Canada Delays Ultra-Secure Payment Card System

This column was written by Evan Schuman, the editor of StorefrontBacktalk, a site that tracks retail technology, e-commerce and security issues. Retail Realities appears every Friday. Evan can be reached at e-mail and on Twitter.

The delay is quite significant. Following the U.K.'s shift to Chip-and-PIN back in 2004, Canada's efforts have been watched closely by retailers in other countries-especially the U.S.-where Wal-Mart has been strongly pushing for national adoption.

Critics of Chip-and-PIN have raised questions about whether EMV is honestly that much more secure than mag-stripe. These concerns mushroomed back in February when a Cambridge University report publicly detailed many security holes in the current implementation.

Even worse, some have suggested the U.S. shouldn't embrace Chip-and-PIN because it will likely be years beyond obsolete by the time it's fully launched. The U.K., one of the world's earliest adopters, took less than three years for full deployment-from its May 2003 Northampton initial trial to the January 2005 liability shift. In Canada, which is more similar to the U.S. (although it's still much smaller), it has taken seven years and it's still not ready.

Even if the U.S. announced that it would move to Chip-and-PIN in October-and there are no indications that any such announcement is imminent-it's unlikely the technology could be fully deployed for more than a decade. Critics question how meaningful Chip-and-PIN would likely be to the retail security environment of late 2020.

When Visa and MasterCard separately announced the six-month delay on Friday (Sept. 24), they explained the identical move differently. MasterCard Canada's statement said the delay was "in response to Canadian market dynamics" and that it was a "six-month extension for Canadian merchants to migrate to Chip-and-PIN point-of-sale technology."

"The original timeline of October 15, 2010, is now extended to March 31, 2011, at which time MasterCard accepting merchants who have not upgraded to chip-enabled point-of-sale terminals will be liable for fraudulent transactions effected at their points-of-sale," the statement said.

The MasterCard statement also quoted Oliver Manahan, the brand's advanced payments VP: "While many merchants have already made the investment in migrating to chip, MasterCard heard through on-going dialogue that some merchants need more time to upgrade their point-of-sale terminals to accept chip-enabled cards. In response, MasterCard is extending the timeline to give them more time to make the necessary infrastructure upgrades."

Visa's statement said the move had been requested by Canadian retail chains, and the brand said the date to make the change was tomorrow (October 1)-two weeks earlier than what the MasterCard statement said.

"Visa and its clients recognize the complexity of the migration to chip payment technology by Canadian merchants," the Visa statement said. "Merchants who are in the process of making the conversion will have additional time to implement chip-compliant technology and can temporarily delay the introduction of changes to their payment environment in the lead up to and during December, typically the busiest shopping period of the year. This postponement will not have any negative long-term impacts on chip migration in Canada."

The Retail Council of Canada, who had lobbied for the delay, said the factors behind the delay go far beyond avoiding a shift near the holidays.

"There are some questions about the technology itself, some issues with terminal pad failures," said Mark Beazley, the Council's communications director. "Some of our members are seeing very high failure rates when processing Chip-and-PIN transactions" and using the chip. The problems "are likely related to an electrostatic discharge from the chip when the card is in the terminal reader, which was causing some issues."

Part of the electrostatic problem might simply be a reflection of the different ways readers handle mag-stripe versus chip transactions. With a mag-stripe, the stripe is run past a head that reads the card, but the card never actually touches the reading head. The head floats above the surface of the card, the way a disk-drive's head does.

On the other hand, to read a chip card, the reader actually connects electrically to the chip and is putting electrical power into the chip. If the card is removed before the power to the card is turned off, there could be some charge left on the card.

The Council's Beazley said that another issue would be the rules surrounding the liability shift. What if circumstances force the retailer to use the mag-stripe? Should a retailer still absorb the higher liability?

For example, Beazley said, what if the card is damaged and the chip won't function? Or perhaps the consumer has forgotten his/her PIN? If the goal is to strongly incentivize retailers to use the more-secure chip, doesn't that anticipate that the retailer physically can?

"Should the retailer turn away the sale or swipe the card?" Beazley asked. "We've raised a number of these concerns."

One longtime payment consultant, Todd Ablowitz (president of the payment consulting firm Double Diamond Group), argues that the Canadian delay could foreshadow U.S. challenges.

"It's no surprise to anyone that changing the entire acceptance experience for consumers, merchants and the back-end providers is a seismic experience. Despite years of notice, and lots of best efforts and
good intention, it's well-known that many in the retail community just aren't ready," Ablowitz said. "So,
like some PCI initiatives, the natural response is delay. In this case, its liability shifts being delayed, as opposed to fines. It goes to show us, if EMV can be delayed in Canada-after being on the table for almost 5 years-how far we'll have to go with U.S. point of sale to see any major changes."

The opinions expressed in this commentary are solely those of the author.

By Evan Schuman
Special to CBSNews.com