By Sylvia Carr, 18 May 2004 12:50
NEWS More than a quarter of UK retailers are wary of moving to the latest Chip & PIN smart card technology for plastic card transactions, according to a survey conducted by Retail Logic, a maker of payment processing software, and the Retail Bulletin, a retail news website.
Of the companies surveyed, 26 per cent said they remain unconvinced of the benefits of changing to the new systems.
The survey concentrated on a range of retailers, from those with fewer than 10 stores to those with over 250.
The deadline for converting UK shops to smart card transactions is 1 January 2005, which would make the UK the first country to move to Chip & PIN systems that meet the EMV (Europay-MasterCard-Visa) standard. Ireland and France are also in the process of upgrading to the new standard.
Smart cards are touted as being harder and more expensive to duplicate than magnetic-strip cards, so using them could cut down on fraud. In addition, the chip technology on smart cards allows their data to be changed and allows them to be used not just for payment but also for loyalty and frequent shopper programmes.
As for who will make the deadline, the survey revealed 53 per cent of retailers expect to be ready by January 2005, while 26 per cent will make it by June 2005 and 21 per cent sometime after that. Given that 20 per cent of retailers are putting off the migration until their next point-of-sale hardware upgrade, the migration for all UK retailers may not be complete until 2010.
What's holding back the switch?
Retailers surveyed cited four major reasons: the complexity of the accreditation process (28 per cent), lack of guidance from banks (28 per cent), technical issues (24 per cent) and lack of resources (20 per cent).
The cost of the migration will also be high, with the majority of respondents (53 per cent) estimating they'll spend between £100,000 and £500,000.
Comments
There are 5 comments. Join the discussion
1. anonymous
The 45 largest retailers in the country account for 55% of all card transactions handled in the UK and are fully commited to implementing chip and PIN. Their programmes will be either fully rolled-out or well under way by the end of 2004. Businesses with bank-owned terminals account for 30% of all UK transactions. Rollout of these terminals will be completed by early 2005. Therefore 85% of all UK plastic card transactions are on track to be upgraded.
The Retail Logic research addresses the medium sized retailers, who account for 15% of all plastic card transactions. The really good news is 54% of these retailers will also be ready. The Chip and PIN Programme has been encouraging mid-tier retailers to plan for the liability shift and we will continue to support them. It is, however, up to each business to assess the business risks of not moving to chip and PIN. From 1 January 2005 whoever decides not to make the investment will be liable for fraud losses commited on chip and PIN cards which could have been prevented with chip and PIN technology.
2. anonymous
Quite a revalation add this to our american cousins still undecided on chip and PIN and 2010 could be optimistic.
What incentive is there for a cardholder to have a PIN with the new type Chip and PIN credit card if they are never going to use it to withdraw 'expensive,' cash at an ATM?
Questions worth asking:
Will high-value credit cards & PINs become the target for fraudsters? Fraudsters are already shoulder surfing, using mini-cameras, high-powered binoculars, phishing on the net and making bogus calls just to get hold of banking details AND PINS.
Just think acquire both and they can get money at an ATM which they couldn't do if the card is not operated by a PIN, or alternatively they can go into a Chip and PIN compliant retailer and spend until their hearts content. What will happen to them - nothing. They won't be challenged at point of sale but the card they are using might be withheld at a cash machine.
Will access to 'easy money,' be too tempting for the weak willed? Is this another ploy by the card companies?
Will victims of PIN based fraud be liable if their cards used before they report it lost or stolen? How will they prove they weren't negligent with their PIN. (See Banking Code, articles 12.4 Taking Care and 12.9 Liability).
Is it compulsory or a legal requirement for a cardholder to accept a PIN with their Chip and PIN card?
Why does the card industry fail to mention Chip and Signature Cards unless pushed?
Will Chip & PIN prevent ID Theft or CNP fraud?
Are card issuers delivery methods of PINs secure. (Do they call the cardholder to see it they've safely received their PIN)?
Why are ATMs where PINs are used all the time not more secure. (Banks own ATMs in iat least two Middle East countries are covered by the latest digital CCTV. This is for two reasons, one to deter ATM crime and two to resolve disputed customer transaction). A sobering though, ATM fraud rose by 37% last year.
PIN Pads, look at the examples on the Chip & PIN or manufactures web sites. How can you hold a PIN Pad in one hand, enter your PIN with the other and cover the pad at the same time?
Why is the card industry giving out misleading information on the availability of Chip & Signature cards, especially for the disabled. (From the Egg web site. Even when you get your new card you might find that you're still asked to sign for some purchases. The retailer will always let you know whether you need to enter your PIN or sign for your purchase. This is because not all retailers will have the new equipment yet, but all retailers will be upgrading within the next 12-24 months. After this time you won't be able to make a purchase without your PIN.)
Is the last sentence true or false? Enter a Chip & Signature card and the prompt for the cardholder and retailer will be Signature required.
Just a few question and thoughts on a scheme that seems to being bulldozed through and the minimum of information (sPIN) is provided for cardholders. Retailers have a choice whether to opt in or out of Chip & PIN. It appears that there's a liability shift for fraud - directly on to the PIN cardholder. What incentive I ask?
3. anonymous
What incentive is there for a cardholder to have a PIN with the new type Chip and PIN credit card if they are never going to use it to withdraw 'expensive,' cash at an ATM?
Questions worth asking:
Will high-value credit cards & PINs become the target for fraudsters? Fraudsters are already shoulder surfing, using mini-cameras, high-powered binoculars, phishing on the net and making bogus calls just to get hold of banking details AND PINS.
Just think acquire both and they can get money at an ATM which they couldn't do if the card is not operated by a PIN, or alternatively they can go into a Chip and PIN compliant retailer and spend until their hearts content. What will happen to them - nothing. They won't be challenged at point of sale but the card they are using might be withheld at a cash machine.
Will access to 'easy money,' be too tempting for the weak willed? Is this another ploy by the card companies?
Will victims of PIN based fraud be liable if their cards used before they report it lost or stolen? How will they prove they weren't negligent with their PIN. (See Banking Code, articles 12.4 Taking Care and 12.9 Liability).
Is it compulsory or a legal requirement for a cardholder to accept a PIN with their Chip and PIN card?
Why does the card industry fail to mention Chip and Signature Cards?
Will Chip & PIN prevent ID Theft or CNP fraud?
Are card issuers delivery methods of PINs secure. (Do they call the cardholder to see it they've safely received their PIN)?
Why are ATMs where PINs are used all the time not more secure. (Banks own ATMs in iat least two Middle East countries are covered by the latest digital CCTV. This is for two reasons, one to deter ATM crime and two to resolve disputed customer transaction). A sobering though, ATM fraud rose by 37% last year.
PIN Pads, look at the examples on the Chip & PIN web site. How can you hold a PIN Pad in one hand, enter your PIN with the other and cover the pad at the same time?
Why is the card industry giving out misleading information on the availability of Chip & Signature cards, especially for the disabled. (From the Egg web site. Even when you get your new card you might find that you're still asked to sign for some purchases. The retailer will always let you know whether you need to enter your PIN or sign for your purchase. This is because not all retailers will have the new equipment yet, but all retailers will be upgrading within the next 12-24 months. After this time you won't be able to make a purchase without your PIN.)
Is the last sentence true or false? Enter a Chip & Signature card and the prompt for the cardholder and retailer will be Signature required.
Just a few question and thoughts on a scheme that seems to being bulldozed through for cardholders. Retailers have a choice and it appears that there's a liability shift for fraud - directly on to the PIN cardholder. What incentive I ask?
4. anonymous
Some compulsion and/or stronger incentives are necessary: we need chip and pin, and we need it universally NOW. There are major vulnerabilities (for all concerned) during the transition phase.
The scenario: A fraudulent trader can easily procure a chip & pin terminal, and with a modest amount of IT skill can reprogramme it so that it captures all the swipe-able details AND the customer pin. At this stage, no communication with the card issuer is made. But the trader now has everything necessary to make a forged swipe-able card, and has the pin... so can make fraudulent transactions (and just to keep the customer unaware, later execute the valid purchase transaction via a swipe-terminal).
Customers have no way of knowing whether the terminal into which they provide their pin is a legal one, or one modified with criminal intent.
This scenario only works during the transitional period, when transactions have to be accepted by the issuers from both types of cards.
So, for as long as swiping is acceptable, there is scope for fraud on a large scale.
Retailers surely need to be told that this isn't an option: they have to convert to chip and pin, and do it quickly.
5. Peter Lewis
Concerning fraudulent terminals capturing swipe and PIN data, whilst not wishing to belittle the risk highlighted by your reader, any retail establishment possessing such a device would run an enormous risk of 'chance' discovery. On top of that, user education to be sure to hold on to your card & to put it into the 'Smartcard' slot yourself is also essential.
Against the risk this must be set the very significant amount of fraud currently involving traders (or their staff). It's easy for someone to say that 'the signature looked OK to me' and there's no practical come-back. With Chip'n Pin either you know the PIN or you don't.
FWIW, I've been using Chip'n Pin here in France for 14 years now, and find signing a slip when I'm in the UK to be a real pain. For a start, PIN entry is noticeably faster, and I'm pleased not to be leaving examples of my signature all over the place.