Credit Cards

October 1 is an important date for businesses that accept credit cards. That's when a new rule takes effect, shifting the liability for fraudulent credit card purchases from the banks to the business making the sale, if it has not installed EMV chip card technology.

Unfortunately, a survey by Wells Fargo shows small businesses, by and large, are not only unprepared – they aren't aware of what's coming.

In its quarterly Small Business Index Survey, just 49% of small business owners who accept point-of-sale card payments today report being aware of the impending liability shift, when a card issuer or merchant that does not support EMV chip card technology will assume liability for any fraudulent point-of-sale card transactions.

Financial institutions have been sending their customers new EMV chip-enabled credit and debit cards. These cards are designed to protect against fraudulent transactions by encoding cardholder information within an encrypted microchip and data that changes with each transaction.

For the cards to work, merchants must convert to new card readers or add EMV capability to their existing magnetic stripe card reader payment terminals. That costs money.

Only 31% compliance

With only three months remaining before the deadline, Wells Fargo and Gallup, which conducted the survey, found that only 31% of small business owners said that their existing credit card processing system accepts chip-enabled cards.

When asked if they plan to upgrade their point-of-sale credit card terminals to accept EMV chip cards, just 29% said they would before the Oct. 1 deadline. Another 34% said they will at some point in the future after October. Twenty-one percent said they never plan to upgrade.

"While our industry has made great progress in the last year informing and preparing small business owners for the EMV liability shift, the survey findings show us that we have more work to do," said Debra Rossi, head of Wells Fargo Merchant Services.

The bank said it is trying to build awareness, prepare small businesses for the EMV liability shift, and encourage business owners to adopt EMV chip-card technology. It has been providing EMV-capable equipment to customers since 2012.

It said all new and re-issued Wells Fargo Business Credit Cards and Business Elite Cards provided to customers are chip-enabled.

Card issuers take the lead

In fact, card issuers have been well ahead of businesses in adopting the EMV technology. Visa and Mastercard announced last year that they had formed a “new cross-industry group focused on enhancing payment system security” to spearhead adoption of the new technology, which has been in use in Europe for years.

Despite the split between businesses that intend to upgrade their payment terminals to accept EMV chip cards and those that don’t, small business owners seem to agree on one thing: when consumers buy something, they told the Wells Fargo survey takers, they prefer customers pay with cash or a check.

Why are there so few chip-enabled card readers at retailers around the country? It depends on who you ask. The nation's retailers say they've done their jobs – it's the credit card companies that have dropped the ball.

The National Retail Federation (NRF) points to a survey that found 48% of retailers have implemented the new EMV chip card system, or are expected to within weeks. A total of 86% said they expected to be EMV compliant by the end of 2016.

But the NRF said the survey also found that 57% of the retailers who had not yet implemented the new system had installed the card readers, but were waiting for certification by the credit card industry. About 60% said they had been waiting for six months or longer.

NRF says those numbers are in sharp contract to the statistics issued by the banking industry, which it says has tried to shift blame for the slow start to retailers. The survey, NRF says, found retailers are eager to begin using the chip card system since it protects them from liability connected to fraud.

Certification process

The certification process for the chip card system checks out a number of important functions to ensure the new technology is working properly. It can be a complicated process because the system must check out across multiple card platforms, including MasterCard, Visa, American Express, and Discover.

The size of the retailer can also complicate things. Big retailers with more point of sale positions take a lot more time.

Hundreds of tests may be required and the process might take two weeks or eight months. The cost to the retailer might be as little as a few hundred dollars or could run into the tens of thousands of dollars.

Visa says it's helping

Visa, meanwhile, recently announced steps it said could help speed up the implementation of the chip card technology. It said it has streamlined testing requirements, made the certification process simpler, and made commitments to improve the technology. It also said it is changing its policy to help limit exposure to counterfeit fraud liability for merchants who are not yet chip-ready.

While retailers might feel frustration at the pace, Visa maintains that progress has been “significant,” with over 300 million chip cards in the hands of consumers and 1.2 million retail locations now equipped to accept them.

But the NRF said it is disappointed the credit card industry has not provided enough personnel to make sure certification happens in a timely manner. In the meantime, it says consumers are confused as to whether they continue to swipe their cards or begin “dipping.”

Carrying a lot of cash is dangerous. Criminals may take it and so may the cops, who increasingly view having a lot of cash as evidence of wrongdoing. But now, police have added a new twist -- they've started using a scanner that lets them swipe the money right off prepaid cards.  

The device is called an ERAD -- Electronic Recovery and Access to Data machine, and Oklahoma's state police began using 16 of them last month. Hundreds of other police departments around the country are also using the device but haven't fessed up to it. 

It's all pretty simple. If a state trooper or other police officer suspects you are tied to some type of crime, he can scan your prepaid cards and seize the money on them. No formal charges, no trial, no due process.

It's an extension of a long-standing practice of shaking down anyone police think is suspicious. All too often, as the Washington Post demonstrated in a Pulitzer Prize-winning investigation a few years ago, all you need to do to look suspicious is have a lot of money.

"Different factors"

The police, of course, say the process is completely straightforward.

"We're gonna look for different factors in the way that you're acting,” Oklahoma Highway Patrol Lt. John Vincent said, according to a Washington Post report. “We're gonna look for if there's a difference in your story. If there's some way that we can prove that you're falsifying information to us about your business."

Of course, when Lt. Vincent says police will "prove" you're falsifying information it doesn't mean they'll prove it in court, where you can confront the witnesses and challenge the evidence. And that's what has critics upset.

State Sen. Kyle Loveless (R-Oklahoma City) said he will introduce legislation in the next session of the state legislature that will require a conviction in a court of law before anyone's assets are seized.

"If I had to err on the side of one side versus the other, I would err on the side of the Constitution,” Loveless said. “And I think that's what we need to do."

Loveless said there have been too many documented cases of abuse in Oklahoma to allow police to continue treating citizens as criminals without benefit of trial.

"We've seen single mom's stuff be taken, a cancer survivor his drugs taken, we saw a Christian band being taken. We've seen innocent people's stuff being taken. We've seen where the money goes and how it's been misspent," Loveless told a local television station.

Where it goes

As for what happens to the money seized with ERAD, 7.7% of it goes to the ERAD Group, a Texas-based company. The rest? Oklahoma Watch, an investigative journalism organization, says records show that in one recent year, 70% of all forfeiture amounts were used to fund salaries for law enforcement. 

Oklahoma law currently allows police and prosecutors to keep the money they take from citizens, even those who are never convicted or indicted, so those victimized by modern-day highway robbers basically have no recourse.

The Post's series caused a stir when it was published, but progress in cleaning up the practice has been slow. New Mexico, Montana and New Hampshire recently passed laws requiring a conviction before property can be forfeited, although the Post says New Mexico police routinely ignore the law.

The ERAD devices, by the way, can strip money off prepaid cards, but they can also decipher quite a bit of information from the magnetic strips on credit and debit cards, information police could conceivably use to track down and swipe additional assets.

ERAD claims its devices are an invaluable tool in fighting money laundering. 

"Each year, there are about $120 billion dollars moved to Mexico, Iran, Colombia, China as well as others as a result of illicit activity in the US," ERAD says on its website. "Prepaid debit cards are becoming the preferred process to move funds for pick up in these countries."

No right to privacy

ERAD CEO T. Jack Williams claimed recently at a conference that American citizens have no right to privacy when it comes to magnetic encoding on their cards, Oklahoma Watch reported.

“Prepaid cards are cash, they are not bank accounts,” Williams said. He claimed that prepaid cards are not protected by the Bank Secrecy Act and are not protected by the Constitution's Fourth Amendment protections against unreasonable search and seizure.

Brady Henderson, legal director for ACLU Oklahoma, says that's debatable and predicted Oklahoma's Department of Public Safety will find itself facing legal challenges to warrantless search and seizures using ERAD.

The situation is not unique to Oklahoma. The ERAD devices are in use around the country by "hundreds" of police agencies, Williams said, although he refused to give an exact number or name any of the police departments using the devices. 

Cracking down on data theft is kind of like squeezing a balloon: press down on a bulge in one area, and it'll only swell somewhere else.

So perhaps it's no surprise that today's Wall Street Journal reports the distressing statistic that, while brick-and-mortar merchants have been cracking down on data fraud at the checkout counter, criminals responded by attacking automatic teller machines, targeting not just bank-owned ATMs but the independently owned “cash kiosks” common in shopping malls, restaurants and other businesses.

(And that's not even counting the prevalence of hidden “skimmers” used to steal data from any ATM card swiped through them.)

Relatively easy

For a thief equipped with the right tools, it's relatively easy to steal debit card information and make counterfeit debit cards, which are then used to steal money from ATMs. The Journal said that according to FICO, the credit-scoring and analytics firm, the period spanning from January to April 9, 2015 saw more debit-card ATM attacks than any previous period in the past 20 years:

Debit-card compromises at ATMs located on bank property jumped 174% from Jan. 1 to April 9, compared with the same period last year, while successful attacks at nonbank machines soared by 317%, according to FICO. … The company declined to disclose the total number of such incidents, citing contractual restrictions with its customers.

ATM fraud has been growing overseas, too. Just last week, we reported the discovery of a new form of ATM fraud plaguing banks in Britain: thieves armed with nothing more than an iPod and a piece of plastic can spy on would-be ATM customers, steal their passcode and arrange for the machine to “eat” their cards – which are then retrieved and used to drain money from the account while the victim contacts bank personnel about their apparently faulty ATM. However, that form of fraud involves stealing and using legitimate ATM cards, not making counterfeit cards as reported by FICO.

It's important to remember that from an individual cardholder's perspective, debit card fraud is much worse than credit card fraud, because debit cards withdraw money directly from your savings accounts, whereas credit card purchases essentially borrow money from the credit card company.

This means that even if your debit-card fraudulent-charge complaint is ultimately settled in your favor, with the bank ultimately making full restitution to you – you still have to go without your money while the matter is being resolved.

If you do have a debit card, even if you're convinced that your account numbers are safe from thieves, you still need to check your account activity on a regular basis, whether you've used the card recently or not, so that if fraudulent withdrawals do occur, you can report them to your bank as soon as possible.

JPMorgan Chase will pay $100 million to settle allegations that it committed debt-collection abuses against tens of thousands of its credit card holders, California Attorney General Kamala D. Harris announced today.

The settlement specifically addresses debt collection wrongdoing that includes collecting incorrect amounts, selling bad credit card debt, and running a debt collection mill that involved illegally “robo-signing” thousands of court documents and improperly obtaining default judgments against military servicemembers.

As part of the settlement, Chase will pay $50 million in restitution to consumers nationwide, including an estimated $10 million to California consumers, and significant restitution to servicemembers in California, some of whom were on active duty when Chase obtained illegal default judgments against them. 

Chase will also pay $50 million in penalties and other payments to California, through the Office of the Attorney General. The judgment includes injunctive terms that fundamentally change Chase’s credit card debt-collection practices to prevent similar misconduct in the future, and is subject to court approval.

“Abusive and illegal debt collection practices will not be tolerated in California,” Harris said. “This settlement provides real relief to tens of thousands of Californians, including servicemembers, and prevents JPMorgan Chase from continuing  these deceptive and illegal debt collection practices.”

Robosigners

Between 2009 and 2013, Chase filed more than 125,000 credit card collection lawsuits against California consumers relying on illegally robo-signed sworn documents and provided an additional 30,000 robo-signed sworn statements in support of lawsuits filed against California consumers by third-party debt-collectors, Harris said. 

Chase also made systematic calculation errors regarding the amounts owed, and sold “zombie debts” to third-party debt-collectors that included accounts that were inaccurate, settled, discharged in bankruptcy, not owed, or otherwise not collectable, she said.

The Attorney General’s investigation and litigation further revealed that Chase sent letters to consumers that contained illegal threats and were signed by attorneys who did not review the accuracy of the information, determine if litigation was appropriate, or intend to follow through on some of the threats made.

Chase also filed false declarations regarding military service and improperly obtained default judgments against servicemembers on active duty, in violation of the Servicemembers Civil Relief Act and the California Military and Veterans Code.

Travelers beware: it looks like hackers managed once again to steal credit or debit card data from the hotel franchise firm White Lodging Services Corporation, specifically a handful of Marriott properties which White Lodging owns.

Security blogger Brian Krebs said that multiple financial institutions have noticed a pattern of fraudulent charges on cards which appear to share one trait in common: all had been used at a White Lodging-owned Marriott. (White Lodging, meanwhile, says it is investigating, but has found no sign of a new breach.)

If confirmed, this security breach would be the second one to be discovered at White Lodging properties in a little over a year. In January 2014, information came to light suggesting that hackers had managed to lift customer information from various White Lodging properties throughout most of 2013 – not just White Lodging-owned Marriotts, but certain hotels under the names Hilton, Sheraton and Westin, as well.

Now, 13 months later, Krebs' sources in financial institutions are once again seeing evidence of security breaches at many of the same White Lodging-owned hotel properties hit before:

Banking sources say the cards that were compromised in this most recent incident look like they were stolen from many of the same White Lodging locations implicated in the 2014 breach, including hotels in Austin, Texas, Bedford Park, Ill., Denver, Indianapolis, and Louisville, Kentucky.  Those same sources said the compromises appear once again to be tied to hacked cash registers at food and beverage establishments within the White Lodging run hotels. The legitimate hotel transactions that predated fraudulent card charges elsewhere range from mid-September 2014 to January 2015.

Contacted about the findings, Marriott spokesman Jeff Flaherty said all of the properties cited by the banks as source of card fraud are run by White Lodging.

So if you've stayed at a White Lodging-run Marriott hotel in the past few months – or if you merely had a drink in the hotel bar or dined in the hotel restaurant – keep an extra-sharp eye out for indications that the card you used for payment has been compromised.

“All it takes is a single insider at a company … to set an identity theft ring in motion.” That comment from Manhattan District Attorney Cyrus Vance illustrates how easy it is to have your identity stolen — or how impossible it is to avoid it.

Vance's office announced today that it had indicted five people on a total of 394 counts, for allegedly belonging to an identity theft ring that stole the identities of patients at a Manhattan dental office, and used them to fraudulently buy Apple gift cards which in turn were used to buy Apple merchandise.

According to the indictment, Annie Vuong spent six months in 2012 working as a receptionist in a dentists' office. During that time, she allegedly copied the personal identifying information of more than 250 patients, including their names, brithdays, addresses, and Social Security numbers.

Vuong then allegedly emailed the information to Devin Bazile, a former sales associate at Apple, who allegedly used the data to apply for and receive “instant credit.” The indictment also claims that three additional employees from Apple stores helped take part in the scheme.

Common scheme

In all, the group is accused of buying more than $700,000 worth of fraudulent Apple gift cards.

“Using stolen information to purchase Apple products is one of the most common schemes employed by cybercrime and identity theft rings today,” Vance said. “We see in case after case how all it takes is single insider at a company – in this instance, allegedly, a receptionist in a dentists’ office – to set an identity theft ring in motion, which then tries to monetize the stolen information by purchasing Apple goods for resale or personal use.”

Coincidentally, District Attorney Vance's office made the announcement less than one day after the Anthem insurance company admitted that hackers had successfully breached a database holding the personal information of 80 million current and former Anthem customers.

Of course, the Anthem breach impacts exponentially more people than does this small identity-theft ring which allegedly targeted a relative handful of dental patients in Manhattan. (Statistically, there's a good chance at least one of those patients had medical coverage through Anthem, too, because rare indeed is the modern American who only needs to worry about one level of identity theft.)

But those 80 million Anthem customers and couple hundred Manhattan dentists' patients have this in common: their personal information made it into the hands of thieves, yet there was nothing those customers could've done to prevent it. A chain is only as strong as its weakest link, and your personal information is only as secure as the least-secure company that has it.

The FBI has joined the discussion of the new EMV, or chip cards that are replacing credit and debit cards in the U.S.

“While EMV cards offer enhanced security, the FBI is warning law enforcement, merchants, and the general public that these cards can still be targeted by fraudsters,” the Bureau said in a public service announcement.

The EMV cards replace the traditional magnetic strip on the back with a small chip that holds encrypted data. It allows merchants to verify a card’s authenticity, providing the cardholder greater security and making the EMV card less vulnerable to hacking while the data is transmitted from the point of sale (PoS) to the issuing bank.

But the FBI says that may not be enough. It says EMV cards can be counterfeited using stolen card data obtained from the black market.

Prefers a PIN system

The FBI says the best defense is for consumers to use a PIN instead of a signature when making purchases.

“Merchants are encouraged to require consumers to enter their PIN for each transaction, in order to verify their identity,” the FBI said. “If a consumer uses a signature, merchants should ask to also see a government-issued photo identification card to verify the cardholder’s identity.”

This was music to retailers' ears, since they delivered an almost identical warning to Congress this week.

“What the FBI is saying is what the rest of the world already sees as common sense,” Mallory Duncan, National Retail Federation vice-president said. “It’s the right thing to do, and we hope the banks are listening.”

Leaving the back door open

Not using all of the card's potential security features, says Duncan, is like locking the front door but leaving the back door wide open.

“Retailers have long-argued that PINs are essential to providing cardholders with the security that they deserve,” said Brian Dodge, executive vice president of the Retail Industry Leaders Association (RILA), another retail industry trade group. “The FBI’s alert should be a wake-up call to the banks and card networks that continue to stand in the way of making PIN authentication the standard in the U.S. just as it has been around the world for years.”

The retailers complain that virtually all of the chip cards being issued in the United States are chip-and-signature rather than chip-and-PIN, leaving consumers without the option to use a PIN. By contrast, EMV cards used in 80 countries around the world for 20 years or more are routinely chip-and-PIN.

“They’re encouraging consumers to use PIN and they’re encouraging merchants to request PIN – the only thing missing is to encourage the banks to issue PIN cards,” Duncan said.

If you’re the proud owner of a chip-enabled credit card, you’ve probably noticed that not every card reader accepts the new technology. Despite having a slot for the new chip cards, many terminals still instruct customers to swipe the magnetic strip instead of dipping the chip.

Only about 17% of retail locations are currently equipped to accept chip cards. In other words, just one in five checkout lines are equipped with an activated chip card reader. 

So why is it that so many terminals are EMV compatible but haven’t yet been enabled to accept chip cards?

Wait-and-see approach

According to payments consultant Allen Weinberg, it’s because many retailers (particularly the larger ones) are taking a “wait-and-see” approach on enabling the chip card transactions. It seems they’d rather leave the task of teaching customers how to use the chip cards to other merhants.

“They see [chip cards] as just slowing down lines and chose to wait until consumers learned what to do -- and do it quickly -- at someone else’s store,” Weinberg wrote.

Weinberg notes that small businesses are another factor in the slow incorporation of EMV cards. Many of them aren’t even equipped with a chip-card enabled terminal yet.

Why? Weinberg says that like larger businesses, small business aren’t in a hurry to teach their community how to use the cards. They also either don’t think they’re at significant risk of fraud or simply weren’t aware the shift to chip cards was coming.

Cost might also be a factor for small businesses. Chip card readers and installation can cost anywhere from a few hundred dollars to thousands of dollars per terminal, as we reported. The industry average is around $2,000.

Liability shift

Now that we’re on the other side of the liability shift -- when credit card fraud became the responsibility of retailers instead of banks if they didn’t have their chip card systems running -- Weinberg says it won’t take much for merchants to “get religion,” as he puts it, and upgrade their systems. It’ll only take one instance of fraud or chargeback from people abusing the liability shift to motivate them to upgrade their terminals.

Terry Crowley, CEO of TranSend, a company that makes software to help merchants and their equipment work with the EMV standard, says there’s an invisible hand at work that is about to accelerate the incorporation of EMV cards.

“If you use a chip card at a point of sale that says swipe -- and you later say that wasn’t me -- there’s very little a merchant can do to dispute that charge,” Crowley tells Brian Krebs, adding that the "friendly" fraud is inevitable. “When people are made aware that if I swipe and I have a chip card, that lunch can be free if I’m a bad consumer.”

After this invisible hand takes hold, the U.S. will be able to jump on the chip card bandwagon with the rest of the world.

Wells Fargo says it is eliminating sales goals as it works to recover consumer confidence after it was ordered to pay nearly $200 million because its employees opened more than two million unauthorized deposit and credit card accounts.

“Our objective has always been and continues to be to meet our customers’ financial needs and drive customer satisfaction,” said CEO John Stumpf in a press release. “We are eliminating product sales goals because we want to make certain our customers have full confidence that our retail bankers are always focused on the best interests of customers.”

That may not be enough to satisfy critics, however. U.S. Senators Claire McCaskill (D-MO) and Susan Collins (R-ME) are pressing the Consumer Financial Protection Bureau for more information about the fraud, which they say may have hit seniors especially hard.

The Senate Banking Committee’s Republican majority, meanwhile, has scheduled a hearing for Sept. 20, at which it wants to grill Stumpf. Democrats on the committee had earlier called for a hearing on the giant fraud.

“We should accept nothing less than a full and transparent explanation of what went wrong, who is responsible, how to fix it, and how to prevent such fraud in the future,” the Democratic senators said earlier on Monday. Wells Fargo executives are briefing regulators this week, explaining the bank's attempts to curtail illicit activity by its employees. 

Vulnerable seniors

McCaskill and Collins are emphasizing the vulnerability of seniors to financial fraud.

“As Wells Fargo begins the long process of identifying and making restitution to the consumers who were defrauded, I want to ensure that seniors -- who are often the targets of fraud and who also can be harder to find and make whole – are adequately protected,” the senators said in a letter to CFPB Director Richard Cordray.

“I have concerns about the impact this activity has had on our nation’s senior population, especially those who do not conduct their financial business on the Internet," McCaskill and Collins said in their letter. "According to Pew Research Center, just 56 percent of adults over age 65 use the Internet."

McCaskill also asked if CFPB had worked with other branches of government to pursue civil or criminal penalties against the employees engaged in fraud. Bank employees have largely put the blame for the fraudulent transactions on bank management.

"When I worked at Wells Fargo, I faced the threat of being fired if I didn't meet their unreasonable sales quotes every day, and it's high time that Wells Fargo pays for preying on consumers' financial livelihoods," Khalid Taha, a former employee, said in a statement to Bloomberg.

Some Wells Fargo customers have complained of similar allegedly fraudulent practices.

"Twice when I was dealing with WF I had over $7500.00 stolen from my account," said Sharon of Halethorpe, Md., in a recent ConsumerAffairs review. "I believe that it was someone who was working there. What they did to me was use a forged check, that would have that check number coming up soon, take a picture of it and withdrawal the cash. Some of the checks didn't even have a signature or who it was made out to."

The CFPB said that Wells Fargo employees applied for approximately 565,000 credit cards and 1.5 million deposit accounts that may not have been authorized by consumers—sometimes illegally transferring money into those accounts in order to make them active. This sometimes resulted in overdraft or late fee charges for affected consumers. Wells Fargo was ordered to pay $185 million in fines to various entities, including a $100 million fine to the CFPB.

Just weeks after new rules went into effect for the use of credit cards with embedded security chips, the National Retail Federation (NRF) complains small businesses are being pressured to make an expensive investment without receiving the full level of security that could be provided.

NRF arranged for a small business owner to testify before Congress this week. Keith Lipert, owner of The Keith Lipert Gallery, a single-location, three-employee store in Washington, told lawmakers small businesses are being overwhelmed.

“Overwhelmed”

“The EMV transition is overwhelming and expensive for an independent, small retailer,” Lipert said. “Small retailers are entirely at the mercy and whims of the big players. We have no say and no way to use the marketplace to make our objections heard and our concerns valued.”

Retailers say the EMV cards, which have an embedded computer chip, don't go far enough to promote security. NRF wants the system to an include a PIN, which would make it less likely a lost or stolen card could be used.

Consumers may have noticed that many retail locations, especially small businesses, are still using the old “swipe” card readers, not the new “dipping” readers.

Unresponsive banks

“EMV is all new to me, and banks and the networks are not contacting small businesses to help the transition in any way,” Lipert said. “No one from my bank, processor or existing supplier even contacted me about the need to add a new EMV device, let alone a deadline by which to do so.”

The House Small Business Committee is investigating how Europay MasterCard Visa cards will affect small businesses. The hearing followed this month’s deadline set by the card industry for merchants to install chip-card readers be on the hook for fraudulent card usage.

Seven times more secure

Lipert said the EMV cards being issued by banks are chip-and-signature cards, instead of the chip-and-PIN cards used in nearly all other countries where EMV cards are used. He pointed to Federal Reserve data showing that a secure, secret PIN to approve transactions is seven times more secure than an easily forged and often-illegible signature.

Lipert also said small businesses are seeing “significant delays” in obtaining chip card readers or getting them certified once they are installed. He says small businesses just aren't a priority for hardware manufacturers.

Chip card terminal can cost as much as $2,000 when installation, software and other expenses are included.

With the holiday shopping season now in full swing, retailers are braced for the heaviest shopping days of the year.

However, the results of a recent 2015 Merchant Survey, conducted by Fattmerchant, has found that 72% percent of business owners have not yet adopted EMV-compliant technology, putting them at risk for fraudulent activity.

Since October 1, merchants have been liable for credit card fraud, a change from when the credit card companies were on the hook.

200% fraud rates

With fraud rates reaching 200% of the average rate on Christmas Eve and Christmas Day alone, Fattmerchant says businesses without EMV technology will be held financially responsible for fraudulent transactions, making these stats particularly alarming.

While there has been a lot of education and information for business owners about making the switch to EMV equipment, Fattmerchant says 36% of business owners still do not know anything about what the switch really means.

The National Retail Federation (NRF) has also expressed concern that so many retail businesses are exposed. But the trade association has also pushed hard for a revision in the EMV card system by asking that a PIN be added. Without it, the more secure chip cards can still be used if they are lost or stolen because the user just has to provide a signature, says the NRF.

Pushing for a PIN

The NRF says law enforcement also advocates a PIN for the new chip cards. The attorneys general of Connecticut, Illinois, Maine, Massachusetts, New York, Rhode Island, Vermont, Washington state and the District of Columbia recently wrote to the credit card companies urging the addition of a PIN.

“The chip-and-PIN approach is considered by many to be the gold standard currently for payment card security,” the letter said. “Countries that have implemented chip-and-PIN cards have seen significant reductions in fraudulent transactions.”

Not only have many retailers not installed the new chip card readers, many consumers are still using the old magnetic strip cards. Credit card companies have several more months in which to issue the new cards with an embedded chip.

It was announced with much fanfare last year that the exclusive deal between American Express and Costco would end on March 31, 2016, when the Citi Visa would become the only credit card accepted by Costco.

There is, however, the little matter of $1 billion.

That's the estimated size of the portfolio of loans outstanding to 51 million holders of the co-branded Amex/Costco credit card. In a statement today, just 32 days away from the announced transition date, American Express said it has concluded negotiations with Citi, which will acquire the portfolio for about $1 billion.

"The sale is expected to close June 2016, at which time all eligible Costco American Express Card cobranded accounts will be transferred to Citi. Additional details will be provided to Card Members in advance of the partnership end date," American Express said in a statement.

If that sounds to you like the March 31 date has slipped, you're probably right. Here's how Citi put it: "The transaction is expected to close in mid-2016 at which time Citi will begin issuing Costco credit cards."

Costco has not troubled itself to issue any public guidance to its members, but Citi says it will issue new Citi Visas to all eligible holders of Amex Costco cards in "mid-2016."

"We are immensely pleased to have entered into an agreement to acquire the Costco portfolio and look forward to a long-term partnership with Costco and the opportunity to deliver value, convenience and seamless service to their 51 million loyal members across the country," said Jud Linville, Chief Executive Officer, Citi Cards.

Linville said Citi is "working with Costco to provide a new value proposition to its members."

Your credit card can get you more than cash back on purchases and points toward perks. Most provide some basic rental car insurance. Some coverage is better than others.

But to make it pay, a cardholder first needs to know it exists, and then what it covers. Progressive Insurance has found that about 20% of rental car customers always pay for the damage waiver, with another 20% doing so occasionally. But since all rental car payments are made with credit cards, it is very likely most of those purchases are unnecessary.

The credit card review site CardHub has analyzed credit cards, choosing the ones that provide the most coverage for rental cars. Among individual cards, it found the cards issued by CitiGroup provide the most extensive rental car coverage.

Citi cards achieved a score of 95.5%, with American Express' 89.5% being the closest competitor. Chase cards are third, with a score of 87.5%.

MasterCard is best

Cards in the MasterCard network provide the best coverage, but all four networks are ranked fairly close together in their coverage.

The top ranked cards don't require you to sign up for the coverage. It is activated when you decline the rental car company's damage loss waiver. The best cards cover costs stemming from damage to or theft of rental vehicles, up to $100,000.

Like any insurance policy, there are some exclusions. Here's where it pays to have one of the higher-rated cards, because they have fewer exceptions to their coverage.

The average card won't cover a truck, open-bed vehicle, exotic or antique car, or even a large van or full-size SUV. The best cards do cover those vehicles, but draw the line at off-road vehicles. Another common exclusion is tire and rim damage. CardHub found that more than 60% of cards don't cover it.

Almost 40% of cards only cover domestic rentals for up to 15 days, but the best cards will extend coverage up to 31 days.

Fewer global options

You're safe with just about any card if you are renting in the U.S., but only Citi and Discover cards provide global coverage. Ireland, Israel and Jamaica are the most common exclusions among other issuers.

There is something else to understand about rental car coverage. Neither the company's damage loss waiver nor your credit card's coverage will protect you from liability in the case of an accident. You'll need to buy a liability supplement or rely instead on your personal auto insurance policy.

It should cover you but not all policies do. It is a good idea to call your insurance provider before renting a car and asking.