PIN Is Not A Win. Merchants Don’t Get That

Don’t pin your hopes on PIN. That’s the advice of a report from the Aite Group, which claims that the cost of having to implement PIN for all card transactions, especially for merchants who don’t already have PIN pads, may just not be worth the expense considering the limited impact on fraud and merchant liability.

The report “Chip Cards in the United States: The PIN, PINless, Debit, Credit Conundrum” says because merchants misunderstand fraud and their own liability risks, a large majority (65 percent of those surveyed) are in favor of implementing chip and PIN in EMV card transactions. None of the issuers surveyed were in favor of it. We here at paymenfacilitator.com have followed this issue every step of the way.

The report has a non-monetary rebuke to the industry as well: play nice or risk robbing Peter to pay Paul (criminals).

“Strive to reduce or eliminate the level of contention between the merchant community and its lobbying organizations, and the issuers and payment networks. It is in no one’s best interest to continue a divisive war of words and litigation. The only winners in that scenario are the fraudsters: They get more time and have the opportunity to find new ways to hack the platform.”

The report’s author, Thad Peterson, tells paymentfacilitator.com that payment facilitators should be concerned with this issue in the context of online and offline business, and in general should worry more about EMV penetration rather than PIN usage.

“Since issues related to EMV are almost exclusively related to brick and mortar POS, there’s probably not a lot of impact on PFs who focus primarily on the online/mobile space,” says Peterson.  “However EMV is driving fraud online and that will increase the challenges and costs of mitigating fraud. Also the ongoing growth of mobile wallets that can effectively deliver safe and fast transactions both online and in the physical world will ultimately change the way that people pay in the online/mobile space.

“For payment facilitators offering a physical world capability in addition to online/mobile, it’s essential that they work with their merchants to get them to the point where they accept EMV transactions, with PIN available for debit transactions. That’s the priority; implementation of EMV across the ecosystem will have the greatest impact on fraud reduction in the U.S.”

Issuers prefer chip and signature for two reasons: less friction at POS, and the negative business case for changing cards to PIN verification. With chip and signature the consumer has one less point of friction; having to remember the PIN associated with the card could make consumers use a different card. The report cites one U.S. issuer’s experiment with PIN-only verification cards issued to a sample group and reported an 8 percent drop in transaction volume from the group.

As worrisome as that problem is, the projection for the costs/benefit analysis for the changes needed results in a nearly $2 billion loss. Card reissuance, customer communications and education, and system upgrades would cost $1.7 billion more than the savings in fraud avoidance.

Merchants are never liable for lost or stolen card fraud and only liable for chargebacks if they haven’t implemented EMV; those that have EMV capability are secure knowing that fraud is the problem of the system that provides payment services. Everywhere in the world EMV is used boasts reduced card-present fraud and increased card not present fraud, but the report says that if PIN was implemented tomorrow in the U.S. fraud would drop by 9 percent but would level at 2 percent because of fraudsters’ adjustments.

“The (merchants’) rationale is that it will increase security and reduce fraud for the merchants,” the report says. “Merchants misperceive how the implementation of PIN on all cards would reduce fraud or improve security. They generally overestimate the impact of lost or stolen card fraud, and a significant percentage believe that implementation of PIN for all cards would have a real impact on their fraud losses. While PIN implementation would have an impact on lost/stolen fraud, it will likely have no corresponding impact on merchant liability.”

For merchants with PIN pads, the expense to enable PIN for all cards was estimated by survey respondents to be $49 per location and $10 per terminal. Merchants without PIN pads – 40 percent of the merchant portion of the survey – would spend much more. The report estimates a total system-wide expense of more than $4.5 billion for merchants (those with existing PIN pads, those without, eating and drinking establishments purchase of tableside terminals, staff training)

Given the high cost and low impact on fraud and merchants’ liability, the report suggests that the system focus on more widespread EMV penetration and lowering card not present fraud rather than chip and PIN implementation. One of its warnings is that with the advancement of authorization tools such as biometrics and voice, PIN might become if not obsolete as an authentication option, even less worth the expense and labor than it is now.

“The payback from EMV implementation is substantially larger than any return from PIN implementation, and the net cost of adding PIN is significant, estimated to be over US$6 billion when all issuer and merchant costs are included,” the report says.