Chip and signature cards do not offer maximum security to consumers.
According to the FBI and the National Retail Federation, new chip-based credit cards are safer than traditional cards, but these cards still leave customers vulnerable to fraud. The FBI warns that these cards need to be used with a PIN instead of a signature to minimize risk.
“What the FBI is saying is what the rest of the world already sees as common sense,” NRF senior vice president and general counsel Mallory Duncan said. “It’s the right thing to do, and we hope the banks are listening.”
“Retailers are determined to protect their customers,” Duncan said. “That’s why we are pushing the banks to use all of the security the new cards are capable of providing, not just half. They shouldn’t lock the front door but leave the back door wide open.”
In a warning issued on Thursday to consumers, merchants and law enforcement, the FBI praised Europay MasterCard Visa chip cards as being more secure than traditional magnetic stripe cards, but said they are “still vulnerable to fraud.” Despite card industry claims that the chips are difficult to counterfeit, the FBI said the cards “can be counterfeited using stolen card data obtained from the black market.” The bureau also said the chip “will not likely” stop stolen or counterfeit cards from being used online or in telephone purchases.
“When using the EMV card at a point-of-sale terminal, consumers should use the PIN instead of a signature,” the FBI said. “This fully utilizes the security features built within the EMV card.”
The FBI encouraged merchants to require that consumers use a PIN rather than signature, and said merchants should ask for a government-issued photo identification card when customers use a signature.
Despite the FBI warning, virtually all of the chip cards being issued in the U.S. are chip-and-signature rather than chip-and-PIN, leaving consumers without the option to use a PIN. By contrast, EMV cards used in 80 countries around the world for 20 years or more are routinely chip-and-PIN.
“They’re encouraging consumers to use PIN and they’re encouraging merchants to request PIN – the only thing missing is to encourage the banks to issue PIN cards,” Duncan said.
The FBI warning follows last week’s deadline for merchants to install chip-card readers or face increased fraud liability if a chip card is used in a non-chip reader. The warning is the second time that the federal government has come down in favor of PIN – President Obama last year signed an executive order requiring that credit cards issued to federal government workers have a PIN, and that federal facilities that accept credit cards be equipped for PIN.
NRF has argued for years that the new cards should have both a chip and a secret PIN, or personal identification number, saying that the combination of both is required to provide sufficient security. While chips make the new cards more difficult to counterfeit, the chip can be circumvented, and the chips do nothing to protect lost and stolen cards from being used. A PIN could prevent all of those types of fraud, even without the chip.
