Local merchants not ready for more secure ‘chip and PIN’ cards    

           

By Joram Borenstein   April 19, 2015

Massive data breaches at retailers like Home Depot and Target are finally pushing credit card issuers to adopt the technology known as “chip and PIN” which is much more secure than the magnetic swipe strips used in the United States.
The technology, which uses an embedded computer chip and a personal identification number, has been successful in Canada, Australia, Europe, and elsewhere. In the United States, a new industry standard is pushing widespread use of chip-based cards by October. Banks and merchants that fail to adopt the technology by then will become liable for the costs of fraud that result from data breaches, rather than issuers such as Visa and Mastercard.

Knowing this was on the horizon, I was curious to find out if Greater Boston was ready for this transition. To make this determination, I simply tried to make purchases with the chip portion of my credit card at every store I visited — and kept a chart of my experiences. At more than a dozen brand-name chains and local mom-and-pop merchants, I inserted the chip portion of the card into the terminal to see if it would process my payment.
In the majority of cases, the clerk behind the counter had no clue what I was doing. Once I saw that the chip wouldn’t allow me to buy my items, which happened with every transaction, except one in a Lexington sandwich shop , I asked the clerks if I could pay with the chip. They almost always looked annoyed and instructed me to swipe; I think they thought I had gone mad.
At a Watertown grocery store, the clerk told me, firmly, three times to use the swipe. At my local post office, they asked questions and were intrigued by how I was trying to pay.
At a RadioShack in Waltham, the clerk confidently told me “Yeah, I know what NFC is,” even though the chip-and-PIN technology has nothing to do with near field communications, which allows you to wave your card or smartphone to pay. A woman behind the counter at a local shoe store said, “We get lots of European customers who try to use their credit cards that way.”
Then there was the time I thought I could use my new chip card abroad. I was standing in the international terminal at Logan Airport waiting for my flight to London to board; it dawned on me that my new chip-enabled card had arrived without a PIN.
While that wouldn’t pose a problem in the US, in the United Kingdom, cards with chips are always used with a PIN. I called my bank’s toll-free number to get my PIN. I was told that I had already received the number in the mail — nearly 20 years earlier when I first got the card. That slip of paper had obviously long since disappeared.
My findings were that the Boston area is representative of the rest of the country. Hardly anyone is ready for chip-and-PIN. Merchants certainly aren’t, even though roughly 600 million chip-based cards will be sent to American customers by the end of this year according to the Smart Card Alliance, a group of financial, technology, and other companies promoting the adoption of chip technology.
Store clerks are not trained to accept them, and point-of-sale terminals don’t have the right software. I would guess that most people reading this haven’t received the most basic instruction on how to use them, even if they have already received the new card in the mail.
Smaller countries, with fewer banks and credit card issuers, have taken four years or more to make the transition from magnetic strips, so I believe it will be years before we are all paying with the chip portion of our cards. If you’ve received a chip-and-PIN card, don’t count on using it effortlessly anytime soon. Once we do make the leap, we should see some big changes — hopefully in the form of lower rates of credit card fraud and smaller effects from data breaches.

Joram Borenstein is a vice president at NICE Actimize, a company based in Boston that makes financial crime and fraud prevention software.