New liability rules on credit, debit card fraud take effect Thursday


2 photos
Save Story
Leer en español

Estimated read time: 4-5 minutes

This archived news story is available only for your personal, non-commercial use. Information in the story may be outdated or superseded by additional information. Reading or replaying the story in its archived form does not constitute a republication of the story.

OREM — "It's been really busy, we've had a lot of people calling in and ordering new EMV-supported equipment," says Douglas Hansen of Complete Merchant Solutions. The Orem-based company provides credit and debit card processing machines to retailers.

The banks and credit card networks have set a deadline of Thursday, Oct. 1, for merchants to upgrade their card machines to be able to accept new EMV, or chip, cards.

"Many of them [merchants] still don't quite understand how EMV is going to affect their business, so a lot of them are trying to find out what it entails," said Hansen.

The new, chip-enabled cards offer much more security than the traditional credit or debit cards that use the decades-old magnetic stripe.

"The little chip that's embedded with the card is going to hold the credit card information," Hansen said. "And, so when a transaction is occurring, it sends over that information through an encryption. So, if that card is stolen, the individuals that stole the card can't really use it because of that encrypted information."

"The embedded chip acts as a tiny computer system, slash security system," Tony Rasmussen told KSL. Rasmussen is Mountain America Credit Union's senior vice president of payment and card services.

"So, when it's used at a merchant, it actually generates a unique, one-time code every time it's used," said Rasmussen. "Unlike a magnetic-striped card, chip cards are inserted into the reader and left in the machine while the chip on the card and the terminal actually agree on a secret, one-time code that can't be copied by a bad guy. So, moving forward, as EMV technology becomes more and more prevalent, just having your card number will become less and less valuable."

Rasmussen says the old magnetic stripe technology made it easy for thieves to duplicate cards. But now, if they steal that code to try to buy something, it won't work. It would be like stealing an expired password.

"The code that's generated off the chip," said Rasmussen, "has proven to be nearly impossible to duplicate."

If merchants don't switch over to EMV card terminals by Thursday, they'll still be able to process cards with their old, magnetic stripe card readers. But they could be held liable for transactions made with phone credit or debit cards.


Unlike a magnetic-striped card, chip cards are inserted into the reader and left in the machine while the chip on the card and the terminal actually agree on a secret, one-time code that can't be copied by a bad guy.

–Tony Rasmussen, Mountain America Credit Union senior VP of card services


"There is going to be a liability shift," said Hansen. "So, any fraudulent transaction that comes through, it's going to be pressed upon more on the merchants themselves instead of the traditional card issuer and processor."

The New York Times recently reported only one in five businesses are expected to make the deadline.

"It's going to take some time," said Hansen. "It's going to be a longer period of time to get businesses to understand the importance of the safety an EMV transaction can provide."

Some experts say it could take several years before the migration to EMV is complete.

"Because the U.S. is the last major market to adopt the chip technology, rather than delay that further, we'd rather have the increased security of at least the chip and the one-time code, with the usage of the card."

Rasmussen says some merchants will have you type in a PIN, like a debit card. But most will likely have you sign instead.

"A lot of people call it Chip-and-PIN," said Rasmussen, "but in the United States, our flavor is Chip-and-Signature. There's a big debate it really is more secure. But, the one-time code associated with it will add that level of security."

(Photo: KSL-TV)
(Photo: KSL-TV)

Here are three things you should know about the change to the chip technology:

If you haven't received a new "chip" card, don't panic — the new machines can still read magnetic stripes. You'll likely get a chip card from your bank when your old one expires. Millions of cards are shipping out this week.

Gas pumps and ATMs will not be required to use EMV technology until 2017.

And the new technology does not secure online transactions.

"Unfortunately, no," said Hansen. "In order to do that, you'll have to equip every household with some sort of device to be able to insert the card. And, I don't see that happening too soon."

Rasmussen says consider using services like Apple Pay, or Visa Checkout to shop online.

"Those are examples of new services that utilize what we call tokenization to actually secure online purchases as well," said Rasmussen. "So, instead of actually using the card number to go out over the networks to get your authorization and send money where it needs to go, tokenization acts much like the chip on the card."

Photos

Related stories

Most recent Utah stories

Related topics

Utah
Sloan Schrage

    STAY IN THE KNOW

    Get informative articles and interesting stories delivered to your inbox weekly. Subscribe to the KSL.com Trending 5.
    By subscribing, you acknowledge and agree to KSL.com's Terms of Use and Privacy Policy.

    KSL Weather Forecast