President Obama signed an executiveorder today that requires the federal government to use chip and PINtechnology on all of its payments cards and to change the point of saleterminals in places like national parks to accept chip and pin cards.
While there is no silver bullet toguarantee data security, the President is signing an Executive Order toimplement enhanced security measures, including securing credit, debit, andother payment cards with microchips in lieu of basic magnetic strips, and PINs,such as those standard on consumer ATM cards. He is calling on all stakeholdersto join the Administration and a number of major corporations in driving theeconomy toward more secure standards to safeguard consumer finances and reducetheir chances of becoming victims of identity theft — America’s fastest-growingcrime.
The language of the order is interesting because it requiresthat the cards use chip and PIN while many issuers were planning to use chipswith signatures. The factsheet also says that the cards must have chips in lieuof magnetic strips, and then later says “These new systems will, at a minimum,meet the global security standard of more secure microchips to store cardnumbers instead of unencrypted magnetic strips, and secure PIN functionality,like the kind featured on most ATM cards.”
Could this mean that government cards will be the first tohave no magnetic strip at all? It certainly looks that way, however it isuncertain the government recognizes how much this will restrict acceptance,especially at ATMs, restaurants and gas stations. The fact sheet says that thegovernment plans to begin replacement of the cards in January 2015, beginningwith the prepaid cards issued for Social Security recipients. Mercatorestimates that there are about 3 million of these cards in circulation, which,depending on the cost per card, could mean a cost of anywhere from $15 to $20million to replace. Of course, the otherissue is making sure that the card manufacturers actually have the capacity toproduce the cards. Getting to the front of the line could increase the costseven more. Certainly the issuing bank will want to be compensated for the costsof reissuing these cards
.
While the order seems to cover only those cards that areissued in conjunction with government programs, it is easy to see how theymight extend to any program that wants to be eligible to receive governmentfunds. This could affect prepaid program managers who were planning to delayEMV implementation and force them to make costly changes before they are ready.
The order also has provisions for increasing theauthentication on data released by the government to citizens, improvingidentity theft resources, and increasing credit score transparency.
Now, it may be that the order gets refined as the paymentsindustry works to educate that government about what the provisions mean from apractical standpoint. The industry should be prepared to do so to avoid gettingcaught up in deadlines for changes that are more aggressive than what theindustry had planned.
Overview by Tim Sloane, Vice President, Payments Innovation for Mercator Advisory Group