Merchants Push For Tokenization Over EMV

Retailers are fed up with hearing from banks and credit unions that they don’t care about payment-card security and fraud, Bank Info Security reported.

“It’s issuers, merchants and cardholders who bear the brunt of fraud losses in the U.S.,” said Liz Garner, VP of the Merchant Advisory Group, at a fraud summit for bankers in Los Angeles last week. “It’s in our best interest to work together to help take fraud out of the system. We absolutely can and should be able to work more closely together in the future. Information sharing is a key part of risk management.”

But at the same event, David Matthews, general counsel for the National Restaurant Association, raised some bankers’ ire when he argued that there’s a simple reason so many merchants haven’t started rolling out point-of-sale terminals that can handle EMV chip payment cards, even with an Oct. 1 deadline looming: Most smaller merchants don’t believe the cost of fraud outweighs the expense of EMV investments, he said.

Instead of EMV, merchants want non-proprietary tokenization that can protect both in-store and e-commerce transactions. EMV can’t do that, Garner said, adding that from a merchant’s perspective, card brands like Visa and MasterCard are the only ones who come out ahead in the EMV migration.

“The card brands, who don’t have the same skin in the game, control PCI-DSS and EMVCo,” Garner said, referring to the card brand-sponsored data security standards organizations. “There needs to be an open standards process in the U.S. to craft and maintain the most secure and interoperable standards, and to lay a strong foundation for mobile commerce.”

What no one disputes is that both card-issuing banks and retailers are in no hurry to support EMV cards. Optimistic estimates suggest that about half of credit and debit cards will have EMV chips by the end of 2015 — three months past the October deadline, after which liability for transaction fraud will fall on whoever hasn’t upgraded to support EMV. An even smaller percentage of merchants are predicted to be ready to accept EMV cards by then.

As of late January, only 26 percent of payment cards have been replaced with EMV versions, a survey by CreditCards.com found — and those have mostly been to users with high-value transaction histories. The banks’ explanation for not getting new cards out to more customers faster: The cost of the more expensive EMV cards outweighs the fraud risk.