Not surprisingly, the Javelin Research Team have had quite a lot of media requests since the start of the year relating to the Target data breach and why the US hadn't moved to this new fangled chip card technology called EMV (no, not a record label with a dog sticking it's head into a gramophone). I'm not going to get into the many, many conversations we had about whether the Target breach could have been prevented with EMV, or the relative benefits of chip and signature compared to chip and PIN. What I am going to discuss is the topic that didn't come up - when will the payments industry finally ditch the magnetic stripe?
It seems that the US payments and retail industries are putting a massive amount of faith into EMV as a card fraud silver bullet. In a letter to Congress, Target's CFO, John Mulligan stated; "The latest "smart cards" have tiny microprocessor chips that encrypt the personal data shared with the sales terminals used by merchants. Why is such a change important? Even if a thief manages to steal a smart card number, it's useless without the chip." True, true. But what about the mag stripe on the back? I'm not arguing that EMV will not reduce counterfeit card fraud. It's been proven to do so pretty much anywhere it's been deployed. But the magnetic stripe will remain a loophole until there is 100% EMV terminalization of the US. I'm not alone in thinking this. During the CVM/EMV keynote panel session at the SCA payment summit in Salt Lake City, Jack Jania, SVP Secure Transactions at Gemalto, challenged the industry as follows... “ In light of the recent (Target) data breach, isn’t it time to add a mag-stripe end-of-life milestone to the official EMV migration time line? Everyone knows that it is easily to clone mag-stripe cards and that fact makes card holder data very valuable to fraudsters. It’s time to minimize cardholder data value to criminals by eliminating the mag-stripe from the card body and close this known security hole.” So, I (and Jack) suggest that the conversation needs to swing to when the lowly old mag stripe is sunsetted.
There must be a tipping point where the penetration of EMV cards and card readers in the US makes it viable to simply stop issuing cards with mag stripes, not just here but globally, finally forcing the hand of merchant laggards to move from payment technology from the 1960's to the 1980's. Nostalgia doesn't seem a valid reason to cling on - I've given up on both cassette tapes and CDs with very little discomfort. I'm sure the payments industry can also wean themselves off the mag stripe and let it live out its final days in peace if they really try.