn't a major issue.”
For now, cards are coming from manufacturers with chips as well as magnetic stripes, said the retail federation's Litchford.
“But retailers are eagerly adopting EMV,” Litchford said. “Retailers must be compliant by October 2015 or the fraud liability shifts.”
Major retailers, he said, will likely buy new terminals en masse.
But there is no reason to worry about laggards, he said. Cards will be equipped with chips as well as stripes for some time to come. So if a beachside cabana bar doesn't want to upgrade, the bar, not the card issuer, will be on the line for any jumbo margaritas bought with counterfeit cards.