EMV chip card payments won't reach "broad" adoption for at least a few more years, and tokenization must be prioritized to secure the payment chain, according to a new report from Forrester Research.
The report noted that the time is "ripe" for a change in the U.S. payment industry, suggesting that more secure, encrypted and tokenized transactions on digital wallets, mobile-based near field communication (NFC) virtual cards, and EMV contactless payments will be strong competition for plastic EMV chip-and-signature and chip-and-PIN payments in the United States.
As a result, Forrester predicted that plastic EMV cards won't achieve broad adoption in the United States until 2020. EMV acceptance in the United States will be slow for three reasons: The technologies don't solve fundamental fraud and security issues; the U.S. payment market is very complex; and the cost of terminal upgrades will slow adoption, or transition retailers directly to contactless solutions.
"EMV without tokenization does not encrypt or protect the card numbers and expiration dates transmitted during card transactions," the report noted. "EMV is largely a bolt-on to existing card technologies to support a chip on the card that prevents counterfeiting, but it does nothing to prevent counterfeiting of cards (i.e., you can still copy the data and produce a counterfeit magnetic stripe card that will work at any magstripe terminal) or fraudulent online use of cards in CNP (card not present) transactions."
In fact, merchants would be better protected against payment card breaches if the cards utilized encryption and tokenization.
"EMV, alone, won't protect against wholesale attacks on payment infrastructure, like in the Home Depot or Target breaches," Andras Cser, an author of the report, told SC Magazine, adding that tokenization and encryption would save merchants money and protect them against attacks.
As new payment platforms such as Apple Pay come to the fore and the U.S. payments market becomes increasingly fragmented, adoption of chip-and-PIN technologies could be delayed even further. Magnetic stripe cards will still see the majority of transactions for now. However, the more secure Apple Pay and the competing Merchant Customer Exchange, in tandem with the increasing number of digital wallets, could offer cheaper alternatives that are more secure.
Some retailers are hesitant to upgrade their point-of-sale terminals, but when they do inevitably make the upgrade, the new terminals will likely support a broad range of payment methods, including contactless payments, which could render plastic cards obsolete over time. Forrester expects that mobile and contactless payments will have a larger share of transaction volume than chip-and-PIN and chip-and-signature payments in the United States by 2025.
Others see value in EMV but don't think it's a complete solution to credit card fraud.
EMV's strength lies in preventing the counterfeiting of credit and debit cards, but it remains ineffective at preventing lost/stolen or CNP fraud and protecting data being stored on computers or transmitted over networks, VeriFone's CSO Joe Majka told Pymnts.com. "EMV would not and could not have prevented the compromise of millions of card payment accounts due to data breaches at major retailers in recent years," he said.
Majka agrees that those types of breaches "should become increasingly irrelevant" as the payments industry moves closer to full conversion to an EMV standard, adoption of point-to-point encryption, and use of tokenization, thus making physically-presented card data unusable to cybercriminals.
However, Majka adds that "it it is going to take years before we're able to eradicate mag-stripe cards completely, and online fraud is another issue altogether."
Meanwhile, the Payments Security Task Force is out with an EMV implementation survey, and its prediction is more optimistic than Forrester's. The Task Force said the transition to EMV chip cards will be nearly complete—98 percent of total credit and debit cards—by 2017. That figure is estimated to reach 63 percent by the end of this year.
This story was updated on May 5, 2015 to reflect the survey from the Payments Security Task Force.
Visa won't budge on fraud liability shift deadline
The importance of pushing back the EMV fraud liability shift deadline
Banks worried that retailers won't be ready for EMV
Many banks won't be fully ready for October EMV deadline
Card issuers ramp up for EMV, retailers lag