The FBI has joined the discussion of the new EMV, or chip cards that are replacing credit and debit cards in the U.S.
“While EMV cards offer enhanced security, the FBI is warning law enforcement, merchants, and the general public that these cards can still be targeted by fraudsters,” the Bureau said in a public service announcement.
The EMV cards replace the traditional magnetic strip on the back with a small chip that holds encrypted data. It allows merchants to verify a card’s authenticity, providing the cardholder greater security and making the EMV card less vulnerable to hacking while the data is transmitted from the point of sale (PoS) to the issuing bank.
But the FBI says that may not be enough. It says EMV cards can be counterfeited using stolen card data obtained from the black market.
Prefers a PIN system
The FBI says the best defense is for consumers to use a PIN instead of a signature when making purchases.
“Merchants are encouraged to require consumers to enter their PIN for each transaction, in order to verify their identity,” the FBI said. “If a consumer uses a signature, merchants should ask to also see a government-issued photo identification card to verify the cardholder’s identity.”
This was music to retailers' ears, since they delivered an almost identical warning to Congress this week.
“What the FBI is saying is what the rest of the world already sees as common sense,” Mallory Duncan, National Retail Federation vice-president said. “It’s the right thing to do, and we hope the banks are listening.”
Leaving the back door open
Not using all of the card's potential security features, says Duncan, is like locking the front door but leaving the back door wide open.
“Retailers have long-argued that PINs are essential to providing cardholders with the security that they deserve,” said Brian Dodge, executive vice president of the Retail Industry Leaders Association (RILA), another retail industry trade group. “The FBI’s alert should be a wake-up call to the banks and card networks that continue to stand in the way of making PIN authentication the standard in the U.S. just as it has been around the world for years.”
The retailers complain that virtually all of the chip cards being issued in the United States are chip-and-signature rather than chip-and-PIN, leaving consumers without the option to use a PIN. By contrast, EMV cards used in 80 countries around the world for 20 years or more are routinely chip-and-PIN.
“They’re encouraging consumers to use PIN and they’re encouraging merchants to request PIN – the only thing missing is to encourage the banks to issue PIN cards,” Duncan said.