Chip-based credit cards are a decade old; why doesn’t the US rely on them yet?

In short:

Technical debt, network effects, and resistance to change.

It won't be a problem for much longer. EMV is supposed to become a standard late next year, and the "liability shift" (basically amending the processing rules so that accepting the old-style card means you're more responsible in case of fraud) is supposed to happen around that time as well.

I wish IT people had that level of control over their environments. We wouldn't be dealing with Windows XP anymore :)

As a Canadian, I've always wondered about this when I've visited the States. The transition from swipe cards to chip cards was fairly painless, from the consumer's point of view, up here.

I think what helped make it work is the prevalence of Interac. Before chip cards, you'd swipe your card, verify the amount, select an account, and enter your PIN. The only thing that changed with the chip was that you inserted your card instead of swiped.

When credit cards started getting chips, people were already familiar with the process and just needed to be issued a PIN by the credit card issuer.

Not a decade, FOUR decades. But it isn't a US patent... http://fr.m.wikipedia.org/wiki/Carte_à_puce

The fraud implications aside, as a Canadian living in the United States, I've always found the payment process much more pleasant with magstripe cards. Every time I go home, I find it incredibly inconvenient to have to dip my card in the chip reader, type in my 4 digit pin without feeling like the whole world is looking at me, and waiting for what seems like an eternity for the auth/capture to happen.

With magstripe cards, you just swipe and sign.

I had no idea that chip cards are not accepted in the US. I can't remember the last time I saw a magnetic stripe card... and I live in Serbia.

We're getting there, albeit very slowly. Almost all the new readers I see at major stores now have the slot to slide your card in for the chip and pin. Every Target store I've been to appears to have been upgraded.

Wells Fargo has also started rolling out chip and pin credit cards, not sure if it's by default or not. I've had one for probably a year now.

That being said, I have no idea if the chip and pin even works end-to-end yet, as I haven't tried it. I'm likely part of the problem!

Also, we'll see what happens with the liability shifts in the US. Right now consumers have it fairly good with regards to fraud protection and getting reimbursed.

Another reason that the article doesn't touch on: there is so much extra money sloshing around in the US system due to high interchange fees that fraud pales in comparison. I don't see how you can ignore this as a disencentive to change.

IIRC, fraudulent charges account for ~40 bp of total transaction volume, very little of which is the responsibility of the issuing institution. Interchange fees are ~200 bp of total transaction volume.

Primarily because it's a big 1 time total system cost to change due to old technology that is current. In such circumstances, no one bites the bullet unless some outside regulatory body enforces it & in the US, regulators tend to have close links if not prior & post tenure employment with the industries they regulate. It's not as much of a habit change issue as much it's an incentives issue of who wants to pick up the one time cost .

In a developing market like India & I'm seeing the big transition to chip & pin happenning right now mandated by the reserve bank. I also saw the transition to securecode additional verification for online payments happen years back similarly - that has still not happened in the Us. The decision makers there are all primarily career economists in Government Service even though there's a lot of secondment into policy framing working teams that happens from the financial industry.

The worst part is that U.S. banks are issuing "chip-and-signature" cards and NOT true chip-and-PIN cards. This is so Americans aren't inconvenienced having to remember and enter a PIN.

Combined with a smartcard reader, Cardpeek [1] can be used to see which verification methods (and their priority if there are multiple) a card supports.

A list of what types of cards banks are issuing is maintained by the flyertalk forum as a Google Spreadsheet. [2]

[1] http://pannetrat.com/Cardpeek/ [2] https://docs.google.com/spreadsheet/ccc?key=0Ani-u3tGk5hedGR...

More than a decade right?

I am a bit pissed of that our current chip cards do not implement the full security that they are technically capable of. https://www.youtube.com/watch?v=m-VRsksSgM0

In Canada we have had them for a few years, but still not all places utilize the pin. Chevron gas station for one all have the pin reader but have the card slot blocked so u have to swipe.

And if it errors on the chip read u can swipe anyways.

One annoying thing when it first came out and restaurants adopted chip readers. Many didn't have GPRS/wireless card readers. There was always a huge line to pay and u had to goto the bar or front desk to pay, no giving them the card and they bring u back a cheque.

Most places do have wireless readers now.

I like the paypass where u just tap your card but for some reason some places don't have it working

You could just put up a QR code of a bitcoin address and let people scan over that with their phone and pay in one click.

Think of the money saved! Run a bitcoin wallet on some junker computer, print out a million copies of your barcode, and off you go.

Albeit, they have to manually enter the payment amount with static wallets, the alternative is to have any kind of localized computer that can transmit to the phone the address and debit (in any form - nfc, bluetooth, wifi, qr codes, whatever).

I had my first contactless transaction a few days ago (I had seen the logo on my card, but didn't think merchants would have the machine). I'm still unsettled by the fact that there was no pin required, it felt like in the US (the merchant told me it doesn't require pin up to 20€, but it might be a bank specific or a shop specific policy).

edit: but if the US is really about to get out of conservatism, change your freaking units and mechanical standards first.

smartcards are a decade old? Try 3+ decades.

Cost of US infrastructure too high to change?

Banks pocket, depend heavily on $30B/year on bank account overdrafts alone, and have supported smartcards in Europe and around the planet for 30+ years.

Retailers prefer to be cracked (Target, etc) rather than protect themselves with better equipment and serious IT defenses.

Typical financial (payment) services: sh!tt!est possible product for lowest possible investment.

Anyone know what will happen to companies like Square that so heavily rely on the magstripe? How would square be able to capture chip and pin transactions? Because as far as I'm aware, the CC specifications require a separate hardware pin pad, (so a software keyboard can not be used to transmit the PIN)

> Some suggest that we should wait for a newer and more secure standard before expending resources shifting systems.

So Americans would continue to have cards which don't work abroad as is the case now? I know Americans notoriously don't travel very frequently but even still...

Wait, I just realized that this means I'm not going to have to keep and securely store 7 years of signed CC receipts for my business! Can't happen fast enough.

It seems like this is a good step, but it seems limited to physical card present transactions.

Does it do anything to address online purchases?

We're even at a point where our swipes have the chip slots but they have rubber inserts blocking them.

Wait, what?

South African here. We barely have broadband internet, yet we have chip-based credit cards.