Magnetic Stripes, EMV Chips and Credit Card Fraud

As we have repeatedly noted on this blog, the U.S. is the only developed country in the world that has not yet adopted the EMV (chip-and-PIN) technology for payment cards. Instead, we are still reliant on magnetic stripes. The issue with mag-stripe cards is that they are much more vulnerable to fraud than EMV, especially in face-to-face transactions.

Now, the story is somewhat more complicated, as such things tend to be. Studies have shown that following a wholesale switch to EMV in a given country, the criminals shift their attention to non-chip transactions (e-commerce would be one example) or to other countries (e.g. the U.S.). Yet, over time, the country that has adopted the new technology invariably sees a reduction of domestic payment card fraud. To illustrate this point, in this post I will give you data from recent studies by two Federal Reserve researchers: Richard J. Sullivan from the Kansas City Fed and Douglas King from the Atlanta Fed.

Magnetic Stripes, EMV Chips and Credit Card Fraud

Before I get started, though, let me just remind you what EMV is. Europay, MasterCard and VISA (EMV) is a global standard for authenticating payment transactions involving chip-carrying credit and debit cards and their compatibility with point-of-sale (POS) terminals and automated teller machines (ATMs). At the end of last year, there were 1.5 billion EMV payment cards in circulation and 21.9 million EMV terminals active worldwide, according to EMVCo, the body that manages the EMV specifications.

1. EMV adoption and deployment. Let’s begin by taking a look at the latest available data for the worldwide adoption and deployment of the EMV technology:

Here is a global map showing the adoption rates by region (click on the image to see a bigger one):

The reason there are no data for the U.S. is that, the scope of adoption here is negligible. Now let’s examine the experience of a couple of the first countries that switched to EMV.

2. Chip-and-PIN in the U.K. The U.K. was one of the first major countries to adopt the new payment technology, which was fully implemented by the end of 2006. So how did that affect the rate of card fraud in the country? Here are the data:

Overall, since the U.K. began the implementation of the new technology in 2004, payment card fraud in face-to-face transactions has fallen by 69 percent:

During the same period, U.K. fraud losses from lost and stolen cards have fallen by 61 percent:

However, U.K. fraud losses from card-not-present transactions, which do not rely on chip authentication, sharply increased in the years immediately following the adoption of EMV, reaching a peak in 2008. They have since fallen, but at the end of 2010 were still 50 percent above the pre-implementation level.

Moreover, even as payment cards issued by U.K. banks were less vulnerable to fraud at home, in the years immediately following the 2004 EMV adoption the losses from cross-border transactions grew quickly. Once again, the peak was reached in 2008 and cross-border fraud losses have fallen since then but at the end of 2010, the total amount was still barely above the pre-EMV-adoption level.

3. The French experience. Similarly to the U.K., EMV was fully implemented in France by the end of 2006. However, while card-present fraud declined significantly, the overall losses on French cards actually increased following the reform, due to a big rise in cross-border fraud. Here is the chart for card-present fraud losses:

And now here is the chart showing the total fraud losses:

Just as was the case in the U.K., card-not-present losses in France increased in the years following the EMV implementation.

The Takeaway

So the British and French experience offer a convincing proof that EMV adoption reduces domestic fraud levels. The criminals move away from countries where EMV has been implemented and focus their efforts in countries that are still reliant on the mag-stripe technology.

So it is great that we are finally making the switch to EMV here in the U.S. A couple of big banks are already issuing chip cards and the requirement that all U.S. payment processors are able to support merchant acceptance of chip cards no later than April 1, 2013 will speed up the shift to the more secure technology. It should have been done long ago, but better late than never.

Image credit: Tctechcrunch2011.files.wordpress.com.