The rollout of smart-chip cards and chip reader in-store payment terminals in the U.S. hasn't been easy -- to put it mildly.
Saturday, Oct. 1, marks a full year since banks and card companies mandated that retailers install new, more secure chip-based credit and debit card readers -- and adopt related new payment processes -- to avoid liability for fraudulent card payments.
After a year of software and equipment certification backlogs, consumer angst and some mid-course corrections made by card companies in June, slow progress is being made toward a full rollout to replace insecure magnetic stripe cards and readers, all sides agreed in a series of interviews. Their collective best guess is that it will take another 18 months to three years for massive adoption of chip cards and readers to succeed in the U.S.
"I would describe the chip technology rollout as making progress, but it's been a pretty bumpy ride for the past year as we worked through...issues that have come up," said Randy Vanderhoof, director of the U.S. Payments Forum, in an interview. The Forum, formerly called the EMV Migration Forum, includes members from a broad swath of card companies, banks, merchants and others.
"Chip-card acceptance numbers are continuing to climb each month and that's encouraging," Vanderhoof said. "The sun will come out tomorrow, but we're not there yet." All told, around a third of card readers in the U.S. are now chip-enabled, although the numbers differ between Visa and Mastercard, for instance.
Consumers today are still apt to see small retail stores that haven't installed point-of-sale terminals able to accept chip cards. At others, customers encounter newer payment terminals that have tape covering the slot where a chip card could be inserted, forcing the customer to rely on the old magnetic-stripe reader instead.
Steps that major card companies took in June to speed up certifications of chip-reader software and other improvements have helped significantly. Among those changes: It now can take less than 3 seconds to make a chip-card payment, down from as high as 12 to 17 seconds, depending on the store.
Big retailers like Walmart were well ahead of the game and seem to have streamlined the chip-card payment process.
Analysts agree that many retailers -- other than the largest like Walmart -- got a late start on the chip-card reader conversion prior to the Oct. 1, 2015 deadline, partly because equipment was costly and installations were complex. Then, in early January, merchants began facing long backlogs to get the equipment and software certified.
"The bottom line is that this process has been very challenging, but progress is being made," conceded Mallory Duncan, general counsel for the National Retail Federation, which represents 18,000 retailers. He spoke in an interview earlier this week.
"Retailers are still very upset at the behavior of the card companies and banks -- for different reasons. The whole conversion process was conceptually flawed from the beginning," he said; in fact, some NRF members still have not completely bought into the idea.
The conversion has spawned several lawsuits against card companies by retailers that are long-time enemies over "swipe fees" -- the charges merchants pay card companies for each card transaction. Home Depot sued Visa and Mastercard in June, similar to a Walmart suit in May, primarily over whether the inconvenience and expense of installing new chip reader technology will truly result in technology that's secure enough.
Retailers generally want banks and card companies to require chip-and-PIN (Personal Identification Number) credit card security to buy something, not just chip-and-signature. Having a PIN atop chip security would help guard against the theft of a card from a purse or gym locker and improve online payment security, Duncan said.
NRF estimates the cost to install equipment and software needed for card readers will reach $30 billion to $35 billion in the U.S.
"It's a $30 billion Edsel," Duncan said. "And our customers are putting up with it."
Card companies have defended using signatures instead of PIN partly for customer convenience, since many customers would have to keep track of the PIN specific to a particular card, atop all the other PINs and passwords that modern consumers with smartphones and computers must remember.
Card companies cite progress
For their part, both Mastercard and Visa have denied virtually all the arguments used against them by retailers in their filings in the recent lawsuits. While noting that much of the rest of the world has moved to chip-card technology, both card companies recently said the chip-card and payment-terminal rollout is making significant progress in the U.S. Still, both admit there have been problems.
Visa said this week that nearly 1.5 million businesses are chip-reader enabled, representing about 37% of the dollars spent with Visa cards in stores.
Visa also said that counterfeit fraud, in terms of dollars lost at stores that have chip-card technology, had dropped 47% in May, compared to a year earlier.
Earlier in September, Mastercard reported similar results, saying that chip-active terminals had reached 2 million business locations on the Mastercard network, about one-third of all U.S. merchants.
Also, Mastercard said counterfeit fraud costs had declined by 54% in April, compared to a year earlier, for stores that have chip card terminals.
Mastercard added that 87% of Americans commonly use chip cards now, up from 49% in 2015, according to a survey of 1,000 U.S. consumers. This number takes into account consumers with all credit cards, not just Mastercard.
Even so, another survey of 1,000 U.S. shoppers conducted in early September found 83% of shoppers were confused about whether retailers will accept chip cards or not. The survey, by Research Now on behalf of payment technology provider Cayan, also found that if a chip card transaction takes more than five seconds, it will jeopardize a shopper’s loyalty to a store brand.
Both card companies have cited the complexity of the rollout in the U.S. A Mastercard blog focused on consumers, for example, notes that "figuring out whether to insert or swipe your card at any given store is frustrating, but more and more stores are updating to new terminals."
The blog adds that paying with a chip card will take a few seconds longer than with a mag-stripe card. "The process will feel more natural in time, but as with anything new, there is an adjustment period."
"We know things won't change overnight," said Craig Vosburg, president of North America for Mastercard, in a statement.
Visa sounded a similar tone.
"From a consumer perspective, this is a process. It's certainly going to be some time before things stabilize," added Stephanie Ericksen, vice president of risk and authentication products at Visa, in an interview. "There have been some lessons learned. There's going to be a different experience at different merchants and the dialog continues about how to best do this."
She added: "Based on the complexity of the U.S. environment and the number of participants in the payment system, we think things are going well and are on track. We're already reaping benefits."
The card companies use a metric known as "chip on chip" to measure the overall impact of the rollout, which refers to the percentage of a card company's total payment volume that is recorded from chip cards using chip-reader terminals. For Visa, that value in the U.S. has reached about 30% after a year of rollouts, Ericksen said. That puts the U.S. in a good light when compared to earlier rollouts of chip technology in Brazil, Canada and Australia -- where it took about three years to reach 60% of domestic payment volume of chip on chip.
"We've focused to move to [chip technology] as quickly as possible," she added.
Other industry assessments vary
While the discomfort and confusion for consumers will continue a while longer, security experts believe the change to chip cards will be worthwhile.
One security company, Trustwave, regularly performed forensic investigations of credit card theft for Australian companies in 2011 before that country's shift to chip-card technology. "Now, post-chip, we do no investigations like that," said Michael Petitti, senior vice president of global alliances for Trustwave, in an interview. "We will see that trend in the U.S. as well."
Petitti agreed to some extent with merchants about the need for chip and PIN. "Chip and signature is a step in the right direction, but customers still need to be vigilant. Chip and signature is not as a secure as chip and PIN."
Analysts who study payments in the U.S. have generally been critical of the chip technology rollout and are outspoken about it.
"Chip compatibility today varies widely from merchant to merchant, creating a horrendous experience," said Jordan McKee, an analyst at 451 Research. "There is simply no way for a consumer to know what to expect prior to arriving to the point of sale."
He predicted that it will take another 18 months, in the best case, before the chip technology rollout "resembles anything close to a coherent, uniform process in the U.S."
McKee said chip technology has made "some nominal improvement" to reducing card fraud "but until merchant acceptance becomes ubiquitous, we won't see meaningful results." By ubiquitous, he means over 90% merchant implementation.
James Wester, an analyst at IDC, said in an interview that he's had to tone down his comments about the rollout, but called the rollout "largely unsatisfactory" in a July report. He blamed the card companies for implementing a rollout plan with "very little input from important stakeholders, namely merchants."
But he also spread the blame. "The fault for the mess...can be shared by many parties," he said, including card companies, banks, intermediaries called "merchant acquirers" and merchants themselves.
"The rollout of chip cards into the U.S. market has been a mess," Wester added. "The good news is that issues will be ironed out over time."
Jack Gold, an analyst at J. Gold Associates, said, "Most consumers in the U.S. see chip cards as a pain ... and it has made some stores say, 'Why should I install something that makes my customers unhappy?' "
Worries over chip cards at gas pumps linger
While consumers slowly learn to accept chip cards at sales terminals in stores, there's hope that the transition in coming months to chip cards for use at ATMs and gas station self-service pumps will go more smoothly.
Mastercard has imposed a mandate of this Saturday -- October 1, 2016 -- for its chip cards to be used at ATMs, while Visa has imposed its ATM mandate for Oct. 1, 2017. Analysts widely agree that ATM chip-reader rollouts, especially for ATMs in bank branches, will go smoothly.
However, chip-card payments at gas pumps could be thornier.
"The possibility of potential problems at the pump is real," Wester said, but at least the retail experience has shown where the biggest problems could be and how best to educate consumers. Self-service pumps must function in all types of outdoor conditions, and conversions will be expensive.
The chip card rollout at the gas pump "still has a long way to go and there are real challenges because of some of the complexities in the infrastructure with pay at the pump," Vanderhoof agreed.
Gas pumps must accept chip cards by Oct. 1, 2017, or dealers without an upgrade will assume card fraud liability.
The transition is bound to happen, even with all the bumps. Like most any new technology, Gold said, "the longer chip cards are in use, the more consumers will get used to using them despite delays in checkout."