EMV (chip + PIN): show us the money?

Ever since the invention of semiconductors, entrepreneurs, startups and technology investors have dreamed of replacing all coins and paper money with chip-based solutions. Smartcards have been touted as the ultimate payment solution for almost two decades, and investors have been pouring money into this sector believing that this time the smartcard goose will lay that elusive golden egg. We are still waiting….

Smartcards started their life in the early 1990s, with an objective to reduce fraud in F2F (face to face) transactions. France was the first country to deploy a countrywide initiative to replace “magnetic only cards” with “chip + PIN” for its domestic transactions. Since then it has successfully reduced its F2F fraud by more than 70%.

One of the major decisions taken by the Cartes Bancaires (the French card authority) at that time was to ensure that all cards and terminals (supplied by multiple vendors) were to be tested in ONE laboratory to ensure full interoperability. This minimised the impact to consumers and merchants from problems associated with the interoperability of different vendors’ products and solutions. The rollout was relatively smooth compared to the current EMV (Europay, MasterCard, VISA) rollout in the UK. It has taken the best part of seven years for the investment made by the banks to breakeven, and even today French cardholders have to pay for their smartcards.

In 1994 Barclaycard took the lead through APACS (the UK payment association) to implement an equivalent to the French “chip + PIN” solution for domestic use - the program was known as UKIS (UK IC spec). Several pilots were initiated – but soon it was realised that international fraud would represent the biggest portion of the total fraud losses. To solve this problem a global “chip + PIN” program would have to be employed to ensure that no matter which country a cardholder used their card in, it would be secured using an internationally recognised “chip + PIN” specification.

The birth of EMV
That was the vision at least of major card vendors like Europay, MasterCard and Visa. The original work that went into UKIS was leveraged to form a common specification for a global “chip +PIN” standard and became known as EMV, named after the three major players, Europay, MasterCard and Visa.

It is estimated that for Europe alone the total bill for the complete deployment would be in the order of €3.2 billion, not counting the cost of training all the relevant employees at the banks, merchants and card issuers.

Smartcard, payment terminal and chip vendors, as well as software companies, poured millions of dollars into developing solutions which were state of the art at that time – at least at the beginning. Many of these companies have either run out of cash and gone bust or have been bought out by bigger competitors at bargain basement prices.

What is not obvious is that none of the current players have realised a single dollar in profits from their EMV efforts. The biggest sufferers have been startups that have found it extremely difficult to penetrate the conservative walls of the EMV accreditation bodies and find themselves in a commodity price war with the larger players.

What about the future?
The outlook is even grimmer – as technology companies continue to strive to develop smaller, cheaper and faster solutions for chips, cards, terminals and software. Very few of these companies will actually succeed in meeting their target revenues, let alone profitability. Some have been lured into believing that new technologies, like contactless, multi-applications or stronger security algorithms will be the next big thing, or that an ‘all-in-one terminal on a chip’ will differentiate their company – but they don’t appreciate the barriers and walls that need to be overcome, resulting from the very conservative and slow decision making of large financial institutions and card issuers. Sometimes it takes three or four years to get these institutions to change or make important decisions.

Secondary players and value added players offering EMV add-ons like loyalty coupons and ticketing have also suffered, not because their products or solutions are poor, but because of the hesitation, indecision, closed rules and conservatism of banks and card issuers that influence EMV’s future evolution. EMV consortia have blocked the co-existence of non-payment applications on the same chip or sharing their infrastructure with transit or mobile operators. This has prevented new solutions from being trialled effectively before mass deployments can take place.

Wasn’t it supposed to prevent fraud?
According to APACS (Association for Payment Clearing Services), the chip + PIN rollout has co-incided with an increased level of fraud, to over £500 million. Apparently, the high-tech chip + PIN cards use a century-old low-tech postal system for deployment to end customers, and over 100,000 cards are posted everyday.

Fraudsters have figured out how to lift these cards in transit and apply for the right PIN numbers. Losses due to postal lifting increased by 62% and cost £73 million. This is an amazing loss considering the number of highly qualified people involved plus the cost and the length of time that chip + PIN has been worked on. It brings technology solutions into disrepute in the public eye.

Counterfeit cards costs £130 million. And presumably that figure will go down when the rest of the 50 million magnetic cards have been replaced - hopefully by a less fraud-prone method than the current postal system, otherwise expect the fraud figures to be even higher.

It seems that no matter how advanced the technology solution to prevent fraud is, the fraudsters are always ahead of the game, knowing that banks and card issuers will always stall all new deployments until they are forced to do so, screaming and shouting by the relevant authorities.

Other countries not in a hurry either
The expectations and time taken to fully deploy EMV around the globe has been nothing but disappointing. Apart from the UK, as the leader in terms of deployment, the reality of EMV deployment in the rest of Europe has not been a success story either. Countries like Spain, Italy and Germany are seriously lagging and are taking a back seat in order to learn from the mistakes of others. The rest of the world is not moving either. The US being 50% of the world market has shunned away from chip + PIN, after the £120m debacle with retail giant Wal-Mart, who failed to come up with a business rationale for loyalty and payment on the same smartcard.

Even Spain was trapped by the technology bug with Visa Cash - a fully deployed e-purse with less than 20 transactions per month from a whole country (how many vendors got burned by this one?) or more recently Pay Pass – a contactless payment card (gizmo) which transfers magnetic card data to a petrol pump!

‘Secure contactless microprocessor cards are the way to go’ said one vendor - with a hockey stick sales forecast. Individual vendors will claim that they have huge penetration in developing countries like Czech Republic and Hungary - but they need to recalibrate their calculators or get a new slide rule. In the payments business if you haven’t got the US covered you haven’t got anything tangible! Or sustainable.

It would be difficult to conclude that EMV has been a success so far – maybe the program executives at EMV would say otherwise as they try to minimise the damage by cutting away from EMV through the creation of a separate body EMVCo…..maybe SIMPAY would like to buy them – well that’s another topic for discussion.

Or could it be that it is time for a whole new payment system that is cheaper, more merchant and end-user friendly, and separate from the current slow, bureaucratic incumbents with their monopolistic pricing and behaviour.