A U.K. Banker’s Warning for His U.S. Brethren: Get with the Chip

Bankers in the U.S. who bemoan the absence of a business case for smart cards may soon find one now that a massive rollout of chip-based credit and debit cards secured with personal identification numbers is well under way in the U.K., a British banker warned today. That's because fraudsters will begin targeting the U.S. market, which lacks chip-and-PIN protection, said Richard Sanders, head of card strategy at Abbey PLC, the U.K.'s sixth-largest retail bank. Speaking at the CardTech SecurTech exposition in Washington, D.C., Sanders also warned U.S bankers in the audience that the day is coming when their cardholders will not be able to use their cards when traveling to Britain. While Sanders couldn't predict when that day will come, he cautioned U.S. banks to expect it. “That's going to be a major issue for U.S. cardholders in the U.K.,” he said, unless the banks can equip their cardholders with chip technology. Under the chip-and-PIN program in the U.K., cardholders enter a PIN at a point-of-sale terminal. The terminal compares the PIN to the one stored in the card's chip, requiring a match to authorize the transaction. Banks in the U.K. began rolling out the technology last year in an effort to meet a deadline set by the bank card associations. On Jan. 1, losses stemming from any fraudulent transaction will be borne by the bank or retailer that failed to implement chip-and-PIN technology. Between 3 million and 4 million chip-and-PIN cards are entering circulation each month, Sanders said, adding that the total stood at 13.5 million when last counted at the end of February. That's about 11% of the total bank-issued card base. U.K. banks acted to roll out chip cards because of rapidly mounting fraud losses on cards. Such losses are running more than £400 million ($700 million) annually, four times the losses sustained in the mid-1990s. Sanders predicted that, without chip-and-PIN, losses would hit £800 million in 2005. But criminals, he warns, will simply turn their attention to card markets that haven't adopted chip protection against such frauds as stolen and counterfeited cards, including the U.S. That, he says, could drive up fraud losses on cards here. Also, he says, U.K. banks are phasing out a so-called PIN bypass rule under which cardholders who forgot, didn't have, or otherwise couldn't enter a PIN could simply run the transaction on the card's magnetic stripe, as in the past. Leaving the rule in place, he said, would leave banks and merchants exposed to more fraud. That means that at some point in the future cards from markets such as the U.S. won't work. “I can't give a timetable for that, but for U.S. banks there will come a day when your cardholder won't be able to use his card in the U.K.,” he said. He pointed out that U.K banks spent £1.1 billion on the new technology, and so can't afford any exceptions that invite fraud. “We haven't spent all this money to provide a window for fraudsters,” he said.