The Credit Union National Association's (CUNA) "Stop the Data Breaches" website and campaign, much like the vast majority of CUNA's claims, is littered with falsehoods.
From false claims about credit unions paying all the costs of data breaches to fighting to keep customers using 1970s swipe card technology, CUNA doesn't let facts or customer security get in the way of making splashy headlines. See below for the facts behind CUNA's false claims.
Apparently Facts Don’t Matter to CUNA
CUNA's FALSE CLAIM: "When a data breach occurs, the merchants pay NONE of the costs to send individuals their new cards or the fraudulent charges an individual may have on their cards or accounts." (http://www.stopthedatabreaches.com/)
FACT: By contract, card issuers are reimbursed for fraud losses and card reissuance costs based upon a formula agreed to by the card issuer and card networks even if no fraudulent activity has actually occurred on the card. For example, according to the MasterCard Account Data Compromise User Guide, under a formula that card issuers and MasterCard have agreed to, a small financial institution is reimbursed by the merchant at a cost of $2.69 per magnetic stripe card.
CUNA's FALSE CLAIM: "In fact, the merchants are not required to pay ANY costs incurred from their own data breaches." (http://www.stopthedatabreaches.com/)
FACT: Merchants are required to compensate card issuers for any fraud that occurs as a result of a breach based upon an agreed upon formula that the card issuer has negotiated with MasterCard and Visa. See 6.4.1 ADC Operational Reimbursement Factors, MasterCard Account Data Compromise User Guide, July 22, 2012.
CUNA's FALSE CLAIM: "Credit Unions Have Been There to Protect Their Members" (http://www.stopthedatabreaches.com/)
FACT: Chip cards and Chip terminals help make a secure transaction system even more secure by validating the cardholder's Chip & PIN. Credit Unions may not even meet the deadline for Chip cards. According to the Credit Union Times, more than half of credit unions are expected to miss an October 2015 deadline to issue cards equipped with chips. (Credit Union Times, "Most Credit Unions will Miss EMV Deadline," August 1, 2014 http://bit.ly/1uQfh8k)
Chip and PIN cards are 700 percent more secure than Chip and Signature. Retailers are on track to have completed an enormous investment in order to be able to accept Chip and PIN cards next year. Yet, there is still little promise that banks will issue such cards. Instead, banks intend to begin issuing chip cards without the requiring PINs, a feature that is proven to reduce fraud by 700 percent, according to the Fed. (Federal Reserve. "2011 Interchange Fee Revenue, Covered Issuer Costs, and Covered Issuer and Merchant Fraud Losses Related to Debit Card Transactions." March 5, 2013 http://1.usa.gov/1xhPXph)
Chip and PIN cards reduce fraud. "One reason why Canadians may be less exposed to the Home Depot breach, said Toronto-Dominion Bank public affairs manager Meghan Thomas, is the prevalence of "chip and PIN" technology in this country. Most cards in Canada have electronic chips and require cardholders to type in a personal identification number when they buy something, making them less exposed to fraud than clients in the United States where that technology is not in as widespread use." (The Globe And Mail, "Canadians little affected by Home Depot data breach." Sep. 25 2014 http://bit.ly/1voJ0Se)
Instead of spewing falsehoods, CUNA should get serious and join the rest of the payments community in the effort to protect customers. Where are our Chip & PIN cards, CUNA?:
According to Visa Canada's "The Importance of PIN" website:[1]
o "Now, with Chip & PIN Visa cards, security comes to your card."
o "Your PIN is unique to you."
o "[I]f your Chip & PIN Visa card is lost or stolen, it cannot be used to complete a transaction without your PIN being entered."
According to Visa Canada's "Benefits of Chip & PIN" website:[2]
o "With Chip & PIN technology comes a new level of cardholder security and convenience."
o "Chip cards and Chip terminals help make a secure transaction system even more secure by validating the cardholder's Chip & PIN. This enhances the security of your card whenever you use it in a face-to-face transaction."
o "Increased security against unauthorized use of your card: You insert your Visa card in a chip terminal and enter your PIN when prompted. Once your PIN is confirmed and the purchase is approved, you'll be prompted to remove your card from the terminal. You do not hand your Visa card to anyone, or lose sight of it at any time. This helps to prevent fraudulent use of your card."
o "Increased security against counterfeiting and skimming: A lost or stolen Chip card cannot be used to complete a transaction without its corresponding PIN. This technology virtually eliminates the ability to copy the contents of the chip to another card."
According to Visa Europe's "Benefits of chip" website:[3]
o "Chip technology, especially when combined with PIN, helps to speed up service, cut queues and reduce lost sales."
o "Chip cards are harder to counterfeit and PINs help prevent fraud involving lost and stolen cards, which makes for more secure payment."
o "Chip, especially when used with PIN, helps reduce fraudulent and disputed payments…"
According to MasterCard's "Cardholder Verification at the POS" website:[4]
o "Chip-enabled PIN-based transactions bring benefits to all participants in the payments value chain."
o "These [PIN-based] transactions:
- "Give cardholders greater confidence that their transactions are secure
- "Reduce lost and stolen and never-received-issue (NRI) fraud losses
According to MasterCard's "Chip and PIN, A More Secure Way To Pay: Chip Cards" website:[5]
o "Instead of swiping a card that has a magnetic strip on the back, you insert a card that has a computer chip embedded on the front. Instead of signing to verify a payment, you enter a private Personal Identification Number (PIN). The data on the chip is extremely difficult to copy or change, protecting against counterfeiting fraud, and the PIN provides added protection if your card is lost or stolen."
According to MasterCard's "Introducing Chip Technology, Greater Peace of Mind" website:[6]
o "Purchases made at chip terminals are more secure because in order to authorize the transaction you're required to enter your PIN, which only you should know."
According to a 2013 joint submission by Visa and MasterCard to the Australian Competition and Consumer Commission in support of mandatory PIN usage for virtually all transactions:[7]
o "Requiring the use of a Personal Identification Number rather than permitting signature as a means of customer authentication for all, or almost all, transactions at Point of Sale is a proven method of reducing card fraud."
o "It is much more difficult for a fraud perpetrator to ascertain a PIN than to forge a signature. Accordingly, one of the most effective ways of combatting fraud (particularly Lost/Stolen and NRI fraud) is to make the use of PIN for customer verification compulsory."
o Mandatory PIN usage was so important to Visa and MasterCard in Australia that the two networks proposed a communications strategy to educate cardholders about the importance and need for PIN through "multiple phases of media campaigns across media including print, out of home, POS, television and digital to raise cardholder awareness of the change to mandatory PIN."
[1] See Visa Canada's "Visa Chip Cards: The Importance of PIN" website, available at http://www.visa.ca/chip/cardholders/importance-of-pin/index.jsp.
[2] See Visa Canada's "Visa Chip Cards: Benefits of Chip & PIN" website, available at http://www.visa.ca/chip/cardholders/benefitsofchippin/index.jsp.
[3] See Visa Europe's "Benefits of chip" website, available at http://www.visaeurope.com/en/businesses__retailers/retailers_and_merchants/innovation/chip/benefits_of_chip.aspx.
[4] See MasterCard's "Chip Card Profile Business Considerations: Cardholder Verification at the POS" website, available at http://www.mastercard.us/cardholder_verification.html.
[5] See MasterCard's "Chip and PIN, A More Secure Way To Pay: Chip Cards" website, available at http://www.mastercard.ca/chip-and-pin.html.
[6] See MasterCard's "Introducing Chip Technology, Greater Peace of Mind" website, available at http://www.mastercard.us/mchip/.
[7] Visa Worldwide Pte Limited and Visa AP (Australia) Pty Ltd and MasterCard Asia/Pacific Pte Ltd Submission to the Australian Competition and Consumer Commission in support of Application for Authorisation. July 4, 2013.