Wal-Mart: "It's Time For Chip-And-PIN In The U.S."

With major card brands and the banks strongly opposed to Chip-and-PIN efforts in the United States, there's only one way it's going to happen--and that happened Wednesday (May 19): Wal-Mart publicly forced the issue. When the world's largest retailer insists on a path, even Visa has to listen. And Wal-Mart is now insisting on a domestic Chip-and-PIN (EMV) program.

"As far as we are concerned, signature is a waste of time. It has to be PIN or nothing," Jamie Henry, Wal-Mart's director of payment services, told attendees of a panel discussion held Wednesday at a Smart Card Alliance event in Scottsdale, Ariz. "Wal-Mart's POS hardware is 100 percent Chip-and-PIN capable. Our hardware is in place," although the software needs some work. "We are working on implementing it in the U.S. It's time for Chip-and-PIN in the U.S. Let's get a roadmap and move it forward here in the United States."

Henry was supposed to be doing this particular panel with Malcolm Nunes, strategic sourcing manager for Home Depot, but Nunes didn't show. No reason was given.

Henry described card mag-stripes today as "fundamentally flawed" and said "Let's go directly to Chip-and-PIN."

(See related Wal-Mart stories this issue: Wal-Mart Digital Makeup Trial: It’s the Inventory, Stupid and Should Wal-Mart Digital Signage Use Near-Time News, Weather, POS Data?)

He also told attendees that his chain has come to this conclusion fully aware of Chip-and-PIN's security holes, but that, overall, EMV is a better option than the signature mag-stripe offerings used in the U.S. today.

"I'm not naïve. [Chip-and-PIN] has security problems. The data from the UK demonstrates that," Henry said.

Coincidentally, this week apparently marked one of the first U.S. deployments of the smartcard payment devices, when the United Nations Federal Credit Union became what Computerworld termed "the first financial institution in the U.S. to unveil plans to issue credit cards" compliant with EMV.

It's certainly appropriate that a U.N. bank would be the first to take such a step, because one of the key drivers behind EMV's movement has been its globalization. Having already been deployed throughout Europe, Australia, Latin America, parts of Asia, Mexico and Canada, the U.S. is one of the largest holdouts. That fact has already started to impact American consumers who try to use their U.S. mag-stripe credit cards at merchants overseas and find that it's got a 50 percent shot of not working

But it's even more of an issue for global retailers such as Wal-Mart, which have to support EMV in much of the world while maintaining mag-stripe capabilities for the U.S.

"China UnionPay issued more than one billion cards with 6-digit PINs. Are they smarter than us in the U.S.? They can use them and we can't?" Wal-Mart's Henry asked. "We want to create an environment that is consistent for our international cardholders."Another concern that Wal-Mart—and others—have raised is the security weakest link belief. In essence, that belief argues that cyberthieves will start to shy away from countries using EMV and move more of that fraud to the more easily defrauded mag-stripe cards. That possibility coupled with the deep pockets of the U.S., and America could become even more of a fraud target—unless the U.S. adopts Chip-and-PIN.

Henry commented on that trend when answering a question about the U.S. Senate's efforts this week to pass financial regulatory legislation that is supported by retail lobbyists and strongly opposed by lobbyists representing the card brands. Part of the bill would add government oversight—and presumably restrictions—on the interchange rates charged to retailers.

Henry said he believed the interchange reform bill, if made into law, would actually help EMV get adopted in the U.S. because it will give the card brands a strong financial incentive. "I think it will push toward the technology because it is more secure. [Card brands] won't be able to push the fraud expense into the merchants." It's not clear that the bill, if made into law, would prevent those fraud expenses. But it's likely the government oversight would make such charges more difficult.

For the moment, Wal-Mart doesn't accept EMV (in the U.S.), contactless payment nor, for that matter, loyalty cards. Henry was asked why his chain does not currently accept contactless.

"A business case hasn't been made yet to make [contactless] interesting to us," he said. "When the business model is right, we are more than willing to move forward."

Another participant on Henry's panel was Richard Mader, the executive director of the National Retail Federation's (NRF) Association for Retail Technology Standards (ARTS). Mader agreed with Wal-Mart that retailers need to go to an EMV approach, but he said how exactly to get there is less clear.

"Retailers need a clear roadmap. What is the right path?" Mader asked. "Is it going to be associated with mobile? Perhaps existing cards with PIN so you don't have to change everything?"

It seems clear now that the U.S. will eventually make the move to EMV. When Wal-Mart and even a few of the other largest chains insist on the move, there's little that can be done to stop it. But even then, it's going to take years to make the transition. Like so many other elements of security technology, there's a fine chance that EMV protections—such as they are—may be obsolete by the time the U.S. completes the move.

Still, it's the better choice for security and convenience, and the sooner retailers start down that path, the better. And if one chain will lead that movement, no one is better than Wal-Mart. After all, when you have $405 billion in annual sales, you somehow tend to always get the last word.