NRF: When chips are down, you need a PIN

Chip-and-signature credit cards without a PIN won’t stop data breaches, at least not according to the National Retail Federation.



Although the new U.S. mandate for EMV-compliant chip-and-signature payment cards is now in effect, the NRF on Oct. 7 told Congress that new chip-and-signature credit cards without a PIN will not stop data breaches. What’s more, small businesses should not be pressured to install the equipment to accept them at the expense of more effective technology, according to the organization.



“The new EMV equipment does not stop breaches,” NRF senior VP for government relations David French said. “Indeed, in many cases it provides no significant benefits either to the business or to the business’ regular customers. It is merely an additional expense small businesses are being told to bear.”



French added that if small businesses are pushed to adopt Europay MasterCard Visa (EMV) technology, alternatives such as near-field communication (NFC) contactless payment, mobile wallets and other smartphone-based technology may effectively be locked out of the market



“These are important considerations that businesses of all sizes must carefully ponder,” French said. “It would be inappropriate to prejudge their decision-making and stampede businesses into the adoption of solutions less protective for businesses and consumers than what has existed throughout the industrialized world for more than a generation.”



Cards currently being issued by U.S. banks feature a computer microchip that will eventually replace magnetic stripes to store data. But French said the cards also need a secure personal identification number, or PIN, which would eventually replace easily forged signatures, as is done in all other countries that use EMV cards. While the chips make the cards more difficult to counterfeit, they do nothing to protect lost or stolen cards, while a PIN alone could prevent both types of fraud, he said.



While the new cards make it somewhat more difficult for criminals to use stolen card numbers, they do not actually prevent numbers from being stolen in the first place, and stolen numbers can still be used for online and other types of fraud.



French’s comments came in a statement submitted to the House Small Business Committee, which is holding a hearing Oct. 7 on what chip-based cards will mean for small businesses.