Credit cards with chips no fraud fix, experts say

You might have received a new credit card in the mail with a tiny metal chip in it — a feature your bank said makes it more secure.

But don't get lulled into a sense of false security, experts say. The cards are an improvement, but not as much as you might think.

“We're going from a 1950s technology to a 1980s technology. There's nothing radical or new about this,” said Nick Holland, head of payments research at Javelin Strategy and Research in Boston. “We're in this congratulatory cycle right now about moving to (chip) technology. But it's an 8-track compared to what's happening in other markets.”

European consumers have used chip cards for years. The technology, known as EMV, makes it more difficult for thieves to replicate cards using stolen data. EMV was named after its original developers: Europay, MasterCard and Visa.

Banks are rolling out the advanced cards before an October deadline, when fraud liability in most cases will shift to merchants from card-issuing banks.

PNC said it will begin issuing cards with chips this month, joining other banks, such as J.P. Morgan Chase and Bank of America.

The push is aimed at enhancing security because of breaches like those at Target, Home Depot and other major chains in recent years, and compromised customers' credit card information.

But the chip cards do nothing to guard against online fraud or prevent breaches when they are used at stores with traditional swipe machines. Not all retailers have upgraded their equipment to read the chip.

The chip devises a unique code for each store purchase and is virtually impossible for thieves to duplicate. But nearly all of the EMV cards are a hybrid of the old and new, with both a chip and the traditional magnetic strip. When swiped at one of the old card readers — which are likely to stick around for a while — it offers no protection.

“At this point, (thieves) could effectively make a card with a fake chip in it, put a magnetic stripe on it and nobody would be the wiser,” Holland said.

Most major national retailers, including Wal-Mart and Target, have either installed chip card readers or are well on their way to having them in place by the end of the year, according to the National Retail Federation. But small retailers that can't afford the upgrades could lag, Holland said.

Consumer and retail groups complain that the chip cards don't go far enough. They require only a signature for authentication instead of a personal identification number, or PIN, which is considered more secure and is common in other parts of the world.

“Having the chip and signature is like locking the front door of the house but leaving the back door open,” said Paul Martino, vice president and senior policy counsel at the National Retail Federation.

Requiring customers to enter a PIN would add another layer of complication to an already disruptive change, and card-issuing banks think the signature system would make it easier on consumers, said Julie Conroy, research director for consultant Aite Group's Retail Banking in Boston.

Consumer advocates say banks haven't done enough to inform cardholders. A recent Chase survey showed 65 percent of consumers had not heard of the chip cards.

Consumers need to know more about how to use the card and the security it provides, said Christina Tetreault, an attorney with the Consumers Union, the policy division of Consumer Reports.

Tetreault said she received her chip card recently, accompanied by a single-page mailer that told her to visit the bank's website for more information.

“The mailer that came along with it said, ‘Your card has more secure features,' ” Tetreault said. “That's not enough information to really understand what this is. A referral to a website and a picture of an attractive person is probably not enough to make sure that consumers can use this technology effectively.”

PNC is informing its customers through letters, emails, updated credit card brochures and information on its website, said spokeswoman Marcey Zwiebel. It has been preparing bank branch staff and customer service consultants to answer questions.

PNC will continue to provide fraud monitoring, and all credit and debit cards come with zero liability fraud protection.

“The importance of security to PNC on behalf of our customers will not change as a top priority,” Zwiebel said.

Chris Fleisher is a staff writer for Trib Total Media. He can be reached at 412-320-7854 or cfleisher@tribweb.com.