Canada begins the official rollout of chip and pin following 3 years of implementation, and testing. Good stuff. However I remain befuddled by one thing, and no amount of discussion with “chip experts” removed this doubt from my mind. The issue is the retention of the magstripe on the card.
Canada begins Chip and PIN roll out
Chip cards will continue to carry the magnetic stripe to allow cardholders to use their debit cards in other countries that do not use chip technology.
By definition, that means the card can be cloned, and used in a magstripe country. We just happen to have the largest magstripe country in the world next door – USA. The US has no plans to move to chip. This is a country of 300 million people, and lots of merchants with a less than stellar record for security.
Relevance to Bankwatch:
Why can Canadian banks not issue cards with chip only. For customers who require the convenience of magstripe in the USA, charge them $20 – $40 for the extra card, with no chip. That extra card could have access to a limited amount of funds, or a limited time window to accommodate vacations. Offer up preferences in online banking to manage their magstripe preferences.
Given the fraud environment in 2008 customers would pay for that service. Until we get to 100% chip with no magstripe, fraud is just an opportunity for the bad guys.
Thoughts from the chip experts?
Bankwatch 
The major problem with the Canadian market post-CHIP is that our POS system will still need to support both CHIP and magstripe. The magstripe cards come from two sources. The first is domestic cards during the transition. I think that this transition will take longer here than it did elsewhere in the world because the majority of our back end card services providers are US based and therefore don’t have experience with the transition. As well, to date only Visa has mandated the switch to CHIP meaning that MasterCard issuers’ only incentive to switch is to not get hit by fraud migrating away from Visas.
The second is cards from the States. Because the US is our largest trading partner and a major source of tourists, we want to be able to support their payment methods (otherwise we cut ourselves off from money flowing out the States). Its difficult to force Canadians to pay extra money for the use of magstripe cards when the POS system continues to be able to support them and Americans can use the technology here in Canada for free.
Card issuers have a choice about how to handle fraud detection and funds authorization. They can apply different rules to a transaction based on presentment mechanism. They will certainly be able to tell the difference between a chip transaction and a stripe transaction. I don’t see the physical presence of the stripe to be much of an issue.
@Terry,
My assumption — and Colin’s, I would guess — is that customers will still be able to use their card, whether presenting chip or magstripe, in cross-border situations just as they do today. I’ve not heard that the issuers will limit customers who, in Colin’s scenario, take their chip card to the US and use it at a swipe terminal to pay for goods. I agree with you that if issuers did impose such limits they could mitigate losses in a magstripe-only environnment…I’d just be surprised if this was the approach right away because of the customer dissatisfaction it would cause.
@ Dan … thats exactly what I was thinking. I think with the passage of time, and the prevalence of fraud, most / many? customers would give up the convenience for the security. Most people rarely go to the US, so why build for the minority.
To share a couple of personal stories….
I tried to buy something at a major office supply store in downtown Toronto was just over $500 using my MasterCard.
The clerk politely stated “Oh we don’t take MasterCard over $300. Do you have a Visa or AMEX card?”
I was shocked, talked to the store manager and found out it was due to high MasterCard fraud. He gave me a head office number and the VP of security (or whatever the title was). A couple days later this person called me back and we had a nice hour long candid conversation on the issue once he knew I worked for a bank.
Basically he said their POS readers were not upgraded to read all ‘tracks’ on the MasterCard as it is cost prohibitive. He said that the banks are constantly pushing new technology on the merchants that come at their expense (software, hardware upgrades). In his opinion, it is the banks who gain the most with these advancements as it absolves them of liability yet they (the banks) bear none of the merchant costs in supporting these newer technologies.
In any case, apparently MasterCard has way higher fraud than Visa with this particular company. And at this specific location (University and Dundas), as well as a few others in the city, they imposed a ‘not over $300’ policy for MasterCards as it was the cheaper solution (although not a permanent one I’m sure).
Without mandatory adoption for MasterCard Chip terminal conversion, MasterCard issuing banks are setting themselves up to be targets of fraud from the Visa fallout. In turn, merchants who are exposed to bank chargebacks /losses may simply stop accepting MasterCard.
Relating directly to Chip, my recent weekend shopping excursion with my shiny new Chip debit card resulted in ONE merchant (out of about 20) that used the Chip method of purchase (upon swiping the card the terminal instructed them to insert it in the chip card reader). The rest of the store clerks only had comments such as “what does this do?” or “that is the first time I have seen one of these”. None of their terminals accepted the Chip insertion method even though I tried by inserting it in the chip reader slot on their POS terminals.
We have a ways to go yet.
@Gene …. good grief – it just gets worse. Thank you so much for sharing that obviously genuine background from an insider.
As a Brit living and working in Canada I can understand the frustration and fear of chip and pin. Back in the UK we rolled out chip and pin nationwide in 2004 we had the same fears as did the merchants.
However it is now the norm and in time it will be in Canada. Cloning will always happen, charge backs will always happen but overall I do feel more secure with my chip and pin.
It’s funny though as I still use my chip’ mastercard and visa from the UK for purchases here I always get the same replies ooh what’s this then is it real? *rolls eyes* from a selfish point of view I can’t wait til the cards are rolled out here as less people will stop assuming my card is some fake or “wont work” without even trying as it can be run on the old or new system.
“Why can Canadian banks not issue cards with chip only.”
I agree. This seems to me to be one of the main lessons learned from the U.K deployment. If people need a magnetic stripe card because they are going to Botswana or the U.S., it’s trivial to provide instant issuance of short-validity stripe cards with different PANs at a branch (or from a vending machine, frankly).
I keep thinking back to something I heard a representative from one of the big issuers say about 7 years ago, when the idea of chip was still just being introduced in Canada. He said that as daunting as credit card fraud was, if by introducing the chip they discouraged (through complexity or growing pains, presumably) even 1% of credit purchases per year, then the fraud savings wouldn’t be worth it.
Whether that’s true or not I don’t profess to know, but this gentleman stated it as a common fact shared in the industry. I certainly don’t doubt it. If it’s true, or even if it’s accepted dogma, I can understand why the issuers are reluctant to mess with the customer’s experience or risk turning customers away at the counter.
Another note: Canadian merchants are still allowed to use the clunky old imprint devices. I’ve taken three cabs in the last month that used the old ‘kachunk-kachunk-sign’ method of security. Suddenly magstripe doesn’t seem so bad…
@Dan … but the dirty liitle secret of bank’s is that every day they cancel 1,000’s of cards adn bank accounts, and and re-issue new ones to customers who ‘may’ have been compromised. No-one talks about that, but the inconvenience and sheer inefficiency of that process is maddening.
Further, the customer inconvenience for those traveling to Botswana and the US pales in the customer experience associated with the above dirty little secret.
@Mark – its not fear of chip/pin that I describe. It is fear that is doesn’t do what it promises so long as we compromise the card with the mag-stripe.
@Dave – eloquently stated.
Colin,
Not sure how we got on the topic of replacement cards, but ok. 🙂
I’m not sure what else a bank could do other than cancel the card. You said the customer may have been compromised, but as far as the issuing bank knows, it’s only the CARD that’s compromised. Short of investigating every aspect of the customer’s life, they couldn’t determine that and the best they can do is change the lock on the door: the card. Inefficient and expensive, to be certain, but I don’t think it’s a dirty little secret. More to the point, if a customer’s card were defrauded and the bank DIDN’T replace the card, the customer would be justifiably angry.
Maybe this all changes under PIN (regardless of whether the stripe lives on), I don’t know. But I don’t think the current process is quite as nefarious as you suggest!