This story was delivered to BI Intelligence "Payments Briefing" subscribers. To learn more and subscribe, please click here.
The US EMV migration is set to occur in several stages, and the first shift occurred for retailers in October 2015.
For gas stations, that deadline was supposed to be set for October 2017. But last week, Visa and MasterCard shifted the deadline for gas stations back to October 2020, giving their fuel clients three additional years to upgrade their pumps, according to Bloomberg.
It’s unlikely the migration would have been completed by the deadline. Visa and MasterCard likely opted to push the deadline for this reason. The upgrade is expected to cost the industry roughly $4 billion, because fuel pumps often need to be replaced in their entirety in order to upgrade to EMV. That expense, which gas station owners have complained about, combined with insufficient supply of hardware or software, meant the migration would have been incomplete by 2017. Shifting liability back in light of that could appeal to gas station owners.
But the could spike already-high US card fraud.
- EMV had the potential to reduce card fraud at gas stations, which is relatively significant. Visa’s EMV-enabled merchants saw a 43% decline in counterfeit fraud. It’s likely the fraud-reducing potential of EMV would carry over to gas stations, which currently see about $250 billion in fraud annually, according to Bloomberg. Those declines would lead to cost savings for station operators as well as payment players.
- Delaying the deadline will increase the share of fraud at gas stations. Right now, gas station skimming fraud comprises just 1.3% of total US card fraud, according to Krebs on Security. But it’s already on the rise — in Arizona, for example, select stations saw more skimming in August 2016 than they did for 2015 at large. As other payment channels become more secure, it’s likely fuel pumps will become an even larger target for fraudsters, who tend to flock to the weakest channels. That could lead to a spike in skimming over the next three years
Such a spike has the potential to be exceedingly costly for payments players. Right now, banks are responsible for the costs of fraud that occur at gas pumps, according to Chron. Following the liability shift, that changes to the non-EMV-compliant party in a fraudulent transaction. Delaying the shift means that, despite increased EMV card penetration, banks and issuers will likely continue to bear the burden of rising gas station fraud for three more years. That could become costly fast.
Fraud cost U.S. retailers approximately $32 billion in 2014, up from $23 billion just one year earlier. To solve the card fraud problem across in-store, online, and mobile payments, payment companies and merchants are implementing new payment protocols that could finally help mitigate fraud.
John Heggestuen, senior research analyst for BI Intelligence, Business Insider's premium research service, has compiled a detailed report on payment security that looks at how the dynamics of fraud are shifting across in-store and online channels and explains the top new types of security that are gaining traction across each of these channels, including on Apple Pay.
Here are some of the key takeaways from the report:
- EMV cards are being rolled out with an embedded microchip for added security. The microchip carries out real-time risk assessments on a person's card purchase activity based on the card user's profile. The chip also generates dynamic cryptograms when the card is inserted into a payment terminal. Because these cryptograms change with every purchase, it makes it difficult for fraudsters to make counterfeit cards that can be used for in-store transactions.
- To bolster security throughout the payments chain encryption of payments data is being widely implemented. Encryption degrades valuable data by using an algorithm to translate card numbers into new values. This makes it difficult for fraudsters to harvest the payments data for use in future transactions.
- Point-to-point encryption is the most tightly defined form of payments encryption. In this scheme, sensitive payment data is encrypted from the point of capture at the payments terminal all the way through to the gateway or acquirer. This makes it much more difficult for fraudsters to harvest usable data from transactions in stores and online.
- Tokenization increases the security of transactions made online and in stores. Tokenization schemes assign a random value to payment data, making it effectively impossible for hackers to access the sensitive data from the token itself. Tokens are often "multiuse," meaning merchants don't have to force consumers to re-enter their payment details. Apple Pay uses an emerging form of tokenization.
- 3D Secure is an imperfect answer to user authentication online. One difficulty in fighting online fraud is that it is hard to tell whether the person using card data is actually the cardholder. 3D Secure adds a level of user authentication by requiring the customer to enter a passcode or biometric data in addition to payment data to complete a transaction online. Merchants who implement 3D Secure risk higher shopping-cart abandonment.
In full, the report:
- Assesses the fraud cost to US retailers and how that fraud is expected to shift in coming years
- Provides 5 high-level explanations of the top payment security protocols
- Includes 7 infographics illustrating what the transaction flow looks like when each type of security is implemented.
- Analyzes the strengths and weakness of each payment security protocol and the reasons why particular protocols are being put in place at different types of merchants.
To get your copy of this invaluable guide, choose one of these options:
- Subscribe to an ALL-ACCESS Membership with BI Intelligence and gain immediate access to this report AND over 100 other expertly researched deep-dive reports, subscriptions to all of our daily newsletters, and much more. >> START A MEMBERSHIP
- Purchase the report and download it immediately from our research store. >> BUY THE REPORT
The choice is yours. But however you decide to acquire this report, you’ve given yourself a powerful advantage in your understanding of payments security.
