EMV No Guarantee Against High Rates of Card Fraud, Study Shows

Cardholders in Mexico, not the United States, report the highest incidents of card fraud, according to a new report from Boston-based Aite Group LLC and Elkhorn, Neb-based ACI Payment Systems.

Of the credit, debit, and prepaid cardholders surveyed in Mexico, where EMV cards are rolling out, 44% reported an incident of fraud, compared to 42% of U.S. cardholders interviewed. At least 300 cardholders in each of the 17 countries surveyed for the report were interviewed.

The higher rate of fraud in Mexico than in the U.S., where the first stage of the EMV rollout is scheduled to be completed in 2015, is surprising because EMV cards are supposed to prevent card skimming and use of counterfeit cards. Skimming typically occurs when a consumer swipes his card through a POS terminal or inserts it in a card reader or ATM to which a small electronic device that captures the cardholder’s account data from the card’s magnetic stripe has been attached.

Unlike mag-stripe cards, EMV cards often require cardholders to enter a PIN to validate the card to the terminal. The terminal validates itself to the EMV chip by communicating with secure elements within the chip before any account information is transmitted between the two.

One of the driving reasons behind fraud in Mexico is the country’s high crime rate, which is being fueled by drug cartels. “The criminal element in the country is moving aggressively into fraud and it is having an impact on fraud rates,” says Shirley Inesco, a senior analyst for Aite Group and author of the report.

In other countries where EMV rollout is complete but which report high incidents of fraud, such as the United Kingdom, the higher fraud rates correspond to a high penetration of credit, debit, and prepaid cards among the population and heavy use of those cards. In the U.K., 34% of cardholders said they had experienced card fraud.

“Higher card usage exposes the cardholder and their account data to situations where the card can get skimmed and potential data breaches,” says Inesco. “Even if EMV prevents counterfeiting, all the criminal needs to make a transaction in a card-not-present environment is the account information [and security code].”

Many cards in the U.K., as well as other countries where EMV has rolled out, still have magnetic stripes so they can be used in the U.S., which makes them vulnerable to skimming. EMV stands for Europay, MasterCard, Visa, the three companies that created the security standard

In comparison, countries where EMV cards are standard, but which have lower card penetration and usage rates, such as Germany and Sweden, report significantly lower incidents of fraud. In Germany, 13% of cardholders and 12% of cardholders in both The Netherlands and Sweden said they experienced card fraud, according to the Aite/ACI report. ACI conducted the research for the report and Aite provided the analysis of the data.

One of the more surprising findings in the report is that one in five cardholders that experienced fraud switched card issuers. “That’s a pretty high percentage,” says Inesco. “While most of those cardholders felt their issuer did not do enough to protect their account, fraud seemed to provide cardholders thinking of switching issuers with a good reason to do so. Attrition resulting from fraud is something card issuers should be keeping a close eye on.”