Apple #722: Chip Cards

This entry may not seem very Christmas-y, but as I've been out & about Christmas shopping, I've encountered a lot of different kinds of credit card readers, so maybe this is timely.  So, here's the question at hand: what's up with the new credit cards with the chips in them?  How come sometimes I'm supposed to swipe them as always, but other times I'm supposed to stick them into the reader and let them stay there a while?



More credit card terminals are starting to look like this. They could allow you to swipe the card at the right, or insert it into the slot beneath the keypad. How do you know when to do which?
(Photo by VISA, sourced from USA Today)

What Are These Cards?

• The new chip cards are referred to by the industry as EMV credit cards.  EMV stands for Europay, MasterCard, and VISA.  These three big-wigs in the credit card industry got together and settled on this technology for all of them to use going forward.

• Other names for these cards include

• chip cards
• smart cards
• smart-chip cards
• chip-enabled cards
• chip-and-choice cards
• chip-and-PIN cards
• EMV smart cards
• EMV cards 

Generic chip card. The computer chip is the shiny silver thing at the left above the numbers.
(Image from Maui Maui.org)

• For years -- too long, actually -- credit cards in the U.S. have used the magnetic stripe on the back as a way to communicate information from the card to the user's account.  Every time the stripe gets swiped, it communicates the same information. This is what made it very easy for thieves to skim the data and use it again, nefariously and fraudulently.

• Credit card companies in Europe switched over to the chip years before the companies here did. (Why did the U.S. companies delay? 'Cause it would cost money, that's why.)  Finally, after a lot of really enormous and expensive thefts, the U.S. companies got their act together and decided to make the upgrade.

• The new cards have a computer chip in them.  Where the magnetic stripe sends the same information with every transaction, the computer chip creates a more complex code unique to each transaction. 

The chip may look like any of these shiny squares or circles on the front of the card.
(Image from NerdWallet)

• Let's say you bought a doughnut maker at Target and paid for it with your chip card, and then some nefarious thief got hold of the data from that transaction. If the thief tried to use that information from your doughnut maker transaction for his own purposes, let's say to buy many rubles' worth of dog food, it wouldn't work because that particular complex code had already been used in your doughnut-maker purchase.

• In other words, the data from the chip cards is much harder to counterfeit. So until the hackers figure out a way around this, we will hopefully have fewer enormous and costly data breaches for a while.

How Do You Use Them?

• Use the chip cards in any circumstance when you would use any credit or debit card. The difference depends on the type of reader the retailer has.

• The plan is for every retailer to have a terminal that is updated to accept the chip cards and use them in the way they're meant to be used.  It's taking a while for everybody to make the transition.

• With the updated terminals, instead of swiping the card, you'll stick the card into a slot in the terminal. Then you have to let it sit in there for a while because two things have to happen. The terminal has to read the chip's information, and then the chip in the card and the terminal have to talk to each other so the transaction can be verified.

• Most terminals will beep or do something to let you know when it's OK to remove the card from the reader.

Using a chip card reader, or "dipping."
(Photo from VISA)

• This business of inserting the card into the reader is referred to as "dipping" or "chip-and-dip."

• Once you take the card out of the reader, in most cases you will still have to sign the receipt. Your signature is another level of verification that yes, you are the person who conducted this transaction and yes, you approve it.

• Debit cards will be getting the chips in them too, though it's going to take more time for banks to get this technology in place.  When you get your chip debit card, you'll still have to enter your PIN with the chip card readers the same way you do with the magnetic stripe readers.  Like a signature, the PIN is your verification that yes, you are the person who made this person and yes, you approve it.

Variations on the Dipping Process

• Retailers are still in the process of switching over to the new terminals, and they are allowed to make that transition gradually.  So you may encounter a machine that has a slot in the bottom of it, but the retailer isn't ready for people to use that yet, so you'll still have to swipe your card.

• One thing to note is that if the terminal has a card slot but accepts swiping-only, it's recording the static magnetic information, as opposed to doing the more complex chip-enabled transaction. So you're not getting the increased level of security that the chip card can provide.

• Other retailers may decide to go with contactless card readers. These smaller readers use near-field communication technology and are mainly designed to be used for mobile payments (with your phone). They still use the computer chip technology to create the transaction code; they just handle the business of collecting the information from your card in a different way.

The contactless chip reader (this one made by The Square) still uses chip card technology for each transaction, but allows you to do so with your phone.

(Photo from The Square)

• Contactless readers also have a slot into which the plastic cards can be inserted. These would be very handy for the small business person or artist who's working at a fair or someplace where they don't have a lot of room or aren't working from a fixed location.

• In the future, all the chip cards will also be required to have PINs as an additional level of security.  This is expected to be phased in about two or three years from now.  Some retailers, especially those in Europe, are ahead of everyone else and they're already requiring PINs.  So you may be asked for a PIN for your chip credit card.  But this isn't happening very often yet in the U.S.

When Will the Transition Be Complete?

• It's hard to estimate when most retailers will have the chip-enabled terminals in place and working as they should.  But the industry has already given one deadline: As of October 1, 2015, whichever party in a transaction is the least EMV-compliant will be liable in the event of fraud.

• That is, if you paid for your doughnut maker after October 1, 2015 with a card that had a chip in it, and the store where you bought the doughnut maker did not have a chip-enabled reader but only a magnetic-strip reader, and someone stole your credit card data and bought something with it, then the store has to reimburse you for the amount that was stolen because they didn't have the EMV reader enabled at the time of the transaction.

• Up to now, it's always been the credit card company who paid for the cost of the fraud. But now that they have this advanced technology, they're putting some of the burden back on the stores. It can get really expensive really fast to cover the cost of credit card fraud, so it's in the stores' interest to convert to the new machines and get them working with the new chip technology as they should.

• Other types of credit card readers have other deadlines associated with them. 

• ATMs -- liability switches to the owner of the ATM (could be a store, could be a bank; wherever the ATM is situated) October 1, 2016

• Gas pumps -- liability switches to the gas stations October 1, 2017

• No store or ATM or gas station is required to switch to a chip card reader. Because the cost of covering credit card fraud can get very expensive very fast, it would be cheaper in the not-very-long run for them to do so. But they don't have to make the switch.  If you go to a store and they don't have a chip card reader and you really wish they did, you can't go yelling at them about it because it's their choice not to offer that technology.

• You could put pressure on them, though, and ask when they'll have their readers chip-enabled. 

• Or you could pay with cash. That will really throw them for a loop. At a coffeehouse last night, I paid for my $2.10 mug of tea with a $5 bill. The cashier could not make change. She had no idea how much to give back to me. She said she needed a piece of paper and a pen to figure it out. Someone came to help her, and she still got it wrong. Technology, slowly making us all dumber.

Gas pumps are going to get chip card readers, too, but probably not for a couple years yet. This person is paying with a card that has a chip in it, but the reader in the pump is still a magnetic stripe reader. So the customer is not getting the benefit of the additional security that the chip card could provide.
(Photo was at Gas Buddy in November 2009, but they've removed the post) 


Sources
CreditCards.com, 8 FAQs about EMV credit cards
Chase, FAQ: Chip-Enabled Card Acceptance (EMV)
The Square, Everything You Need to Know About the Switch to Chip Cards
NerdWallet, NerdWallet's Best EMV 'Chip With Signature' Credit Cards
Verifone, EMV Key Dates Chart-Card Networks