Credit Cards

October 1 is an important date for businesses that accept credit cards. That's when a new rule takes effect, shifting the liability for fraudulent credit card purchases from the banks to the business making the sale, if it has not installed EMV chip card technology.

Unfortunately, a survey by Wells Fargo shows small businesses, by and large, are not only unprepared – they aren't aware of what's coming.

In its quarterly Small Business Index Survey, just 49% of small business owners who accept point-of-sale card payments today report being aware of the impending liability shift, when a card issuer or merchant that does not support EMV chip card technology will assume liability for any fraudulent point-of-sale card transactions.

Financial institutions have been sending their customers new EMV chip-enabled credit and debit cards. These cards are designed to protect against fraudulent transactions by encoding cardholder information within an encrypted microchip and data that changes with each transaction.

For the cards to work, merchants must convert to new card readers or add EMV capability to their existing magnetic stripe card reader payment terminals. That costs money.

Only 31% compliance

With only three months remaining before the deadline, Wells Fargo and Gallup, which conducted the survey, found that only 31% of small business owners said that their existing credit card processing system accepts chip-enabled cards.

When asked if they plan to upgrade their point-of-sale credit card terminals to accept EMV chip cards, just 29% said they would before the Oct. 1 deadline. Another 34% said they will at some point in the future after October. Twenty-one percent said they never plan to upgrade.

"While our industry has made great progress in the last year informing and preparing small business owners for the EMV liability shift, the survey findings show us that we have more work to do," said Debra Rossi, head of Wells Fargo Merchant Services.

The bank said it is trying to build awareness, prepare small businesses for the EMV liability shift, and encourage business owners to adopt EMV chip-card technology. It has been providing EMV-capable equipment to customers since 2012.

It said all new and re-issued Wells Fargo Business Credit Cards and Business Elite Cards provided to customers are chip-enabled.

Card issuers take the lead

In fact, card issuers have been well ahead of businesses in adopting the EMV technology. Visa and Mastercard announced last year that they had formed a “new cross-industry group focused on enhancing payment system security” to spearhead adoption of the new technology, which has been in use in Europe for years.

Despite the split between businesses that intend to upgrade their payment terminals to accept EMV chip cards and those that don’t, small business owners seem to agree on one thing: when consumers buy something, they told the Wells Fargo survey takers, they prefer customers pay with cash or a check.

Why are there so few chip-enabled card readers at retailers around the country? It depends on who you ask. The nation's retailers say they've done their jobs – it's the credit card companies that have dropped the ball.

The National Retail Federation (NRF) points to a survey that found 48% of retailers have implemented the new EMV chip card system, or are expected to within weeks. A total of 86% said they expected to be EMV compliant by the end of 2016.

But the NRF said the survey also found that 57% of the retailers who had not yet implemented the new system had installed the card readers, but were waiting for certification by the credit card industry. About 60% said they had been waiting for six months or longer.

NRF says those numbers are in sharp contract to the statistics issued by the banking industry, which it says has tried to shift blame for the slow start to retailers. The survey, NRF says, found retailers are eager to begin using the chip card system since it protects them from liability connected to fraud.

Certification process

The certification process for the chip card system checks out a number of important functions to ensure the new technology is working properly. It can be a complicated process because the system must check out across multiple card platforms, including MasterCard, Visa, American Express, and Discover.

The size of the retailer can also complicate things. Big retailers with more point of sale positions take a lot more time.

Hundreds of tests may be required and the process might take two weeks or eight months. The cost to the retailer might be as little as a few hundred dollars or could run into the tens of thousands of dollars.

Visa says it's helping

Visa, meanwhile, recently announced steps it said could help speed up the implementation of the chip card technology. It said it has streamlined testing requirements, made the certification process simpler, and made commitments to improve the technology. It also said it is changing its policy to help limit exposure to counterfeit fraud liability for merchants who are not yet chip-ready.

While retailers might feel frustration at the pace, Visa maintains that progress has been “significant,” with over 300 million chip cards in the hands of consumers and 1.2 million retail locations now equipped to accept them.

But the NRF said it is disappointed the credit card industry has not provided enough personnel to make sure certification happens in a timely manner. In the meantime, it says consumers are confused as to whether they continue to swipe their cards or begin “dipping.”

Carrying a lot of cash is dangerous. Criminals may take it and so may the cops, who increasingly view having a lot of cash as evidence of wrongdoing. But now, police have added a new twist -- they've started using a scanner that lets them swipe the money right off prepaid cards.  

The device is called an ERAD -- Electronic Recovery and Access to Data machine, and Oklahoma's state police began using 16 of them last month. Hundreds of other police departments around the country are also using the device but haven't fessed up to it. 

It's all pretty simple. If a state trooper or other police officer suspects you are tied to some type of crime, he can scan your prepaid cards and seize the money on them. No formal charges, no trial, no due process.

It's an extension of a long-standing practice of shaking down anyone police think is suspicious. All too often, as the Washington Post demonstrated in a Pulitzer Prize-winning investigation a few years ago, all you need to do to look suspicious is have a lot of money.

"Different factors"

The police, of course, say the process is completely straightforward.

"We're gonna look for different factors in the way that you're acting,” Oklahoma Highway Patrol Lt. John Vincent said, according to a Washington Post report. “We're gonna look for if there's a difference in your story. If there's some way that we can prove that you're falsifying information to us about your business."

Of course, when Lt. Vincent says police will "prove" you're falsifying information it doesn't mean they'll prove it in court, where you can confront the witnesses and challenge the evidence. And that's what has critics upset.

State Sen. Kyle Loveless (R-Oklahoma City) said he will introduce legislation in the next session of the state legislature that will require a conviction in a court of law before anyone's assets are seized.

"If I had to err on the side of one side versus the other, I would err on the side of the Constitution,” Loveless said. “And I think that's what we need to do."

Loveless said there have been too many documented cases of abuse in Oklahoma to allow police to continue treating citizens as criminals without benefit of trial.

"We've seen single mom's stuff be taken, a cancer survivor his drugs taken, we saw a Christian band being taken. We've seen innocent people's stuff being taken. We've seen where the money goes and how it's been misspent," Loveless told a local television station.

Where it goes

As for what happens to the money seized with ERAD, 7.7% of it goes to the ERAD Group, a Texas-based company. The rest? Oklahoma Watch, an investigative journalism organization, says records show that in one recent year, 70% of all forfeiture amounts were used to fund salaries for law enforcement. 

Oklahoma law currently allows police and prosecutors to keep the money they take from citizens, even those who are never convicted or indicted, so those victimized by modern-day highway robbers basically have no recourse.

The Post's series caused a stir when it was published, but progress in cleaning up the practice has been slow. New Mexico, Montana and New Hampshire recently passed laws requiring a conviction before property can be forfeited, although the Post says New Mexico police routinely ignore the law.

The ERAD devices, by the way, can strip money off prepaid cards, but they can also decipher quite a bit of information from the magnetic strips on credit and debit cards, information police could conceivably use to track down and swipe additional assets.

ERAD claims its devices are an invaluable tool in fighting money laundering. 

"Each year, there are about $120 billion dollars moved to Mexico, Iran, Colombia, China as well as others as a result of illicit activity in the US," ERAD says on its website. "Prepaid debit cards are becoming the preferred process to move funds for pick up in these countries."

No right to privacy

ERAD CEO T. Jack Williams claimed recently at a conference that American citizens have no right to privacy when it comes to magnetic encoding on their cards, Oklahoma Watch reported.

“Prepaid cards are cash, they are not bank accounts,” Williams said. He claimed that prepaid cards are not protected by the Bank Secrecy Act and are not protected by the Constitution's Fourth Amendment protections against unreasonable search and seizure.

Brady Henderson, legal director for ACLU Oklahoma, says that's debatable and predicted Oklahoma's Department of Public Safety will find itself facing legal challenges to warrantless search and seizures using ERAD.

The situation is not unique to Oklahoma. The ERAD devices are in use around the country by "hundreds" of police agencies, Williams said, although he refused to give an exact number or name any of the police departments using the devices. 

Cracking down on data theft is kind of like squeezing a balloon: press down on a bulge in one area, and it'll only swell somewhere else.

So perhaps it's no surprise that today's Wall Street Journal reports the distressing statistic that, while brick-and-mortar merchants have been cracking down on data fraud at the checkout counter, criminals responded by attacking automatic teller machines, targeting not just bank-owned ATMs but the independently owned “cash kiosks” common in shopping malls, restaurants and other businesses.

(And that's not even counting the prevalence of hidden “skimmers” used to steal data from any ATM card swiped through them.)

Relatively easy

For a thief equipped with the right tools, it's relatively easy to steal debit card information and make counterfeit debit cards, which are then used to steal money from ATMs. The Journal said that according to FICO, the credit-scoring and analytics firm, the period spanning from January to April 9, 2015 saw more debit-card ATM attacks than any previous period in the past 20 years:

Debit-card compromises at ATMs located on bank property jumped 174% from Jan. 1 to April 9, compared with the same period last year, while successful attacks at nonbank machines soared by 317%, according to FICO. … The company declined to disclose the total number of such incidents, citing contractual restrictions with its customers.

ATM fraud has been growing overseas, too. Just last week, we reported the discovery of a new form of ATM fraud plaguing banks in Britain: thieves armed with nothing more than an iPod and a piece of plastic can spy on would-be ATM customers, steal their passcode and arrange for the machine to “eat” their cards – which are then retrieved and used to drain money from the account while the victim contacts bank personnel about their apparently faulty ATM. However, that form of fraud involves stealing and using legitimate ATM cards, not making counterfeit cards as reported by FICO.

It's important to remember that from an individual cardholder's perspective, debit card fraud is much worse than credit card fraud, because debit cards withdraw money directly from your savings accounts, whereas credit card purchases essentially borrow money from the credit card company.

This means that even if your debit-card fraudulent-charge complaint is ultimately settled in your favor, with the bank ultimately making full restitution to you – you still have to go without your money while the matter is being resolved.

If you do have a debit card, even if you're convinced that your account numbers are safe from thieves, you still need to check your account activity on a regular basis, whether you've used the card recently or not, so that if fraudulent withdrawals do occur, you can report them to your bank as soon as possible.

“All it takes is a single insider at a company … to set an identity theft ring in motion.” That comment from Manhattan District Attorney Cyrus Vance illustrates how easy it is to have your identity stolen — or how impossible it is to avoid it.

Vance's office announced today that it had indicted five people on a total of 394 counts, for allegedly belonging to an identity theft ring that stole the identities of patients at a Manhattan dental office, and used them to fraudulently buy Apple gift cards which in turn were used to buy Apple merchandise.

According to the indictment, Annie Vuong spent six months in 2012 working as a receptionist in a dentists' office. During that time, she allegedly copied the personal identifying information of more than 250 patients, including their names, brithdays, addresses, and Social Security numbers.

Vuong then allegedly emailed the information to Devin Bazile, a former sales associate at Apple, who allegedly used the data to apply for and receive “instant credit.” The indictment also claims that three additional employees from Apple stores helped take part in the scheme.

Common scheme

In all, the group is accused of buying more than $700,000 worth of fraudulent Apple gift cards.

“Using stolen information to purchase Apple products is one of the most common schemes employed by cybercrime and identity theft rings today,” Vance said. “We see in case after case how all it takes is single insider at a company – in this instance, allegedly, a receptionist in a dentists’ office – to set an identity theft ring in motion, which then tries to monetize the stolen information by purchasing Apple goods for resale or personal use.”

Coincidentally, District Attorney Vance's office made the announcement less than one day after the Anthem insurance company admitted that hackers had successfully breached a database holding the personal information of 80 million current and former Anthem customers.

Of course, the Anthem breach impacts exponentially more people than does this small identity-theft ring which allegedly targeted a relative handful of dental patients in Manhattan. (Statistically, there's a good chance at least one of those patients had medical coverage through Anthem, too, because rare indeed is the modern American who only needs to worry about one level of identity theft.)

But those 80 million Anthem customers and couple hundred Manhattan dentists' patients have this in common: their personal information made it into the hands of thieves, yet there was nothing those customers could've done to prevent it. A chain is only as strong as its weakest link, and your personal information is only as secure as the least-secure company that has it.

The FBI has joined the discussion of the new EMV, or chip cards that are replacing credit and debit cards in the U.S.

“While EMV cards offer enhanced security, the FBI is warning law enforcement, merchants, and the general public that these cards can still be targeted by fraudsters,” the Bureau said in a public service announcement.

The EMV cards replace the traditional magnetic strip on the back with a small chip that holds encrypted data. It allows merchants to verify a card’s authenticity, providing the cardholder greater security and making the EMV card less vulnerable to hacking while the data is transmitted from the point of sale (PoS) to the issuing bank.

But the FBI says that may not be enough. It says EMV cards can be counterfeited using stolen card data obtained from the black market.

Prefers a PIN system

The FBI says the best defense is for consumers to use a PIN instead of a signature when making purchases.

“Merchants are encouraged to require consumers to enter their PIN for each transaction, in order to verify their identity,” the FBI said. “If a consumer uses a signature, merchants should ask to also see a government-issued photo identification card to verify the cardholder’s identity.”

This was music to retailers' ears, since they delivered an almost identical warning to Congress this week.

“What the FBI is saying is what the rest of the world already sees as common sense,” Mallory Duncan, National Retail Federation vice-president said. “It’s the right thing to do, and we hope the banks are listening.”

Leaving the back door open

Not using all of the card's potential security features, says Duncan, is like locking the front door but leaving the back door wide open.

“Retailers have long-argued that PINs are essential to providing cardholders with the security that they deserve,” said Brian Dodge, executive vice president of the Retail Industry Leaders Association (RILA), another retail industry trade group. “The FBI’s alert should be a wake-up call to the banks and card networks that continue to stand in the way of making PIN authentication the standard in the U.S. just as it has been around the world for years.”

The retailers complain that virtually all of the chip cards being issued in the United States are chip-and-signature rather than chip-and-PIN, leaving consumers without the option to use a PIN. By contrast, EMV cards used in 80 countries around the world for 20 years or more are routinely chip-and-PIN.

“They’re encouraging consumers to use PIN and they’re encouraging merchants to request PIN – the only thing missing is to encourage the banks to issue PIN cards,” Duncan said.

JPMorgan Chase will pay $100 million to settle allegations that it committed debt-collection abuses against tens of thousands of its credit card holders, California Attorney General Kamala D. Harris announced today.

The settlement specifically addresses debt collection wrongdoing that includes collecting incorrect amounts, selling bad credit card debt, and running a debt collection mill that involved illegally “robo-signing” thousands of court documents and improperly obtaining default judgments against military servicemembers.

As part of the settlement, Chase will pay $50 million in restitution to consumers nationwide, including an estimated $10 million to California consumers, and significant restitution to servicemembers in California, some of whom were on active duty when Chase obtained illegal default judgments against them. 

Chase will also pay $50 million in penalties and other payments to California, through the Office of the Attorney General. The judgment includes injunctive terms that fundamentally change Chase’s credit card debt-collection practices to prevent similar misconduct in the future, and is subject to court approval.

“Abusive and illegal debt collection practices will not be tolerated in California,” Harris said. “This settlement provides real relief to tens of thousands of Californians, including servicemembers, and prevents JPMorgan Chase from continuing  these deceptive and illegal debt collection practices.”

Robosigners

Between 2009 and 2013, Chase filed more than 125,000 credit card collection lawsuits against California consumers relying on illegally robo-signed sworn documents and provided an additional 30,000 robo-signed sworn statements in support of lawsuits filed against California consumers by third-party debt-collectors, Harris said. 

Chase also made systematic calculation errors regarding the amounts owed, and sold “zombie debts” to third-party debt-collectors that included accounts that were inaccurate, settled, discharged in bankruptcy, not owed, or otherwise not collectable, she said.

The Attorney General’s investigation and litigation further revealed that Chase sent letters to consumers that contained illegal threats and were signed by attorneys who did not review the accuracy of the information, determine if litigation was appropriate, or intend to follow through on some of the threats made.

Chase also filed false declarations regarding military service and improperly obtained default judgments against servicemembers on active duty, in violation of the Servicemembers Civil Relief Act and the California Military and Veterans Code.

Wells Fargo says it is eliminating sales goals as it works to recover consumer confidence after it was ordered to pay nearly $200 million because its employees opened more than two million unauthorized deposit and credit card accounts.

“Our objective has always been and continues to be to meet our customers’ financial needs and drive customer satisfaction,” said CEO John Stumpf in a press release. “We are eliminating product sales goals because we want to make certain our customers have full confidence that our retail bankers are always focused on the best interests of customers.”

That may not be enough to satisfy critics, however. U.S. Senators Claire McCaskill (D-MO) and Susan Collins (R-ME) are pressing the Consumer Financial Protection Bureau for more information about the fraud, which they say may have hit seniors especially hard.

The Senate Banking Committee’s Republican majority, meanwhile, has scheduled a hearing for Sept. 20, at which it wants to grill Stumpf. Democrats on the committee had earlier called for a hearing on the giant fraud.

“We should accept nothing less than a full and transparent explanation of what went wrong, who is responsible, how to fix it, and how to prevent such fraud in the future,” the Democratic senators said earlier on Monday. Wells Fargo executives are briefing regulators this week, explaining the bank's attempts to curtail illicit activity by its employees. 

Vulnerable seniors

McCaskill and Collins are emphasizing the vulnerability of seniors to financial fraud.

“As Wells Fargo begins the long process of identifying and making restitution to the consumers who were defrauded, I want to ensure that seniors -- who are often the targets of fraud and who also can be harder to find and make whole – are adequately protected,” the senators said in a letter to CFPB Director Richard Cordray.

“I have concerns about the impact this activity has had on our nation’s senior population, especially those who do not conduct their financial business on the Internet," McCaskill and Collins said in their letter. "According to Pew Research Center, just 56 percent of adults over age 65 use the Internet."

McCaskill also asked if CFPB had worked with other branches of government to pursue civil or criminal penalties against the employees engaged in fraud. Bank employees have largely put the blame for the fraudulent transactions on bank management.

"When I worked at Wells Fargo, I faced the threat of being fired if I didn't meet their unreasonable sales quotes every day, and it's high time that Wells Fargo pays for preying on consumers' financial livelihoods," Khalid Taha, a former employee, said in a statement to Bloomberg.

Some Wells Fargo customers have complained of similar allegedly fraudulent practices.

"Twice when I was dealing with WF I had over $7500.00 stolen from my account," said Sharon of Halethorpe, Md., in a recent ConsumerAffairs review. "I believe that it was someone who was working there. What they did to me was use a forged check, that would have that check number coming up soon, take a picture of it and withdrawal the cash. Some of the checks didn't even have a signature or who it was made out to."

The CFPB said that Wells Fargo employees applied for approximately 565,000 credit cards and 1.5 million deposit accounts that may not have been authorized by consumers—sometimes illegally transferring money into those accounts in order to make them active. This sometimes resulted in overdraft or late fee charges for affected consumers. Wells Fargo was ordered to pay $185 million in fines to various entities, including a $100 million fine to the CFPB.

British police have uncovered the latest security threat to ATM cardholders, a threat so simple from a thief's perspective that it's pretty much guaranteed to come to America — if it hasn't already.

Security-savvy ATM users have known for years now to watch out for illegal “skimmers” — electronic devices placed over a legitimate ATM-card reader to steal personal identification numbers (PINs) and other information from any swiped cards.

Many of these skimmers are small and thin enough to escape a typical ATM user's notice (unless that sharp-eyed user knows exactly what to look for) — but a thief hoping to use a skimmer generally needs either technological ability sufficient to build his own, or criminal “connections” sufficient to buy one.

No barriers

However, as Security Affairs reported yesterday, the latest criminal threat to ATM security has no such barriers to entry. An off-the-shelf iPod hidden behind a panel with a pinhole drilled in it is all it takes to make a pinhole spy camera capable of recording the PINs of anyone who visits that particular ATM.

Though there's a little more to the scam than that. Apple's iPods have been on the market for years, but only last January was the first such incident of this particular iPod-based ATM spy camera scheme discovered in Gatley, Stockport (a suburb of Manchester, England). As the oft-sensationalist Daily Mail reported last January:

These pictures show the lengths criminal gangs are going to in an attempt to steal card details at ATM machines - as a trick of using hidden iPods as spy cameras continues to spread.

It involves strapping the musical device to the roof of a cash point and setting it to record video of a person inputting their personal identification number (PIN).

The iPod is concealed in a specially-designed fascia with the camera recording through a pinhole-sized gap.

A fascia is simply a long, thin board covering the area where a wall joins a roof or ceiling — the architectural equivalent of a beveled edge, more or less.

Card-eater

So long as the thief has a few minutes of privacy, it's very easy to attach an iPod to the roof or upper wall of an ATM cash point, hidden behind a fascia of the same color. After installing this hidden camera, the fraudsters then slip a thin piece of plastic into the actual ATM card slot.

Now they're ready to pull their scam, which works like this: a victim walks to the ATM, inserts his card and types his PIN, unaware of the hidden camera recording this information. Meanwhile, that piece of plastic in the card slot traps the card inside the ATM. So the victim can't get his card out of the machine, and eventually leaves – most likely to contact the bank and complain about a faulty card-eating ATM.

Once the victim leaves, the thieves go to the ATM, retrieve the card from the slot and the PIN from the video recording, and use these to withdraw cash from the victim's account.

When British police discovered such a setup at a Barclays ATM, they immediately removed the device and informed Barclays, which in turn urged its customers to keep a sharp eye on their accounts and immediately contact the bank if they notice any signs of fraudulent activity.

And if you're an American ATM user, regardless of who you bank with, you need to do the same thing.

Bank of America has been ordered to pay $30 million for violating the Servicemembers Civil Relief Act (SCRA), which protects active-duty military personnel from abusive lending and collection practices.

The Office of the Comptroller of the Currency (OCC) levied a $30 million penalty against Bank of America and ordered it to make remediation payments to about 73,000 customers.

The bank said the action resulted from a "small number" of credit card and overdraft payments that were in default and were not handled properly under SCRA provisons. 

“We have taken significant steps over the last several years, and will take further steps now, to ensure we have the right controls and processes in place to meet – and exceed – what is required by law and what our military customers deserve and expect,” said Andrew Plepler, Bank of America Global Corporate Social Responsibility and Consumer Policy Executive.

"The issues were discovered by reviews that began in 2011; since that time, Bank of America enhanced its collections litigation and sworn documents processes and enhanced controls around SCRA across the company," the bank said in a prepared statement.

The OCC’s enforcement action also directed the bank to improve its SCRA-compliance policies and procedures for determining whether military personnel are eligible for requested SCRA-related benefits, for ensuring that the bank calculates the SCRA benefits correctly, and for verifying the military service status of servicemembers prior to seeking or obtaining default judgments on non-home loans. 

Southern and Midwestern shoppers beware: it looks like Fred's Super Dollar, a discount pharmacy and general merchandise retailer, is the latest business to lose customer payment-card data after hackers planted malware on the point-of-sale (POS) systems used in checkout lanes at Fred's locations.

Security expert Brian Krebs reports that he contacted the company last week, after “about a pattern of fraud on customer cards indicating that Fred’s was the latest victim” of malware planted on POS systems.

Fred's Inc. responded in a formal statement on Friday, admitting that:

Fred’s Inc. recently became aware of a potential data security incident and immediately launched an internal investigation to determine the scope of the issue. We retained Mandiant, a leading independent forensics firm, to examine our data security systems.

We want to assure our customers that protecting their information is one of our top priorities and we are taking this potential incident very seriously. Until this investigation is completed, it will be difficult to determine with certainty the scope or nature of any potential incident, but we will continue to work vigilantly to address any potential issues that may affect our customers.

Scope unknown

So far, that's the only information available: Fred's had a security breach, and hired investigators to look into it. The scope of the breach has not yet been determined: how long ago did the hackers plant the malware? How long were the hackers then able to monitor any transactions on those infected POS systems? And how many Fred's locations were affected?

Krebs' sources are “unclear” on that last bit, but said “the pattern of fraudulent charges traced back to Fred’s stores across the company’s footprint in the Midwest and south, including Alabama, Arkansas, Georgia, Indiana, Kentucky, Louisiana, Mississippi, Tennessee and Texas.”

So if you are or have been a Fred's shopper in any of those states, and paid with a card rather than in cash, check your card statement extra-closely to see if you can spot any fraudulent charges.

With the holiday shopping season now in full swing, retailers are braced for the heaviest shopping days of the year.

However, the results of a recent 2015 Merchant Survey, conducted by Fattmerchant, has found that 72% percent of business owners have not yet adopted EMV-compliant technology, putting them at risk for fraudulent activity.

Since October 1, merchants have been liable for credit card fraud, a change from when the credit card companies were on the hook.

200% fraud rates

With fraud rates reaching 200% of the average rate on Christmas Eve and Christmas Day alone, Fattmerchant says businesses without EMV technology will be held financially responsible for fraudulent transactions, making these stats particularly alarming.

While there has been a lot of education and information for business owners about making the switch to EMV equipment, Fattmerchant says 36% of business owners still do not know anything about what the switch really means.

The National Retail Federation (NRF) has also expressed concern that so many retail businesses are exposed. But the trade association has also pushed hard for a revision in the EMV card system by asking that a PIN be added. Without it, the more secure chip cards can still be used if they are lost or stolen because the user just has to provide a signature, says the NRF.

Pushing for a PIN

The NRF says law enforcement also advocates a PIN for the new chip cards. The attorneys general of Connecticut, Illinois, Maine, Massachusetts, New York, Rhode Island, Vermont, Washington state and the District of Columbia recently wrote to the credit card companies urging the addition of a PIN.

“The chip-and-PIN approach is considered by many to be the gold standard currently for payment card security,” the letter said. “Countries that have implemented chip-and-PIN cards have seen significant reductions in fraudulent transactions.”

Not only have many retailers not installed the new chip card readers, many consumers are still using the old magnetic strip cards. Credit card companies have several more months in which to issue the new cards with an embedded chip.

Due to its website going down, Target had a disappointing Cyber Monday this year; losing precious hours of shopping time means big money at this time of the year. This is nothing, though, when compared to the fiasco that the company went through in 2013 when a data breach compromised personal information for over 70 million consumers.

That debacle may finally be coming to a close soon. Target has agreed to pay $39.4 million to banks, credit unions, and lenders who are seeking reimbursement for issuing new debit and credit cards, as well as settling fraudulent charges made on consumer accounts during the 2013 holiday season.

The 2013 data breach was rather large in scope; Target estimated that at least 40 million credit cards were compromised and as many as 110 million consumers had their personal information stolen. As a result, they have beefed up security in recent years – including the installation of microchip-enabled readers at all locations.

Looking forward

Wednesday's settlement was not the first that the company reached as a result of the data breach. It reached an agreement with Visa Inc. card issuers earlier this year, paying out over $67 million. An additional $10 million dollars was paid out to shoppers as well.

Just last week the company spent $290 million in expenses related to the breach, $90 million of which it hopes will be reimbursed by insurers. Molly Snyder, a spokeswoman for Target, said that the company is “pleased that the process is continuing to move forward.”

Looking forward, the company will continue to work with financial institutions to settle all matters related to the data breach. “Financial institutions should not always have to bear the burden of extensive costs related to merchant data breaches over which they have no control,” said Charles Zimmerman and Karl Combronne, lawyers for several plaintiffs seeking a settlement.

Your credit card can get you more than cash back on purchases and points toward perks. Most provide some basic rental car insurance. Some coverage is better than others.

But to make it pay, a cardholder first needs to know it exists, and then what it covers. Progressive Insurance has found that about 20% of rental car customers always pay for the damage waiver, with another 20% doing so occasionally. But since all rental car payments are made with credit cards, it is very likely most of those purchases are unnecessary.

The credit card review site CardHub has analyzed credit cards, choosing the ones that provide the most coverage for rental cars. Among individual cards, it found the cards issued by CitiGroup provide the most extensive rental car coverage.

Citi cards achieved a score of 95.5%, with American Express' 89.5% being the closest competitor. Chase cards are third, with a score of 87.5%.

MasterCard is best

Cards in the MasterCard network provide the best coverage, but all four networks are ranked fairly close together in their coverage.

The top ranked cards don't require you to sign up for the coverage. It is activated when you decline the rental car company's damage loss waiver. The best cards cover costs stemming from damage to or theft of rental vehicles, up to $100,000.

Like any insurance policy, there are some exclusions. Here's where it pays to have one of the higher-rated cards, because they have fewer exceptions to their coverage.

The average card won't cover a truck, open-bed vehicle, exotic or antique car, or even a large van or full-size SUV. The best cards do cover those vehicles, but draw the line at off-road vehicles. Another common exclusion is tire and rim damage. CardHub found that more than 60% of cards don't cover it.

Almost 40% of cards only cover domestic rentals for up to 15 days, but the best cards will extend coverage up to 31 days.

Fewer global options

You're safe with just about any card if you are renting in the U.S., but only Citi and Discover cards provide global coverage. Ireland, Israel and Jamaica are the most common exclusions among other issuers.

There is something else to understand about rental car coverage. Neither the company's damage loss waiver nor your credit card's coverage will protect you from liability in the case of an accident. You'll need to buy a liability supplement or rely instead on your personal auto insurance policy.

It should cover you but not all policies do. It is a good idea to call your insurance provider before renting a car and asking.