66% of IT execs say chip-and-signature provides insufficient security

As the retail industry prepares to transition to EMV credit and debit cards, 66 percent of IT decision makers, including those in the C-suite, believe the chip-and-signature authentication method being pushed by the credit card networks provides insufficient security to card holders.

            View more survey results by Randstad Technologies.

Instead, the executives said chip-and-PIN authentication should be required, according to a recent survey on EMV readiness by Randstad Technologies. The survey also found that 58 percent of the respondents, who represent a cross-section of industries that will be affected by the chip card changeover, are actively preparing for the transition, while 42 percent have either taken no action or are unaware that their companies are making any progress toward adopting EMV.

In October, companies that have not invested and implemented EMV point-of-sale equipment and systems will risk bearing the liability for credit or debit card fraud, unless the card issuer in question is less prepared.

"With the deadline just two months away, this is a significant number of businesses that are simply going to miss the deadline," Dick Mitchell, solutions director at Randstad Technologies, told FierceRetailIT. Lack of time and access to technology expertise ranked as the top obstacles organizations face in meeting the deadline. "Neither of these will get any better as October approaches, especially given that the availability of skilled point-of-sale professionals will grow more scarce as we near the deadline," he said.

On the authentication numbers, Mitchell said, "despite this preference from merchants for chip-and-PIN cards, banks continue to issue chip-and-signature cards."

Federal Reserve Governor Jerome Powell recently urged credit card companies to rethink their plan for the chip-and-signature EMV cards. "Given the current technologies that we have at our disposal, we should assess the continued use of signatures as a means of authenticating card transactions," he said.

"It is evident that businesses prefer the more secure chip-and-PIN cards over chip-and-signature, but the banks are leading the chip-and-signature movement," Mitchell said. "It's cheaper for them to distribute cards that don't have the PIN capability, and they feel that consumers may be less likely to use their card in a transaction if they have to remember another PIN number. Until consumers demand chip-and-PIN and start voting with their dollars or legislation demands it, chip-and-signature will stick around." 

It's going to get sorted out over time, Mitchell said, "but the Oct. 1 deadline for EMV adoption is going to overrun many."

The survey findings show a vast disconnect between many merchants' seriousness about the EMV transition and the actions they are taking to make it happen. "Many have an attitude that the transition isn't a big deal. Given that consumer demand has been slow to develop, many businesses just aren't feeling the urgency to upgrade their systems. Part of this is because consumers have historically been insulated from the liability."

Retailers should be taking the transition very seriously and take steps now to meet the deadline, or at least get things underway, Mitchell said. "Many don't think it will be terribly impactful on their businesses, and the costs to upgrade to EMV technology is a deterrent causing some to drag their feet, but this is a huge gamble. Credit card fraud in the U.S. is estimated at $10-$12 billion this year alone and growing. Previously, credit card companies absorbed that cost, but after Oct. 1, retailers that fail to make the upgrade will be picking up at least a portion of that tab," he said.

In the short-term, businesses need to take steps as soon as possible and upgrade their point-of-sale systems to EMV technology, Mitchell said. Over the long-term, consumers need to demand stronger credit cards with chip-and-PIN. "We've seen the success of chip-and-PIN cards in Europe, Canada and many other developed countries, and for EMV technology to be truly effective, chip-and-PIN cards need to supplant chip-and-signature cards." 

Also U.S. companies can look at Europe's experience and see that with the EMV rollout, credit card fraud shifted from in-person transactions to online, or card-not-present fraud. "The U.S. needs to be prepared for a similar scenario to play out here," Mitchell said.

For more:
-See this Randstad press release
-See this Randstad survey

Related stories:
Retailers, banks spar over chip-and-PIN cards
Banks worried that retailers won't be ready for EMV
EMV is $35B 'money pit' for retailers
The importance of pushing back the EMV fraud liability shift deadline
Visa won't budge on fraud liability shift deadline