This podcast is brought to you by bankinfosecurity.com. Bankinfosecurity.com is your source for the news and views, shaping security and risk management within the finance space. Payments fraud, skimming attacks, and emerging technology options for Chiv & Pen. Could the convergence of those factors make the timing right for a US move to EMV?
Hi, I'm Tracy Kitten with Information Security Media Group. Today we hear from Randy Vanderhoop, executive director of the Smart Card Alliance, about how a number of factors working in tandem could push the US to begin investments in new payments technology. Randy, the last time we spoke, we talked about the so-called roadmap the US might follow on its path toward EMV. The path we pursue might not look like what's been implemented in Europe, but it could take technology that's similar and would enhance capabilities for global payments, convergence, and enhanced security.
Could you give us a little background about what that roadmap in the US might look like? Well, sure, Tracy, and thank you for having us conversation today. So we're definitely at the end of the road when it comes to the old magnetic strike card. And now we're looking at a whole new direction in terms of where do we go from here.
And that roadmap has a lot of different options to it. And as we explained in the last discussion, we had EMV chip cards, contactless payments, NFC, mobile payments, all offer many different options for the US payments industry and different technology decisions that need to be made along the way. And we're just starting now to look at how the US market differs from Europe and Asia and other places that have implemented EMV and that we don't necessarily have to follow exactly the same script that those other countries have led, but actually use the options that are available to us based on the current state of the technology and the understanding of how the industry might adopt this technology in the US to really take a fresh look at it. And I think a lot of smart people are starting to have those discussions today.
Now, you raise a good point, Randy. When we talk about mobile payments, chip cards and NFC, what's the common ground in all three? Well, all of them introduce something that's severely lacking in the US market, which is dynamic data. And I can't emphasize enough that the old magnetic strike is based on a very vulnerable magnetic data format that is what the hackers are going after to harvest that information, to create clone copies of these cards and to force issuers who might be suspected that they've had a data breach to reissue tens of millions of cards a year.
By introducing dynamic data into the transaction stream, which is something that mobile payments, chip cards and contactless cards bring to the marketplace, it devalues that data that is what the criminals are going after. And it makes it much more difficult for the criminals to create fraudulent copies or skin the data from the US card issuers. That important element alone is going to dramatically reduce the amount of fraud and change the direction of fraud mitigation from simply trying to protect the existing card to actually focusing on where the card is being used and where the criminals that are attempting to use those cards can be further attracted and stopped. And how does NFC support mobile payments?
What does the current contactless infrastructure look like and how would it be compatible with payments technology that's already in place in other parts of the world, such as Europe? So most people that have been following the industry know that we're now seven years into a migration of contactless payment technology, led by the brands, solutions, master cards, PayPass, Visa, Paywave, American Express, Express Pay, and Discover Zip Products. And hundreds of different financial institutions have issued contactless cards in the US, and somewhere between 75 million and 85 million cards have been issued now. So as NFC comes along, NFC is going to be able to leverage the infrastructure that's been established for contactless cards and just offer one additional option for consumers, which is to use their mobile phone as a means for delivering that payment transaction at the point of sale.
What NFC brings to the table besides simply another way to pay is that the mobile phone is an intelligent computing device that can be connected to the internet, and it can be conserved as a device that can receive data as well as transmit data. So it's a very powerful tool to be able to not only deliver payments, but also to accept coupons and promotions and marketing messages from retailers that will actually help shape the way consumers stop in the future. And we've talked about contactless payments in the past, and it seems like interest in contactless payments has kind of slacked a bit in the US. Do you think that the move to mobile or to mobile payments might reignite some of the interest and acceptance of contactless payments?
I do, and part of the evidence for that was how successful contactless payments stickers were and have been since they've come out. And everywhere I go, I see people that have heard of or have used their contactless payments stickers on their phones at convenience stores and shopping centers and guest stations and all over the place, and they really liked the concept of being able to use their mobile phone. We think that NFC is going to further ignite consumer interest in contactless payments, because it provides some very interesting ways in which consumers can be incented to use contactless payments through their mobile phone by being able to interact with merchants and receive promotions and coupons and location-based advertising and other ways that will really help shape the way consumers shop in the future. Another point that the NFC phone offers that contactless cards never could deliver was that it has a user interface that has a display and has a keyboard in the mobile phone.
So it actually provides a lot more interactive capabilities than a standard contactless card would offer. Now, from a more timely perspective, Randy, I'd like to just ask a quick question here about interchange and the impact that some of the things we're seeing right now with the Durbin Amendment could have on contactless payments and EMB and mobile. When we think about the Fed Reserve's decision on interchange, how do we think that could impact or motivate merchants and financial institutions to make a move to EMB or to some type of NFC mobile payment platform? Well, all eyes are on the Federal Reserve and what decision they're going to come out with today.
And I think a lot of people are starting to look at what might be the possible outcomes of a decision to dramatically reduce interchange. From my perspective, I think the cost of fraud is going to become extremely difficult to be absorbed if the revenue that financial institutions would count on from their interchange channel gets dramatically reduced. So for years, we've heard the banks promote the fact that interchange rate is low and that there's really not a business case to invest in EMB technology. But when the percentage of fraud against the revenue that those card transactions generate dramatically changes, then my suspicion is that the business managers are going to take a harder look at fraud and look for ways in which they can actually significantly change the curve on that and reduce it in the future.
And that's going to be a one-time investment in chip technology or NFC contactless that will then provide them with a whole other level of fraud reduction that they can achieve down the road. Now, I want to go back to talk about security and contactless specifically. There have been concerns in the past about contactless technology, radio frequency identification, which is better known as simply as RFID. And security concerns surrounding that, though it has been suggested that the reality is that contactless payments are more secure than mag-stripe payments.
So there's been a lot of media coverage about these alleged breaches of data from contactless cards. And we fought hard to try to set the record straight by providing expert peace on the layers of security that go into the payment system that go beyond just the simple ability to read the account data from the contactless payment device. We think we put that discussion to bed. There's been no reported breaches of people's credit card data as a result of a scheme of contactless cards.
We know that there's layers of security that go into the system to prevent that kind of vulnerability. And we don't think it's an issue. The mobile devices have even additional opportunities for securing that data because the mobile phones themselves have pin protection. The payment transactions that are going to reside in those mobile phones will also likely have a pin security.
So considering where we were coming from in terms of the old magnetic straight card, which was basically vulnerable to any type of contactless payment cards offered a significant additional layer of security. And now NFC phones are going to add more security on top of that. So it's all part of a process of closing down some of the old ways in which data can be stolen from the payments industry and create fraudulent cards and fraudulent transactions and play opening up new opportunities for how people can make payments. And Randy, could you tell us about what some of those different security models are for mobile and contactless payments?
So the mobile devices that are going to support payments are built around something called a secure element, which will reside in the mobile handset and be a secure container for the card transaction data. When that transaction is made when someone uses their phone at a point of sale, the communications between the phone handset and the point of sale device will implement the same dynamic data string that contactless cards generate today. And if and when the US market starts to process payments using EMV, the additional security capabilities of EMV will also be a part of that mobile payment transaction. So we now are seeing how the level of security with new technology is going to dramatically increase as we move off of this old roadmap of magnetic strip and move into the technology of the future.
And as you've pointed out earlier, we have actually some examples to look to in the industry to support the fact that these types of transactions can be more secure. Could you give us a little background on what's going on with transit and or open payments? Well, transit is a very interesting market to follow because the transit industry represents a very attractive set of consumers for people who are involved in advancing contactless and mobile payments. For those people who use transit in major cities around the country, they usually go to a kiosk machine and put their cash or their credit or debit card into a machine and transfer that into their payment media and put money on a card or pay per ticket to be used to access the trains and buses and subways.
What the transit industry is looking to do is to migrate their accepted systems to not only accept the fair media that they have traditionally offered, but also to accept contactless cards and mobile phones that are issued through the open banking system. What's attractive about the transit industry for banks is that it's a group of consumers that use their payment device multiple times a day and therefore it's people that are likely going to, once they've used it a few times, it will become a part of their daily activity. It will also increase ridership because people who avoid writing on buses and trains and subways often do so because they don't want the hassle of having to go and purchase tickets and put money onto a card that they might never fully use or unsure about the payments that are accepted in those systems or maybe simply don't have the cash that they would need to normally get in and operate on those riders. But being able to pull out your payment card and tap it on an accepted device in any city in the country provides a level of comfort for people that I think will help mass transit ridership increase.
So it's really good for the banks, it's good for the transit operators, it's good for consumers. And what about some of the initiatives that are taking place in the industry? Wells Fargo and Chase, for instance, have been issuing cards to some of their card holders who travel overseas and they're issuing separate EMB cards for them. Can you tell us how those programs have been launched and what the thinking behind them was?
Certainly. So again, the end of the road for Megstripe is being played out, not only in the US, but outside the US as well. As more countries become committed to chip technology and the use of smart cards for payment, there's less acceptance for the old magnetic straight cards. So what people from the US were finding as they were traveling to cities in Europe and Asia and elsewhere was that they would have their US issued magnetic straight cards not be accepted in all places.
And this is created a significant burden on US customers. So what the leading banks have started to recognize is rather than lose those transactions by people moving away from their cards and going back to cash, they could capitalize on those international traveler customers by offering them a payment card that will work in the US as traditional magnetic straight card but also contain an EMV chip in the card that they could then use when they're traveling outside of the US in those acceptance locations that only accept chip or that favor chip over the magnetic straight. So it's a way to service their customer base without having to make a significant change in their entire card holder infrastructure and just begin with issuing EMV to their international travelers. And before we close, Randy, what final thoughts would you like to leave our audience with?
Do you expect the US to make a move to EMV sometime soon? Well, I think the US market has started to seriously look at EMV and all of its forms and start to plot a new roadmap for payments in the US market. There's a lot of attention being placed on Canada, which as you may know is almost fully implemented EMV and because of the close ties between the region, there's a lot of information and experience that can be passed back and forth both from the financial institution side and processing side as well as from the merchant side. So there's some great lessons learned there.
There's also some lessons where they don't want to repeat. And I think this is what's positioning the US market to actually have a very efficient approach to EMV because they can take what's happened in countries that have not done well or and address the changes that will work best for the US market and also piggyback on the new technology innovations that are happening with mobile phones and come up with a really strategy for the market as it exists not only today, but five years from now when the full implementation of EMV is likely to take place. Randy, I'd like to thank you again for your time this morning. Okay, it's been a pleasure Tracy, thank you.
Again, we've just heard from Randy Vanderhoop, Executive Director of the Smart Card Alliance for Information Security Media Group. I'm Tracy Kid. This podcast has been brought to you by bankinfosecurity.com. For more interviews, breaking news, research and educational webinars, please visit www.bankinfosecurity.com.