As all eyes in the US cybersecurity world scan the horizon continuously for yet another malware/ransomware attack, one seemingly simple fix to a major source of cybercrime is yet to be fully implemented by the very industry it is meant to protect: retailers. And consumers, until recently, are the ones who are suffering.
US retailers have yet to fully convert to EMV chip card readers, (Europay, MasterCard and Visa, the global standard for chip-based credit and debit cards) and are still offering their customers the magnetic stripe option, which have been the source of numerous data breaches. Cybercriminals only have to load their malware onto POS terminals, then remotely collect customer data from every card swiped.
The data is sold and typically encoded onto cards with magnetic stripes, which are much cheaper and easier to clone than cards with chips, which is what makes EMV cards a more secure option.
In many European countries, as well as our neighbor to the north, consumers are in this respect better protected than our US consumers.
According to a March story on credit.com, EMV cards are so prevalent in Europe and Canada that when US travelers present our current magnetic stripe cards, many clerks don’t know how to handle them, a situation comparable to using a flip phone in a smartphone world.
EMV cards are a joint effort to create a secure environment in which the major cards can be used globally. As stories of mass data breaches at major retailers such as Target and Home Depot, online sellers like eBay and many smaller establishments make the news on a regular basis, questions arise regarding the seeming reluctance of US retailers to jump on board the chip card bandwagon.
In October, a deadline was supposed to usher in the era of EMV cards in the US. According to the industry group EMV Migration Forum, there are approximately 5 million terminals in US retail outlets today, but only perhaps 1 million have started accepting chips. So if you find a chip reader at your local market, odds are you won’t be able to use it.
According to a CNBC report, some major retailers that don’t accept chip cards yet: Costco, Kmart, Safeway, CVS, Kohl’s, Marshall’s, PetSmart and more.
When the deadline hit, new rules also went into effect that mandate retailers who haven’t updated their systems to cover the costs of fraudulent transactions. Before that, it was usually banks and financial institutions that shouldered the burden. It could be said, then, that now retailers are suffering doubly for a lack of action – not only do their reputations and consumer confidence take a hit, but now there are additional, possibly severe, financial consequences.
So why aren’t retailers rushing to flip the switch from swipe to insert? Well, they are…but there are complications. Industry experts initially attributed the delay to the investment retailers have to make in the new card readers, approximately $500 per checkout station. But seemingly, the real hurdle is in getting the new systems certified as EMV compliant. There are a relatively small number of firms that certify systems, and as more and more retailers seek certification…well, you get the picture.
Industry predictions are that perhaps a fifth of retailers will be up and running with the new system by the end of the year, and by the end of 2017, perhaps 75-90%. In the meantime, there are security solutions available for retailers large and small, including Comodo’s own SecureBox.
