Smaller Banks Not Sweating EMV Liability Shift

Smaller banks appear to have other priorities than issuing smart cards to customers.

After October 1, 2015, liability for fraudulent transactions at the point of sale will pass to the party that has not updated to the EMV (Europay-MasterCard-Visa) global standard. These are the so-called “smart cards” with embedded computer chips that allow tokenized transactions, and the POS technology to accept payments from them.

Some big banks, such as SunTrust, have started rolling out EMV cards comfortably ahead of the deadline. But for smaller banks and credit unions, it’s a different story. Credit Union Times reported this month that more than half of credit unions should be expected to miss the October 15 deadline.

It appears smaller banks are in the same boat.

Render Dahiya, CEO of payment card provider Arroweye, which provides on-demand printing of EMV cards, estimates that 80% of POS devices — those belonging to the nation’s largest retailers — will be fully prepared by Oct. 1, 2015. (Square is preparing its own mobile EMV-compliant reader, which will be chip-and-signature, rather than chip-and-pin.) “The whole thing turned around when the Target beach happened,” Dahiya told Bank Innovation, referencing the major security lapse at the retailer last fall. “Everyone’s looking for a solution. Consumer awareness is higher than it has ever been.”

If retailers are ready, that puts the burden on financial institutions.

But switching to EMV is an expensive proposition. “Costs can increase 5x or 10x for EMV inventory,” Dahiya said. “To store it is much more expensive; there is more cash tied up” to buy the inventory of new cards.

And beyond the costs, there are a limited number of producers of EMV cards. “Some of the smaller guys are getting big lead times, because if Bank of America wants to print 50,000 cards, it’s tough luck to the small to midsize guys,” Dahiya said.

Arroweye is currently producing about 95% magstripe cards and 5% EMV, although Dahiya estimates that in a year that mix will be more like 50/50. His company has on-demand EMV capability, which means an order placed tonight can be in tomorrow’s mail, and Dahiya is betting this will lure in smaller customers that may be shut out by larger producers.

Community banks, however, are not as sanguine about retailers getting points-of-sale ready in time, according to Cary Whaley, vice president of payments and technology policy for the Independent Community Bankers of America (ICBA). (The bigger banks agree.) This leads the banks to take a more calculated approach as the liability deadline approaches.

“Yes, the bigger orders come first for providers,” Whaley said, saying this is nothing new for community banks. “This really manifests itself with software providers.”

Regarding EMV technology, Whaley pointed out that smart cards are just one slice of a three-slice pie. Those slices are the cards, the encryption technology to protect data in transit, and tokenization to make sure intercepted information is worthless to fraudsters. “So community banks are going to aim for having one or two of these [in time for the liability deadline], rather than all three implementations,” he said.

The reason for this gets back to the costs Dahiya described. “The service may not scale to smaller banks initially,” Whalen said. “If they come in early and are experimental, that’s going to be cost-prohibitive. Smaller banks don’t want to be alpha testers or beta testers. They want to be in a position to use a proven solution.”

The deadline, in other words, is not a matter of dire urgency, especially considering there may be bottlenecks with retailers and acquirers, Whalen said. “A lot of them [smaller banks] will take a wait-and-see approach. What types of opportunities and cost reductions does the liability shift represent?… You’ve got to build a business case as with any other product.”

More than half of all payment card fraud occurs in the U.S., the world’s last major magstripe market. This has led ATM producers, such as Diebold, to create entirely new ways to read cards in ATMs to avoid skimmers — the card is inserted sideways and a moving read pulls in the data. Wouldn’t EMV be cheaper?

Magstripe dominates gift cards and prepaid cards, and that can be expected to continue, Dahiya said. “But in 2016, magstripe at the POS will start to stand out, the way barcode and QR transactions stand out today.” But magstripe is not going away anytime soon, Dahiya said. “As long as magstripe still works, there will still be those cards out there.”