The long expected migration of the U.S. payment system to the Europay MasterCard Visa (EMV) smartcard standard finally appears to be gathering steam.
The Aite Group Tuesday issued a report projecting that 70% of all U.S. credit cards, and about 41% of debit cards -- 1.1 billion cards in total -- will be EMV-enabled by the end of 2015.
Interviews with 18 of the top 40 credit and debit card issuers, including 7 of the top 10, show that banks are moving full speed ahead with EMV implementation plans, Aite Group research director Julie Conroy said today. "A majority of Americans will have EMV cards in their wallets by the end of 2015," she said.
But unlike in many other countries where EMV cardholders are required to enter a Personal Identification Number (PIN) for in-person transactions, just a signature will be required in the U.S.
In fact, 13 of the 18 banks reviewed by Aite plan to issue EMV cards that require only a signature. Just one bank currently plans to issue EMV cards with a PIN requirement, while four have not decided what route to take, Conroy said.
EMV credit and debit cards use a microchip instead of a magnetic stripe to hold the data needed to process transactions. Experts consider such cards to be substantially safer than magnetic stripe cards, especially when a PIN is used.
Though other countries moved to the technology years ago, U.S. retailers and banks only began recently amid heightening credit and debit card fraud rates.
Visa and MasterCard currently require U.S. retailers to implement technology for supporting EMV transactions no later than October 2015. However, they do not require card issuers or merchants to require PINs.
After the October 2015 deadline, merchants that do not have EMV infrastructure in place will face greater liability exposure in the event of a data breach.
The move to EMV is expected to cost U.S. retailers and banks several billion dollars. An estimated 13 million point-of-sale systems around the country have to be upgraded or replaced to support EMV transactions.
Conroy expects that big banks will spend around $1.30 for each EMV card while smaller banks could pay between $3 and $5 per card. Banks and financial companies will also need to replace or upgrade ATM machines to support EMV.
Some retail groups have expressed concern over the lack of a PIN requirement. The National Retail Federation, for instance, argues that the true security benefits of EMV technology can only be realized with a PIN.
They have noted that while a signature-based EMV card will help address some kinds of fraud, such as that involving cloned cards, it can't stop crooks using card-not-present tactics in online or phone transactions.
The NRF suggest that instead of spending billions on the current U.S. EMV plan, credit card companies require other approaches, such as end-to-end encryption of card data or a PIN requirement for all transactions.
Retailers started moving more quickly toward supporting EMV adoption after a massive data breach at Target last year. Concerns over the liability impacts of such breaches appear to have convinced many merchants to migrate to EMV.
"Aite's projections provide another important data point that the migration from magnetic stripe to chip technology is well underway," said Ellen Richey, Visa's chief enterprise risk officer.
"By the end of next year, chip cards should be very real for consumers, and when widely adopted will have a dramatic impact on counterfeit fraud rates," she said in an email.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed. His e-mail address is jvijayan@computerworld.com.
See more by Jaikumar Vijayan on Computerworld.com.
Read more about security in Computerworld's Security Topic Center.