U.S. retailers are digging in their heels over their need for PIN authentication for Europay MasterCard Visa (EMV) smartcard use here.
Visa and MasterCard want retailers to migrate to EMV smartcard-ready payment systems by October 2015, but at this point aren't requiring that a Personal Identification Number (PIN) system be used to authenticate cardholders.
EMV cards store cardholder data and other sensitive information in a tiny embedded microprocessor. Such cards are considered substantially safer than magnetic stripe cards currently used in the U.S.
But merchants maintain that the chip cards offers few new benefits without use of a PIN.
About 60 of the 80-plus countries now using EMV cards require that cardholders enter a PIN when using the card at a payment terminal.
In a statement Friday, the National Retail Federation (NRF), which represents thousands of retailers and other businesses, called on MasterCard and Visa to implement the same model in the U.S..
"We remain insistent that U.S. retailers' customers be given the same protections as consumers," in the other countries, NRF general counsel Mallory Duncan said.
"There is no single solution to the complex issue of criminal hacking and we know PIN and Chip is just a bridge on the long road to a safer payment system, but it is an important step in the right direction."
Signatures are a virtually worthless form of authentication, Mallory noted in the statement. "Insisting on chip-and-signature cards is like installing an alarm on the front door of a home while leaving the back door wide open. It doesn't make sense when the technology exists to secure the entire house," he said.
The NRF's position is similar to that of the Retail Industry Leaders Association (RILA). RILA also argues that MasterCard and Visa's EMV mandate leaves gaps in payment card security.
In a recent interview with Computerworld, Visa Chief Risk Officer Ellen Richey downplayed such concerns , contending that they are based on an incomplete understanding of EMV technology. Richey said smartcards offer significant security benefits over magnetic stripe technology regardless of whether a PIN is used.
She said that smartcards have all but eliminated fraud involving the use of counterfeit or cloned debit and credit cards.
PIN-based authentication can help prevent fraud involving cards that are lost or stolen. But that type of fraud is relatively uncommon, and preventing it is not a big enough concern to merit the additional investments in the systems necessary to support the use of PINs, Richey said.
Seth Eisen, senior business leader with MasterCard North American Markets, on Friday said the EMV implementation model for the U.S. allows retailers and issuing banks to decide on their own whether to use a PIN.
Concerns about the the lack of a PIN requirement are also overstated he said. Currently, under MasterCard's zero-liability policy for instance, consumers are not responsible for any fraud that might result from the misuse of their card.
Craig Shearman, vice president of government affairs public relations at the NRF, Friday insisted that a mandatory PIN requirement for U.S. EMV implementation is needed.
"Right now, chip cards are difficult to counterfeit, but there are ways around the chip," he said.
"And criminals will eventually find a way to counterfeit them," he said noting that the technology has already been in use for more than a decade. "Once they find a way around the chip, if you don't have the PIN the chip card can still be used to commit fraud. So it's not just a matter of stolen physical cards."
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His email address is jvijayan@computerworld.com.
Read more about security in Computerworld's Security Topic Center.