Could EMV Have Prevented Recent Security Breaches?
PRINCETON JUNCTION, N.J. -- Experts disagree over whether Europay, MasterCard and Visa (EMV)-based credit cards could have prevented the recent breaches that affected millions of Target Corp. and The Neiman Marcus Group customers. Although today’s "EMV 101" webinar, presented by the EMV Migration Forum, did not tackle these specific breaches directly, presenters did say EMV cards are superior to magnetic stripe cards and can help prevent a variety of potential breaches.
EMV guidelines state that retailers must upgrade their point-of-sale (POS) equipment by Oct. 1, 2015 for in-store transactions, Oct. 1, 2016 for most ATM transactions and Oct. 1, 2017 for transactions taking place at the pump. If retailers choose not to upgrade their POS equipment by these dates, they will become responsible for fraudulent card transactions, as opposed to the credit-card providers.
"Magnetic stripe cards can be easily cloned," Guy Berg, managing consultant for MasterCard Advisors, said during today’s webinar. "It’s very difficult for the [POS] to recognize cloned cards."
EMV-enabled cards are superior because the chip allows for a risk assessment to be performed when a transaction is taking place at the POS, Berg explained. "Once the risk assessment is performed, a decision is made to approve the transaction or not," he said. "Also, EMV security mechanisms can help monitor skimming and data breach threats."
EMV cards also provide another layer of protection vs. magnetic stripe cards thanks to an authentication key they contain, he continued.
Both chip and PIN and chip and signature standards will be acceptable under EMV guidelines. During his presentation, Berg said both types of cards are excellent, with the exception of one flaw chip and signature cards have. "Chip and signature is very secure," he said. "It only does not provide protection from when a card is stolen up to when a consumer calls reporting the card missing."
Currently, there are approximately 1.2 billion credit cards and 100 million POS terminals accepting such cards in the United States, according to Randy Vanderhoof, director of the Princeton Junction, N.J.-based EMV Migration Forum and moderator of the webinar. Although the U.S. represents the only developed country that has not already switched to EMV cards, it will mark a major change once it does. The U.S. is responsible for about 50 percent of the world’s payment transactions, noted Vanderhoof.
"The goal is to have a majority of POS terminals EMV ready by October 2015," he said. "We’ve already seen merchants upgrading their POS terminals to accept EMV."