Credit Cards

October 1 is an important date for businesses that accept credit cards. That's when a new rule takes effect, shifting the liability for fraudulent credit card purchases from the banks to the business making the sale, if it has not installed EMV chip card technology.

Unfortunately, a survey by Wells Fargo shows small businesses, by and large, are not only unprepared – they aren't aware of what's coming.

In its quarterly Small Business Index Survey, just 49% of small business owners who accept point-of-sale card payments today report being aware of the impending liability shift, when a card issuer or merchant that does not support EMV chip card technology will assume liability for any fraudulent point-of-sale card transactions.

Financial institutions have been sending their customers new EMV chip-enabled credit and debit cards. These cards are designed to protect against fraudulent transactions by encoding cardholder information within an encrypted microchip and data that changes with each transaction.

For the cards to work, merchants must convert to new card readers or add EMV capability to their existing magnetic stripe card reader payment terminals. That costs money.

Only 31% compliance

With only three months remaining before the deadline, Wells Fargo and Gallup, which conducted the survey, found that only 31% of small business owners said that their existing credit card processing system accepts chip-enabled cards.

When asked if they plan to upgrade their point-of-sale credit card terminals to accept EMV chip cards, just 29% said they would before the Oct. 1 deadline. Another 34% said they will at some point in the future after October. Twenty-one percent said they never plan to upgrade.

"While our industry has made great progress in the last year informing and preparing small business owners for the EMV liability shift, the survey findings show us that we have more work to do," said Debra Rossi, head of Wells Fargo Merchant Services.

The bank said it is trying to build awareness, prepare small businesses for the EMV liability shift, and encourage business owners to adopt EMV chip-card technology. It has been providing EMV-capable equipment to customers since 2012.

It said all new and re-issued Wells Fargo Business Credit Cards and Business Elite Cards provided to customers are chip-enabled.

Card issuers take the lead

In fact, card issuers have been well ahead of businesses in adopting the EMV technology. Visa and Mastercard announced last year that they had formed a “new cross-industry group focused on enhancing payment system security” to spearhead adoption of the new technology, which has been in use in Europe for years.

Despite the split between businesses that intend to upgrade their payment terminals to accept EMV chip cards and those that don’t, small business owners seem to agree on one thing: when consumers buy something, they told the Wells Fargo survey takers, they prefer customers pay with cash or a check.

Why are there so few chip-enabled card readers at retailers around the country? It depends on who you ask. The nation's retailers say they've done their jobs – it's the credit card companies that have dropped the ball.

The National Retail Federation (NRF) points to a survey that found 48% of retailers have implemented the new EMV chip card system, or are expected to within weeks. A total of 86% said they expected to be EMV compliant by the end of 2016.

But the NRF said the survey also found that 57% of the retailers who had not yet implemented the new system had installed the card readers, but were waiting for certification by the credit card industry. About 60% said they had been waiting for six months or longer.

NRF says those numbers are in sharp contract to the statistics issued by the banking industry, which it says has tried to shift blame for the slow start to retailers. The survey, NRF says, found retailers are eager to begin using the chip card system since it protects them from liability connected to fraud.

Certification process

The certification process for the chip card system checks out a number of important functions to ensure the new technology is working properly. It can be a complicated process because the system must check out across multiple card platforms, including MasterCard, Visa, American Express, and Discover.

The size of the retailer can also complicate things. Big retailers with more point of sale positions take a lot more time.

Hundreds of tests may be required and the process might take two weeks or eight months. The cost to the retailer might be as little as a few hundred dollars or could run into the tens of thousands of dollars.

Visa says it's helping

Visa, meanwhile, recently announced steps it said could help speed up the implementation of the chip card technology. It said it has streamlined testing requirements, made the certification process simpler, and made commitments to improve the technology. It also said it is changing its policy to help limit exposure to counterfeit fraud liability for merchants who are not yet chip-ready.

While retailers might feel frustration at the pace, Visa maintains that progress has been “significant,” with over 300 million chip cards in the hands of consumers and 1.2 million retail locations now equipped to accept them.

But the NRF said it is disappointed the credit card industry has not provided enough personnel to make sure certification happens in a timely manner. In the meantime, it says consumers are confused as to whether they continue to swipe their cards or begin “dipping.”

Carrying a lot of cash is dangerous. Criminals may take it and so may the cops, who increasingly view having a lot of cash as evidence of wrongdoing. But now, police have added a new twist -- they've started using a scanner that lets them swipe the money right off prepaid cards.  

The device is called an ERAD -- Electronic Recovery and Access to Data machine, and Oklahoma's state police began using 16 of them last month. Hundreds of other police departments around the country are also using the device but haven't fessed up to it. 

It's all pretty simple. If a state trooper or other police officer suspects you are tied to some type of crime, he can scan your prepaid cards and seize the money on them. No formal charges, no trial, no due process.

It's an extension of a long-standing practice of shaking down anyone police think is suspicious. All too often, as the Washington Post demonstrated in a Pulitzer Prize-winning investigation a few years ago, all you need to do to look suspicious is have a lot of money.

"Different factors"

The police, of course, say the process is completely straightforward.

"We're gonna look for different factors in the way that you're acting,” Oklahoma Highway Patrol Lt. John Vincent said, according to a Washington Post report. “We're gonna look for if there's a difference in your story. If there's some way that we can prove that you're falsifying information to us about your business."

Of course, when Lt. Vincent says police will "prove" you're falsifying information it doesn't mean they'll prove it in court, where you can confront the witnesses and challenge the evidence. And that's what has critics upset.

State Sen. Kyle Loveless (R-Oklahoma City) said he will introduce legislation in the next session of the state legislature that will require a conviction in a court of law before anyone's assets are seized.

"If I had to err on the side of one side versus the other, I would err on the side of the Constitution,” Loveless said. “And I think that's what we need to do."

Loveless said there have been too many documented cases of abuse in Oklahoma to allow police to continue treating citizens as criminals without benefit of trial.

"We've seen single mom's stuff be taken, a cancer survivor his drugs taken, we saw a Christian band being taken. We've seen innocent people's stuff being taken. We've seen where the money goes and how it's been misspent," Loveless told a local television station.

Where it goes

As for what happens to the money seized with ERAD, 7.7% of it goes to the ERAD Group, a Texas-based company. The rest? Oklahoma Watch, an investigative journalism organization, says records show that in one recent year, 70% of all forfeiture amounts were used to fund salaries for law enforcement. 

Oklahoma law currently allows police and prosecutors to keep the money they take from citizens, even those who are never convicted or indicted, so those victimized by modern-day highway robbers basically have no recourse.

The Post's series caused a stir when it was published, but progress in cleaning up the practice has been slow. New Mexico, Montana and New Hampshire recently passed laws requiring a conviction before property can be forfeited, although the Post says New Mexico police routinely ignore the law.

The ERAD devices, by the way, can strip money off prepaid cards, but they can also decipher quite a bit of information from the magnetic strips on credit and debit cards, information police could conceivably use to track down and swipe additional assets.

ERAD claims its devices are an invaluable tool in fighting money laundering. 

"Each year, there are about $120 billion dollars moved to Mexico, Iran, Colombia, China as well as others as a result of illicit activity in the US," ERAD says on its website. "Prepaid debit cards are becoming the preferred process to move funds for pick up in these countries."

No right to privacy

ERAD CEO T. Jack Williams claimed recently at a conference that American citizens have no right to privacy when it comes to magnetic encoding on their cards, Oklahoma Watch reported.

“Prepaid cards are cash, they are not bank accounts,” Williams said. He claimed that prepaid cards are not protected by the Bank Secrecy Act and are not protected by the Constitution's Fourth Amendment protections against unreasonable search and seizure.

Brady Henderson, legal director for ACLU Oklahoma, says that's debatable and predicted Oklahoma's Department of Public Safety will find itself facing legal challenges to warrantless search and seizures using ERAD.

The situation is not unique to Oklahoma. The ERAD devices are in use around the country by "hundreds" of police agencies, Williams said, although he refused to give an exact number or name any of the police departments using the devices. 

Cracking down on data theft is kind of like squeezing a balloon: press down on a bulge in one area, and it'll only swell somewhere else.

So perhaps it's no surprise that today's Wall Street Journal reports the distressing statistic that, while brick-and-mortar merchants have been cracking down on data fraud at the checkout counter, criminals responded by attacking automatic teller machines, targeting not just bank-owned ATMs but the independently owned “cash kiosks” common in shopping malls, restaurants and other businesses.

(And that's not even counting the prevalence of hidden “skimmers” used to steal data from any ATM card swiped through them.)

Relatively easy

For a thief equipped with the right tools, it's relatively easy to steal debit card information and make counterfeit debit cards, which are then used to steal money from ATMs. The Journal said that according to FICO, the credit-scoring and analytics firm, the period spanning from January to April 9, 2015 saw more debit-card ATM attacks than any previous period in the past 20 years:

Debit-card compromises at ATMs located on bank property jumped 174% from Jan. 1 to April 9, compared with the same period last year, while successful attacks at nonbank machines soared by 317%, according to FICO. … The company declined to disclose the total number of such incidents, citing contractual restrictions with its customers.

ATM fraud has been growing overseas, too. Just last week, we reported the discovery of a new form of ATM fraud plaguing banks in Britain: thieves armed with nothing more than an iPod and a piece of plastic can spy on would-be ATM customers, steal their passcode and arrange for the machine to “eat” their cards – which are then retrieved and used to drain money from the account while the victim contacts bank personnel about their apparently faulty ATM. However, that form of fraud involves stealing and using legitimate ATM cards, not making counterfeit cards as reported by FICO.

It's important to remember that from an individual cardholder's perspective, debit card fraud is much worse than credit card fraud, because debit cards withdraw money directly from your savings accounts, whereas credit card purchases essentially borrow money from the credit card company.

This means that even if your debit-card fraudulent-charge complaint is ultimately settled in your favor, with the bank ultimately making full restitution to you – you still have to go without your money while the matter is being resolved.

If you do have a debit card, even if you're convinced that your account numbers are safe from thieves, you still need to check your account activity on a regular basis, whether you've used the card recently or not, so that if fraudulent withdrawals do occur, you can report them to your bank as soon as possible.

“All it takes is a single insider at a company … to set an identity theft ring in motion.” That comment from Manhattan District Attorney Cyrus Vance illustrates how easy it is to have your identity stolen — or how impossible it is to avoid it.

Vance's office announced today that it had indicted five people on a total of 394 counts, for allegedly belonging to an identity theft ring that stole the identities of patients at a Manhattan dental office, and used them to fraudulently buy Apple gift cards which in turn were used to buy Apple merchandise.

According to the indictment, Annie Vuong spent six months in 2012 working as a receptionist in a dentists' office. During that time, she allegedly copied the personal identifying information of more than 250 patients, including their names, brithdays, addresses, and Social Security numbers.

Vuong then allegedly emailed the information to Devin Bazile, a former sales associate at Apple, who allegedly used the data to apply for and receive “instant credit.” The indictment also claims that three additional employees from Apple stores helped take part in the scheme.

Common scheme

In all, the group is accused of buying more than $700,000 worth of fraudulent Apple gift cards.

“Using stolen information to purchase Apple products is one of the most common schemes employed by cybercrime and identity theft rings today,” Vance said. “We see in case after case how all it takes is single insider at a company – in this instance, allegedly, a receptionist in a dentists’ office – to set an identity theft ring in motion, which then tries to monetize the stolen information by purchasing Apple goods for resale or personal use.”

Coincidentally, District Attorney Vance's office made the announcement less than one day after the Anthem insurance company admitted that hackers had successfully breached a database holding the personal information of 80 million current and former Anthem customers.

Of course, the Anthem breach impacts exponentially more people than does this small identity-theft ring which allegedly targeted a relative handful of dental patients in Manhattan. (Statistically, there's a good chance at least one of those patients had medical coverage through Anthem, too, because rare indeed is the modern American who only needs to worry about one level of identity theft.)

But those 80 million Anthem customers and couple hundred Manhattan dentists' patients have this in common: their personal information made it into the hands of thieves, yet there was nothing those customers could've done to prevent it. A chain is only as strong as its weakest link, and your personal information is only as secure as the least-secure company that has it.

Wells Fargo says it is eliminating sales goals as it works to recover consumer confidence after it was ordered to pay nearly $200 million because its employees opened more than two million unauthorized deposit and credit card accounts.

“Our objective has always been and continues to be to meet our customers’ financial needs and drive customer satisfaction,” said CEO John Stumpf in a press release. “We are eliminating product sales goals because we want to make certain our customers have full confidence that our retail bankers are always focused on the best interests of customers.”

That may not be enough to satisfy critics, however. U.S. Senators Claire McCaskill (D-MO) and Susan Collins (R-ME) are pressing the Consumer Financial Protection Bureau for more information about the fraud, which they say may have hit seniors especially hard.

The Senate Banking Committee’s Republican majority, meanwhile, has scheduled a hearing for Sept. 20, at which it wants to grill Stumpf. Democrats on the committee had earlier called for a hearing on the giant fraud.

“We should accept nothing less than a full and transparent explanation of what went wrong, who is responsible, how to fix it, and how to prevent such fraud in the future,” the Democratic senators said earlier on Monday. Wells Fargo executives are briefing regulators this week, explaining the bank's attempts to curtail illicit activity by its employees. 

Vulnerable seniors

McCaskill and Collins are emphasizing the vulnerability of seniors to financial fraud.

“As Wells Fargo begins the long process of identifying and making restitution to the consumers who were defrauded, I want to ensure that seniors -- who are often the targets of fraud and who also can be harder to find and make whole – are adequately protected,” the senators said in a letter to CFPB Director Richard Cordray.

“I have concerns about the impact this activity has had on our nation’s senior population, especially those who do not conduct their financial business on the Internet," McCaskill and Collins said in their letter. "According to Pew Research Center, just 56 percent of adults over age 65 use the Internet."

McCaskill also asked if CFPB had worked with other branches of government to pursue civil or criminal penalties against the employees engaged in fraud. Bank employees have largely put the blame for the fraudulent transactions on bank management.

"When I worked at Wells Fargo, I faced the threat of being fired if I didn't meet their unreasonable sales quotes every day, and it's high time that Wells Fargo pays for preying on consumers' financial livelihoods," Khalid Taha, a former employee, said in a statement to Bloomberg.

Some Wells Fargo customers have complained of similar allegedly fraudulent practices.

"Twice when I was dealing with WF I had over $7500.00 stolen from my account," said Sharon of Halethorpe, Md., in a recent ConsumerAffairs review. "I believe that it was someone who was working there. What they did to me was use a forged check, that would have that check number coming up soon, take a picture of it and withdrawal the cash. Some of the checks didn't even have a signature or who it was made out to."

The CFPB said that Wells Fargo employees applied for approximately 565,000 credit cards and 1.5 million deposit accounts that may not have been authorized by consumers—sometimes illegally transferring money into those accounts in order to make them active. This sometimes resulted in overdraft or late fee charges for affected consumers. Wells Fargo was ordered to pay $185 million in fines to various entities, including a $100 million fine to the CFPB.

JPMorgan Chase will pay $100 million to settle allegations that it committed debt-collection abuses against tens of thousands of its credit card holders, California Attorney General Kamala D. Harris announced today.

The settlement specifically addresses debt collection wrongdoing that includes collecting incorrect amounts, selling bad credit card debt, and running a debt collection mill that involved illegally “robo-signing” thousands of court documents and improperly obtaining default judgments against military servicemembers.

As part of the settlement, Chase will pay $50 million in restitution to consumers nationwide, including an estimated $10 million to California consumers, and significant restitution to servicemembers in California, some of whom were on active duty when Chase obtained illegal default judgments against them. 

Chase will also pay $50 million in penalties and other payments to California, through the Office of the Attorney General. The judgment includes injunctive terms that fundamentally change Chase’s credit card debt-collection practices to prevent similar misconduct in the future, and is subject to court approval.

“Abusive and illegal debt collection practices will not be tolerated in California,” Harris said. “This settlement provides real relief to tens of thousands of Californians, including servicemembers, and prevents JPMorgan Chase from continuing  these deceptive and illegal debt collection practices.”

Robosigners

Between 2009 and 2013, Chase filed more than 125,000 credit card collection lawsuits against California consumers relying on illegally robo-signed sworn documents and provided an additional 30,000 robo-signed sworn statements in support of lawsuits filed against California consumers by third-party debt-collectors, Harris said. 

Chase also made systematic calculation errors regarding the amounts owed, and sold “zombie debts” to third-party debt-collectors that included accounts that were inaccurate, settled, discharged in bankruptcy, not owed, or otherwise not collectable, she said.

The Attorney General’s investigation and litigation further revealed that Chase sent letters to consumers that contained illegal threats and were signed by attorneys who did not review the accuracy of the information, determine if litigation was appropriate, or intend to follow through on some of the threats made.

Chase also filed false declarations regarding military service and improperly obtained default judgments against servicemembers on active duty, in violation of the Servicemembers Civil Relief Act and the California Military and Veterans Code.

British police have uncovered the latest security threat to ATM cardholders, a threat so simple from a thief's perspective that it's pretty much guaranteed to come to America — if it hasn't already.

Security-savvy ATM users have known for years now to watch out for illegal “skimmers” — electronic devices placed over a legitimate ATM-card reader to steal personal identification numbers (PINs) and other information from any swiped cards.

Many of these skimmers are small and thin enough to escape a typical ATM user's notice (unless that sharp-eyed user knows exactly what to look for) — but a thief hoping to use a skimmer generally needs either technological ability sufficient to build his own, or criminal “connections” sufficient to buy one.

No barriers

However, as Security Affairs reported yesterday, the latest criminal threat to ATM security has no such barriers to entry. An off-the-shelf iPod hidden behind a panel with a pinhole drilled in it is all it takes to make a pinhole spy camera capable of recording the PINs of anyone who visits that particular ATM.

Though there's a little more to the scam than that. Apple's iPods have been on the market for years, but only last January was the first such incident of this particular iPod-based ATM spy camera scheme discovered in Gatley, Stockport (a suburb of Manchester, England). As the oft-sensationalist Daily Mail reported last January:

These pictures show the lengths criminal gangs are going to in an attempt to steal card details at ATM machines - as a trick of using hidden iPods as spy cameras continues to spread.

It involves strapping the musical device to the roof of a cash point and setting it to record video of a person inputting their personal identification number (PIN).

The iPod is concealed in a specially-designed fascia with the camera recording through a pinhole-sized gap.

A fascia is simply a long, thin board covering the area where a wall joins a roof or ceiling — the architectural equivalent of a beveled edge, more or less.

Card-eater

So long as the thief has a few minutes of privacy, it's very easy to attach an iPod to the roof or upper wall of an ATM cash point, hidden behind a fascia of the same color. After installing this hidden camera, the fraudsters then slip a thin piece of plastic into the actual ATM card slot.

Now they're ready to pull their scam, which works like this: a victim walks to the ATM, inserts his card and types his PIN, unaware of the hidden camera recording this information. Meanwhile, that piece of plastic in the card slot traps the card inside the ATM. So the victim can't get his card out of the machine, and eventually leaves – most likely to contact the bank and complain about a faulty card-eating ATM.

Once the victim leaves, the thieves go to the ATM, retrieve the card from the slot and the PIN from the video recording, and use these to withdraw cash from the victim's account.

When British police discovered such a setup at a Barclays ATM, they immediately removed the device and informed Barclays, which in turn urged its customers to keep a sharp eye on their accounts and immediately contact the bank if they notice any signs of fraudulent activity.

And if you're an American ATM user, regardless of who you bank with, you need to do the same thing.

If you’re the proud owner of a chip-enabled credit card, you’ve probably noticed that not every card reader accepts the new technology. Despite having a slot for the new chip cards, many terminals still instruct customers to swipe the magnetic strip instead of dipping the chip.

Only about 17% of retail locations are currently equipped to accept chip cards. In other words, just one in five checkout lines are equipped with an activated chip card reader. 

So why is it that so many terminals are EMV compatible but haven’t yet been enabled to accept chip cards?

Wait-and-see approach

According to payments consultant Allen Weinberg, it’s because many retailers (particularly the larger ones) are taking a “wait-and-see” approach on enabling the chip card transactions. It seems they’d rather leave the task of teaching customers how to use the chip cards to other merhants.

“They see [chip cards] as just slowing down lines and chose to wait until consumers learned what to do -- and do it quickly -- at someone else’s store,” Weinberg wrote.

Weinberg notes that small businesses are another factor in the slow incorporation of EMV cards. Many of them aren’t even equipped with a chip-card enabled terminal yet.

Why? Weinberg says that like larger businesses, small business aren’t in a hurry to teach their community how to use the cards. They also either don’t think they’re at significant risk of fraud or simply weren’t aware the shift to chip cards was coming.

Cost might also be a factor for small businesses. Chip card readers and installation can cost anywhere from a few hundred dollars to thousands of dollars per terminal, as we reported. The industry average is around $2,000.

Liability shift

Now that we’re on the other side of the liability shift -- when credit card fraud became the responsibility of retailers instead of banks if they didn’t have their chip card systems running -- Weinberg says it won’t take much for merchants to “get religion,” as he puts it, and upgrade their systems. It’ll only take one instance of fraud or chargeback from people abusing the liability shift to motivate them to upgrade their terminals.

Terry Crowley, CEO of TranSend, a company that makes software to help merchants and their equipment work with the EMV standard, says there’s an invisible hand at work that is about to accelerate the incorporation of EMV cards.

“If you use a chip card at a point of sale that says swipe -- and you later say that wasn’t me -- there’s very little a merchant can do to dispute that charge,” Crowley tells Brian Krebs, adding that the "friendly" fraud is inevitable. “When people are made aware that if I swipe and I have a chip card, that lunch can be free if I’m a bad consumer.”

After this invisible hand takes hold, the U.S. will be able to jump on the chip card bandwagon with the rest of the world.

Bank of America has been ordered to pay $30 million for violating the Servicemembers Civil Relief Act (SCRA), which protects active-duty military personnel from abusive lending and collection practices.

The Office of the Comptroller of the Currency (OCC) levied a $30 million penalty against Bank of America and ordered it to make remediation payments to about 73,000 customers.

The bank said the action resulted from a "small number" of credit card and overdraft payments that were in default and were not handled properly under SCRA provisons. 

“We have taken significant steps over the last several years, and will take further steps now, to ensure we have the right controls and processes in place to meet – and exceed – what is required by law and what our military customers deserve and expect,” said Andrew Plepler, Bank of America Global Corporate Social Responsibility and Consumer Policy Executive.

"The issues were discovered by reviews that began in 2011; since that time, Bank of America enhanced its collections litigation and sworn documents processes and enhanced controls around SCRA across the company," the bank said in a prepared statement.

The OCC’s enforcement action also directed the bank to improve its SCRA-compliance policies and procedures for determining whether military personnel are eligible for requested SCRA-related benefits, for ensuring that the bank calculates the SCRA benefits correctly, and for verifying the military service status of servicemembers prior to seeking or obtaining default judgments on non-home loans. 

Southern and Midwestern shoppers beware: it looks like Fred's Super Dollar, a discount pharmacy and general merchandise retailer, is the latest business to lose customer payment-card data after hackers planted malware on the point-of-sale (POS) systems used in checkout lanes at Fred's locations.

Security expert Brian Krebs reports that he contacted the company last week, after “about a pattern of fraud on customer cards indicating that Fred’s was the latest victim” of malware planted on POS systems.

Fred's Inc. responded in a formal statement on Friday, admitting that:

Fred’s Inc. recently became aware of a potential data security incident and immediately launched an internal investigation to determine the scope of the issue. We retained Mandiant, a leading independent forensics firm, to examine our data security systems.

We want to assure our customers that protecting their information is one of our top priorities and we are taking this potential incident very seriously. Until this investigation is completed, it will be difficult to determine with certainty the scope or nature of any potential incident, but we will continue to work vigilantly to address any potential issues that may affect our customers.

Scope unknown

So far, that's the only information available: Fred's had a security breach, and hired investigators to look into it. The scope of the breach has not yet been determined: how long ago did the hackers plant the malware? How long were the hackers then able to monitor any transactions on those infected POS systems? And how many Fred's locations were affected?

Krebs' sources are “unclear” on that last bit, but said “the pattern of fraudulent charges traced back to Fred’s stores across the company’s footprint in the Midwest and south, including Alabama, Arkansas, Georgia, Indiana, Kentucky, Louisiana, Mississippi, Tennessee and Texas.”

So if you are or have been a Fred's shopper in any of those states, and paid with a card rather than in cash, check your card statement extra-closely to see if you can spot any fraudulent charges.

Just weeks after new rules went into effect for the use of credit cards with embedded security chips, the National Retail Federation (NRF) complains small businesses are being pressured to make an expensive investment without receiving the full level of security that could be provided.

NRF arranged for a small business owner to testify before Congress this week. Keith Lipert, owner of The Keith Lipert Gallery, a single-location, three-employee store in Washington, told lawmakers small businesses are being overwhelmed.

“Overwhelmed”

“The EMV transition is overwhelming and expensive for an independent, small retailer,” Lipert said. “Small retailers are entirely at the mercy and whims of the big players. We have no say and no way to use the marketplace to make our objections heard and our concerns valued.”

Retailers say the EMV cards, which have an embedded computer chip, don't go far enough to promote security. NRF wants the system to an include a PIN, which would make it less likely a lost or stolen card could be used.

Consumers may have noticed that many retail locations, especially small businesses, are still using the old “swipe” card readers, not the new “dipping” readers.

Unresponsive banks

“EMV is all new to me, and banks and the networks are not contacting small businesses to help the transition in any way,” Lipert said. “No one from my bank, processor or existing supplier even contacted me about the need to add a new EMV device, let alone a deadline by which to do so.”

The House Small Business Committee is investigating how Europay MasterCard Visa cards will affect small businesses. The hearing followed this month’s deadline set by the card industry for merchants to install chip-card readers be on the hook for fraudulent card usage.

Seven times more secure

Lipert said the EMV cards being issued by banks are chip-and-signature cards, instead of the chip-and-PIN cards used in nearly all other countries where EMV cards are used. He pointed to Federal Reserve data showing that a secure, secret PIN to approve transactions is seven times more secure than an easily forged and often-illegible signature.

Lipert also said small businesses are seeing “significant delays” in obtaining chip card readers or getting them certified once they are installed. He says small businesses just aren't a priority for hardware manufacturers.

Chip card terminal can cost as much as $2,000 when installation, software and other expenses are included.

It was announced with much fanfare last year that the exclusive deal between American Express and Costco would end on March 31, 2016, when the Citi Visa would become the only credit card accepted by Costco.

There is, however, the little matter of $1 billion.

That's the estimated size of the portfolio of loans outstanding to 51 million holders of the co-branded Amex/Costco credit card. In a statement today, just 32 days away from the announced transition date, American Express said it has concluded negotiations with Citi, which will acquire the portfolio for about $1 billion.

"The sale is expected to close June 2016, at which time all eligible Costco American Express Card cobranded accounts will be transferred to Citi. Additional details will be provided to Card Members in advance of the partnership end date," American Express said in a statement.

If that sounds to you like the March 31 date has slipped, you're probably right. Here's how Citi put it: "The transaction is expected to close in mid-2016 at which time Citi will begin issuing Costco credit cards."

Costco has not troubled itself to issue any public guidance to its members, but Citi says it will issue new Citi Visas to all eligible holders of Amex Costco cards in "mid-2016."

"We are immensely pleased to have entered into an agreement to acquire the Costco portfolio and look forward to a long-term partnership with Costco and the opportunity to deliver value, convenience and seamless service to their 51 million loyal members across the country," said Jud Linville, Chief Executive Officer, Citi Cards.

Linville said Citi is "working with Costco to provide a new value proposition to its members."

Your credit card can get you more than cash back on purchases and points toward perks. Most provide some basic rental car insurance. Some coverage is better than others.

But to make it pay, a cardholder first needs to know it exists, and then what it covers. Progressive Insurance has found that about 20% of rental car customers always pay for the damage waiver, with another 20% doing so occasionally. But since all rental car payments are made with credit cards, it is very likely most of those purchases are unnecessary.

The credit card review site CardHub has analyzed credit cards, choosing the ones that provide the most coverage for rental cars. Among individual cards, it found the cards issued by CitiGroup provide the most extensive rental car coverage.

Citi cards achieved a score of 95.5%, with American Express' 89.5% being the closest competitor. Chase cards are third, with a score of 87.5%.

MasterCard is best

Cards in the MasterCard network provide the best coverage, but all four networks are ranked fairly close together in their coverage.

The top ranked cards don't require you to sign up for the coverage. It is activated when you decline the rental car company's damage loss waiver. The best cards cover costs stemming from damage to or theft of rental vehicles, up to $100,000.

Like any insurance policy, there are some exclusions. Here's where it pays to have one of the higher-rated cards, because they have fewer exceptions to their coverage.

The average card won't cover a truck, open-bed vehicle, exotic or antique car, or even a large van or full-size SUV. The best cards do cover those vehicles, but draw the line at off-road vehicles. Another common exclusion is tire and rim damage. CardHub found that more than 60% of cards don't cover it.

Almost 40% of cards only cover domestic rentals for up to 15 days, but the best cards will extend coverage up to 31 days.

Fewer global options

You're safe with just about any card if you are renting in the U.S., but only Citi and Discover cards provide global coverage. Ireland, Israel and Jamaica are the most common exclusions among other issuers.

There is something else to understand about rental car coverage. Neither the company's damage loss waiver nor your credit card's coverage will protect you from liability in the case of an accident. You'll need to buy a liability supplement or rely instead on your personal auto insurance policy.

It should cover you but not all policies do. It is a good idea to call your insurance provider before renting a car and asking.