emv survey results

EMV Survey Results:

Lack of time, deployment expertise cited as top obstacles to EMV readiness

Europay, Mastercard and Visa (EMV), the standard credit card processing method used widely throughout the world, has proven effective at significantly reducing face-to-face credit card fraud. In the U.K., for example, starting with EMV’s implementation in 2004, face-to-face credit card fraud fell 70 percent over the next six years. France claims an 80 percent reduction. The U.S. is the last major market that still uses the outdated mag stripe technology, but that’s about to change. In October of this year, what’s known as the “liability shift” will take place, meaning liability for the cost of fraud will fall on the entity using the lesser technology.

One would think the enormity of the potential risk of a credit card security breach would drive businesses to adopt the chip and PIN technology before the October 1st deadline. But is this actually the case? To get a fuller picture of how businesses are approaching the upcoming liability shift and their knowledge of and attitudes towards the pending EMV transition, Randstad Technologies surveyed C-level executives and IT decision makers representing a cross-section of affected industries. This report summarizes the findings of that survey.

www.randstadtechnologies.com

Introduction

Many businesses might miss the deadline

One of the more prominent and puzzling findings of this survey is that while nearly 60 percent of the respondents indicated they were actively preparing for the EMV technology transition, the remaining 40 percent were pretty much evenly divided between those either not preparing or unaware if they were. With time running out to meet the deadline, firms that have not acted by now, especially those with numerous and geographically scattered locations, have either decided the risks are worth taking, the deadline will be extended, or they can scramble and accomplish the transition. Given that consumer transition to the new cards has been slow, perhaps they feel no urgency to upgrade their systems.

Greatest conversion obstacles — expertise and time

The survey also found that lack of time ranked as the top obstacle to meeting the deadline (comprised 19 percent of responses), followed by access to technology expertise (comprised 17 percent of responses). It’s not surprising that lack of time is a factor given the challenges organizations face getting access to the expertise required to meet the deadline. Because so many firms lack the experienced internal personnel to handle card reader deployment, they rely on outside firms for help. Given that many of these outside firms are fully committed to fulfilling their current workloads, the availability of skilled point-of-sale professionals who know both deployment and EMV system certification is scarce and will only become more so as the deadline nears.


Executive Summary

Another survey finding of note was that 66 percent of respondents believe that Chip and Signature does not offer sufficient security and that PIN technologies should be required. This finding, that two-thirds of the respondents would favor the use of a PIN while a third think that a signature is sufficient, reflects the diversity of opinions and even confusion on the subject. The issuing banks are, by and large, opting for Chip and Signature, and one of their stated reasons is that requiring consumers to remember a PIN might make them less likely to use their card or to complete a transaction if they forget their PIN. Retailers, on the other hand, appear to realize that Chip and Signature is not much of an advance over the current mag stripe and that requiring a PIN is the key to a more secure transaction.


•

Executive Summary

Chip and Signature – not secure enough for most

Bottom line:

•

•

Many businesses will make the October deadline, but a significant number are either going to miss the deadline (whether intentionally or unintentionally) or push to try to make it over the next few months.

The major obstacles to conversion are lack of technical deployment expertise and not having enough time to meet the deadline. Neither of these is going to become more favorable before the deadline. In fact, access to skilled people will only grow more difficult as October approaches.

Chip and PIN is considered more secure than Chip and Signature, but a significant number of banks are issuing only Chip and Signature. The results of the complete survey follow.

No

19.05%

Not sure

22.62%Yes

58.33%

According to survey respondents, 58 percent are actively preparing for the EMV technology transition, while the remaining 42 percent have not taken any steps towards the transition or are unaware of any progress made.

What’s surprising isn’t that 3 out of 5 respondents report actively preparing for the transition, but that 2 out of 5 either haven’t or aren’t sure if they have! Given the potential liability organizations face from a breach, this raises some concern — especially with so many high profile cases of credit card fraud.

Deeper insight


Has your business taken any steps towards meeting the EMV deadline?

1

Fifty-two percent of respondents anticipate that it takes more than four months to make the EMV transition.

Time’s running short to meet the pending October transition deadline. Those with large numbers of sites to upgrade are going to have to scramble – and still might miss the deadline.

Deeper insight


How much time does the EMV transition take from beginning to end?

2

more than6 months

40.48%

4 - 6 months

11.9%

1 - 3 months

4.76%

not sure

42.86%

Aside from not having enough time to meet the deadline (19%), respondents most frequently identified access to technology deployment expertise (17%) as their top obstacle.

Technology deployment expertise isn’t just limited to physical deployment know-how, but other issues as well -- for example, how to attain EMV certification. It’s not surprising that the lack of time is a prominent factor given that organizations face challenges getting access to the right technology expertise to meet the deadline.

Deeper insight


What are the greatest obstacles your business faces in meeting the deadline for EMV card readers?

3

17%14%

12% 12%

19%

26%

Access totechnologyexpertise

Cost Limited availability

to cardreader

Developmentof the

application

Not enough

time

Other

58 percent of survey respondents believe that failing to meet the liability shift deadline will have either limited or no impact on their company’s bottom line.

This reveals that a segment of organizations have placed their EMV transition on the back burner. Some might be discounting the magnitude of the risk they are exposing themselves to by missing the deadline. Others might have what they consider higher business priorities commanding their attention and resources. Perhaps they plan on transitioning at their own pace or think that costs might decline.

Deeper insight


If your business does not make the EMV transition in time, what level of impact will the liability shift have on your company’s bottom line?

4

Limited impact

No impact

Significant impact

Not sure

EMV Survey Results:

Lack of time, deployment expertise cited as top obstacles to EMV readiness

Nearly 30 percent believe that having EMV card readers will encourage customers to conduct business with them and another 32 percent are uncertain about its impact.

Because consumers have been largely insulated from the costs of credit card fraud, this finding reveals that organizations don’t necessarily think customers will change their purchasing behavior based on their offering a more secure purchasing option. Also, communication and marketing efforts to promote the security benefits of the EMV system over the traditional mag stripe technology to consumers have been spotty.

Deeper insight


Do you believe your customers are more likely to conduct business with you if you have EMV card readers deployed?

Not sure

32.39%

Yes

29.58%

No

38.03%

5

The majority (66 percent) believe Chip and Signature does not offer ample security and that PIN technologies should be required.

If there’s anything surprising in these numbers it’s that nearly six percent of respondents believe that mag stripe technology offers sufficient security. That’s a perspective that’s been undercut on many occasions by costly security breaches to a number of prominent businesses.

Deeper insight


Do you think Chip and Signature cards offer ample security to your customers, or do you think PINs should also be required?

6

No. Chip and PIN should berequired

66.2%

Yes. Chip andsignature issufficient

28.17%

Neither. Traditional mag stripe technology offers enough security

5.63%

More than half believe the liability shift should be delayed (56 percent).

Although the restaurant industry, in particular, has been advocating for a delay in the transition deadline, there’s no widespread push for delay, and there’s nothing right now to indicate that a delay is probable. Organizations that procrastinate because they think the deadline is going to be pushed back might find themselves out of luck, as deployment help will be scarce and the new pin pads will be nearly impossible to acquire as October grows near.

Deeper insight


Do you think the EMV liability shift deadline should be and/or will be delayed?

7

25.5%31%

22.5% 21%

Yes, it should be delayed and will

be delayed

Yes, it should

be delayed but probably

won’t be

No, it shouldnot be

delayed and likelywon’t be

No, it should not be

delayed but probably

will be

Conclusion:Given that the liability shift is only a few months away and it’s unlikely to be delayed, it’s surprising that so many organizations are either waiting until the last minute to act or are willing to incur the associated risks from missing the deadline. For those organizations that still think they can make the October deadline, the longer they wait, the more they are going to find that deployment expertise and the new card readers will be in short supply. Additionally, those willing to incur the risks should be aware that thieves will be looking for the weakest link — and if they turn out to be that link, the price for ignoring the deadline could be steep.


Methodology:Randstad Technologies surveyed 84 IT decision makers within large-scale* national businesses to gauge their readiness for the EMV liability shift deadline in October. Respondents included C-level and director-level staff within top industries affected by the deadline, including retail, hospitality, restaurants, financial services and others. The survey was conducted from May 13, 2015 through June 19, 2015.

* according to these results “large-scale” business are those with 100 or more sites


emv survey results

Technology

emv technology transition

percent of respondents

technology expertise

lack of time

percent of responses

emv survey results

pin technology

percent reduction