An Exception to the Rule, SECU Issues PINs for Its EMV Cards, But Usage Is Another Story

The United States appears to be making steady progress in its conversion to the EMV chip card standard. Some 120 million chip cards were issued by the end of last year, a figure expected to balloon to 600 million by the end of 2015, according to the EMV Migration Forum, an industry trade group.

But U.S. banks for the most part are issuing so-called chip-and-signature credit cards, and that has merchant groups upset, and at least one governor of the Federal Reserve Board expressing reservations.

“New approaches to authentication increasingly offer greater assurance and protection. Given the current technologies that we have at our disposal, we should assess the continued use of signatures as a means of authenticating card transactions,” said Fed governor Jerome H. Powell in a speech given late last month at a payments conference at the Kansas City Fed.

Retailers object to signatures for EMV, arguing PINs are far more effective at preventing fraud. “Retailers are investing billions to implement new chip-enabled card readers in stores nationwide. They’re asking banks and credit unions to meet that commitment by issuing new chip cards with PINs,” says the Retail Industry Leaders Association in a recent press release.

To be sure, chip-and-signature lets issuers get cards out faster and at less cost. That’s a key factor given the looming Oct. 1 deadline by which responsibility for counterfeit and lost-and-stolen fraud, once borne by the issuer, will hit merchants if they aren’t equipped to handle an EMV card. That date, set by the card networks, has triggered a furious industrywide campaign to get EMV cards out the door and merchants armed with new terminals.

But while it’s true most issuers are pumping out cards with signature as the only user-authentication method, that’s not the case with all of them. One major financial institution, State Employees Credit Union, an early proponent of EMV, began converting its entire 1.3-million-strong debit card base to the new standard four years ago and now has 300,000 credit cards converted, as well. All of the cards go out the door with PINs, Leanne Phelps, senior vice president for card services, tells Digital Transactions News.

With $29.5 billion in assets, SECU is the second-largest credit union in the country. And it began issuing PINs with its EMV cards long before Powell expressed his doubts about signatures. But all of this doesn’t mean it can afford to ignore which way the wind may be blowing in Washington, D.C. “Any time the Federal Reserve starts talking about how we should run things, yeah, it does cause concern,” says Phelps.

Powell in his speech did not recommend or even mention any particular alternative to signatures for EMV, PIN or otherwise. The Fed did not respond to a request for comment from Digital Transactions News.

SECU is using online PIN verification, the type of authentication familiar to any mag-stripe debit card holder. By contrast, some Continental European countries along with the United Kingdom and Canada have adopted so-called offline PIN verification, where the chip compares the PIN entered by the cardholder with an encrypted version stored on the chip.

Both methods have plusses and minuses, but Phelps argues online PIN is more affordable for the issuer, since it requires a less expensive chip. The option also simplifies PIN resets when necessary. But this option may not be available in all cases. SECU can verify cardholder PINs in real time at its host, a capability some issuers and card processors can’t match.

Partly for this reason, SECU appears likely to be part of a distinct minority for some time to come. “The majority of issuers I’m talking to are strictly doing chip-and-signature,” says Julie Conroy, research director at Boston-based consultancy Aite Group LLC. “There’s a lot of costs associated with offline PIN but also a lot of costs associated with online PIN.” That’s hard to justify, she says, when counterfeit fraud, the kind chip-and-signature alone solves, is by far the largest form of fraud issuers confront.

Indeed, SECU also supports signature authentication. And even though it assigns a PIN with each EMV card it issues, few credit card holders, it seems, are paying attention. Less than one-half of 1% of all of SECU’s EMV credit card transactions so far have been PIN-authenticated.

That could change in the coming months. But for the time being, “consumers aren’t clamoring for the PIN,” notes Conroy.