American consumers increasingly rely on credit and debit cards to pay for goods and services. Between 1997 and 2011, card payments rose from accounting for 23% of payments to 48%. During the same period, payment by cash and checks dropped from 70% to 35%. In 2011, consumers made 49 billion debit transactions totaling $1.8 trillion and 26 billion credit transactions totaling $2.1 trillion. This shift makes card security and fraud prevention more important than ever. In 2012, MasterCard and Visa—also called "payment brands" —set October 1, 2015, as the date by which U.S. card issuers—banks and credit unions—would need to have replaced existing credit and debit magnetic stripe cards with chip cards, and for merchants to begin accepting them. Chip cards are formally known as "EMV" cards, named for the coalition of three companies, Europay, MasterCard, and Visa, that developed the specifications for the standard. EMVCo membership has now expanded to include the payment brands of American Express, JCB, Discover, and UnionPay. There were four significant drivers of EMV adoption in the United States: L iability Shift. The October 1, 2015, deadline that shifted liability to the party that has not switched to chip cards is seen as a strong incentive for merchants and issuers to make the switch. Increasing Financial Impact of Fraud. In 2012, credit card losses in the United States totaled $5.33 billion, an increase of 14.5% from 2011. Between 2004 and 2010, fraud using U.S.-issued bank credit cards rose 70%. Merchants, card issuers, and consumers are adversely affected by increases in fraud. Increasing Concern o ver Data Breaches. Although the number of breaches dipped significantly between 2011 and 2012, there has been a modest increase between 2012 and 2013. Although the number of incidents in 2013 (198) is small compared to 2011 (855), a lot of attention has been paid to those breaches in the news. That attention appears to have created the perception that the number of breaches is increasing more than it actually is, raising concern among consumers, as well as policymakers. Better Security for Cards and Transactions. Chip cards make data stolen in a breach much more difficult to use: Counterfeiting is significantly more difficult than with stripe cards. Most observers, including the Federal Reserve Bank, agree that chip cards, "regardless of the verification method used, will provide a more secure payment environment." The cost of a complete transition in the United States is expected to be at least $6 billion, but the costs for issuers and merchants that do not meet the adoption deadline could be even greater: Now that the deadline has passed, the liability for fraudulent transactions will shift to the party that has not switched to chip cards. For example, if a merchant does not accept chip cards and the customer has a chip card, the transaction will still be processed using the magnetic stripe still present on the back of the card, but the merchant will bear responsibility for any fraudulent activity. If the merchant has a chip point-of-sale (POS) terminal, but the bank has not issued a chip card to the customer, the bank will be liable. If neither or both parties have complied, the fraud liability will remain the same as it is today. Historically, the issuer has paid about 60% of losses and retailers have paid 40%. Issuers picked up most of the losses when the card was present but was fraudulent, while merchants picked up the bulk of losses when cards were not present. Now that October 1, 2015, has passed, exploring and understanding the ramifications of the transition—or the failure to transition—is likely to become increasingly important for Congress, especially if additional major breaches occur. Additionally, new deadlines are coming in 2016 and 2017 for card-branded ATM cards. There are many policy issues related to EMV adoption in the United States and elsewhere in the world. This report describes the financial harm caused by data breaches and explains how those breaches are carried out. It provides information about the effect of the transition in selected foreign countries. The report also discusses resolved and remaining impediments to completing the EMV transition in the United States and identifies areas of potential congressional interest. EMV cards offer a significantly higher level of data security than stripe cards: Data on the chip is secured using both hardware and software security measures, so even if the card data is compromised, the chip itself will still be difficult to counterfeit. The EMV chip carries cardholder and account data, and is programmed to make decisions about a transaction and control its outcome, that is, approve or decline it. Chip cards can be produced as "chip-and-PIN," "chip-and-signature," or "chip-and-choice" (which allows the use of either a personal identification number [PIN] or signature). Transactions are verified in the method programmed into the chip. If the card is to have a PIN associated with it, the PIN is programmed into the chip before it is embedded in the card and sent to the cardholder. EMV is the global standard for the chip technology embedded in financial payment cards. Much of the rest of the world—Europe, Canada, Latin America, and the Asia-Pacific region—has already transitioned to chip cards. In the fourth quarter of 2012, there were 1.62 billion chip cards in use across 80 countries, leaving the United States as the last major country to implement what is now the de facto global standard. Globally, card fraud totaled $11.3 billion in 2012, an increase of 15% from 2011. In the United States, although fraud constituted less than 1% of total expenditures, credit card losses totaled $5.33 billion in 2012, an increase of 14.5% from 2011. The United States has been disproportionately affected by fraud: Since 2003, the United States has consistently accounted for about half of the total global loss, but for only about a quarter of the total volume of card payments ( Figure 1 ). Between 2004 and 2010, fraud committed on U.S.-issued bank credit cards rose 70% ( Figure 2 ). Debit card fraud also rose, with cards using a signature for verification accounting for 91% of the fraud and cards using a PIN for verification accounting for 9% ( Figure 3 ). Card fraud can be conducted in a number of ways, but it always begins with the theft of card information. The scale of the theft can range from small, such as stealing a wallet, to large, such as skimming or a data breach. Data breaches can be carried out in more than one way (and for reasons other than committing fraud), but the most common method is hacking into a POS system used to make card-based purchases. These breaches are called "POS intrusions." In 2013, 75% of breaches in the travel/hospitality sector and 31% in the retail sector were POS intrusions aimed at stealing credit and debit card data. POS intrusions and the ensuing card fraud are facilitated by what many consider to be the weak link in the U.S. card payment process: the continued use of magnetic stripe cards that carry unencrypted data. A hacker can gain access to a company's POS systems in a number of ways. Sometimes the hacker will use a "brute force" approach, systematically checking all possible keys or passwords until the correct one is found, or exploiting inadequately managed Internet connections to the POS system. Another common way is through the use of stolen third-party (vendor) credentials (sign-on information). For example, some POS system vendors do not change the default password to access the system. That password is often included in the system documentation, making it easy for anyone, especially a hacker, to find the information online. Once the hacker has gained access to the computer system used to manage the POS system, he or she installs malware that copies the unencrypted data on cards as they are swiped. The most common type of malware used in POS intrusions is called a "RAM scraper," so named because it allows the hacker to "scrape" data out of the memory of the POS system. The RAM scraper exploits the very brief period that the card data is in the POS reader, before it is encrypted and sent to complete the payment process. Europe has transitioned between about 73% and 80% of cards and about 95% of POS terminals to EMV technology. Other regions around the world have transitioned to varying degrees ( Figure 4 ). A 2012 study of five countries by the Federal Reserve Bank (FRB) of Atlanta examined fraud trends experienced by the United Kingdom, Canada, France, Australia, and the Netherlands as they transitioned from stripe cards to chip-and-PIN cards; none of the countries studied issued chip-and-signature cards. Three of the five countries studied in the report experienced decreases in both the rates and total amounts of card fraud ( Figure 5 ), with some exceptions attributed to factors other than the security of the chip itself. For example, when the United Kingdom began issuing chip cards, the cards continued to carry a magnetic stripe, too. If the card was swiped to make a purchase and the card data was compromised, it could be used in card-not-present (CNP) environments or to make counterfeit cards for use in non-chip countries. The data analyzed in the study showed that chip-and-PIN is most effective in reducing certain types of fraud, notably— card-present fraud ; domestic counterfeit card fraud , committed by manufacturing cards created with valid information from lost or stolen cards, but most often carried out using data stolen in a data breach or "skimming"; and lost and stolen card fraud , committed using an original, activated, and valid card after it is lost or stolen, in both "card present" (e.g., retail) and certain "card-not-present" (e.g., Internet purchase) scenarios. Additionally, mail non-receipt fraud , committed by stealing a card before it is activated by the rightful owner, has also decreased with the introduction of chip cards. For example, since 2004, this type of fraud has decreased 91% in the United Kingdom. Most U.S. issuers have stated that they plan to issue chip-and-signature credit cards, rather than chip-and-PIN cards. It is uncertain how this decision may affect fraud in the United States. In all but one of the countries studied (France), the switch to chip cards caused two types of fraud to increase: domestic CNP fraud , e.g., catalog or Internet purchases, and c ross-border counterfeit card fraud . This type of fraud uses data stolen from cards issued in chip countries to produce physical counterfeit cards for use in non-chip countries. This is a phenomenon referred to as "fraud migration," with the fraud migrating primarily to the United States, the last major market to transition to chip cards. In the countries where CNP fraud eventually decreased, many merchants have adopted fraud prevention measures. There are two simple prevention measures: requiring cardholders to authenticate their identities by entering the card's verification/security code and/or expiration date. A card's security code and expiration are shown only on the card and are not encoded on either the magnetic stripe or the EMV chip. An additional measure is "Address Verification Service" (AVS). AVS matches the billing address information provided at check-out with that on file with the card issuer. Other options to mitigate CNP fraud are also available and have been adopted in varying degrees. Some of these are discussed below. Visa, MasterCard, and American Express have developed and adopted proprietary security measures to make CNP fraud more difficult to perpetrate: Verified by Visa, SecureCode, and SafeKey, respectively. All three are based on the 3-D Secure protocol and are only used for Internet-based purchases. They work by redirecting the payment transaction to the issuer's website to perform user authentication by requiring the cardholder to provide additional credentials before approving a transaction. The merchant, the cardholder, and the card issuer all must use the system for it to work. In 2013, only about 3% of U.S. merchants employed an authentication method based on 3-D Secure. The 3-D Secure protocol allows the card issuer to define what those credentials will be. For example, the cardholder might be required to enter a password. The password can be permanent or transaction specific. Transaction-specific passwords can be generated in a number of ways. Issuer-generated passwords can be sent via text message and email to the cardholder's registered mobile device and email account. This method can be used with both stripe and chip cards. With a chip card, the cardholder can generate a password by inserting the card into a cardholder-owned reader and entering the card's permanent PIN. The reader will then generate a one-time PIN for use with that specific transaction. In Europe, about 30 million people use chip cards and readers for Internet transactions. Although 3-D Secure provides an extra layer of security for CNP transactions, it still has vulnerabilities. For example, in the past, hackers successfully used malware to direct cardholders signing up for 3-D Secure to a fake enrollment window, allowing theft of the card data. While this specific vulnerability can be avoided using additional security methods, hackers are likely to continue looking for any vulnerability they can find and exploit in POS systems. There are also new security measures available that were developed by third-party companies not associated with the card companies. Two such examples are "D-FACTOR," by DeviceAuthority, and "TranSecure," a partnership between Quatrro and NorseCorp. Using D-FACTOR, cardholders link their credit cards to one or more devices, such as a mobile phone or home computer. Before a CNP purchase is approved, D-Factor verifies that the purchase is being made using a cardholder-registered device. TranSecure is not a transaction authentication method, but provides ongoing monitoring for fraud. This system uses fraud-detection software paired with fraud analysts to thwart CNP and other types of card fraud. Neither of these systems has been widely adopted at this time. Cross-border counterfeit fraud increased in the countries studied by FRB Atlanta, as counterfeiters used data stolen in chip-and-PIN markets and produced stripe cards for use in those markets still using them. The FRB Atlanta report attributed the increase to issuers providing cards with both chips and magnetic stripes. For instance, when the United Kingdom transitioned to EMV cards, credit and debit cards were issued with both a chip and a magnetic stripe, which rendered them as easy to exploit and clone as stripe cards. The stolen data could then be used to manufacture counterfeit stripe cards for use in places such as the United States, where the transition had not yet begun. To mitigate the chance that this vulnerability will exist, cards issued in the U.K. now include a small "flag" on the magnetic stripe to indicate that the card has a chip on it. If swipe card data is stolen, the flag would be copied along with the other stolen data onto the cloned card. The POS system would then recognize the flag if the card were swiped, alerting the merchant that a cloned card was being used. The United Kingdom and Australia reported an initial increase in counterfeit fraud after EMV implementation, but it later decreased. It is too soon to say whether the United States could have this same "immunity" from such an increase: Since the United States is the only remaining major market still using at least some stripe cards, there will not be any other major markets where stolen information could be used. Unlike CNP fraud, counterfeit fraud appears to diminish as more countries eliminate stripe cards. The upcoming liability shifts for branded ATM cards and the ongoing debate over signature versus PIN are two areas of continued work toward a complete shift to chip cards. On October 1, 2016, a new liability shift will occur: Automated teller machines (ATMs) that accept MasterCard-branded debit cards must be EMV operational. ATMs that accept Visa-branded debit cards will have an additional year to be operational. As nearly all ATMs in the United States accept both Visa-branded and MasterCard-branded cards, the 2016 date for MasterCard essentially forces all ATMs to be operational. As with the 2015 shift date, this date is not a mandate, but most ATMs are likely to be EMV operational to avoid possible fraud liability. There is some concern that the complexity of updating payment processing software to accommodate both debit (PIN) and credit (signature) processing of debit card transactions could contribute to the delay or cause a decrease in the number of ATMs. Many retailers are frustrated with the delays in certifying their payment systems. Retailers made significant investments to upgrade their systems to avoid the possibility of having the liability for fraudulent transactions shift to them after October 1, 2015. For instance, in New York City, one supermarket chain spent about $700,000 to upgrade their systems in time to meet the October 1, 2015, deadline, but their systems remain uncertified as of March 2016 and they have now begun incurring the costs associated with fraud liability. The banks and retailers have differing opinions on the cause or causes for the delay in retail-outlet certification: Banks say that retailers waited till the last minute to update their terminals. Retailers point to financial ties between the banks and the companies that provide certification, saying there is no motivation to move faster. Although most issuers are currently providing chip-and-signature cards, some experts predict that could change. Along with some retailers, the federal government supports PIN use in EMV transactions, stating: Currently, not all EMV cards are issued to consumers with the PIN capability and not all merchant PoS terminals can accept PIN entry. EMV transactions at chip PoS terminals provide more security of consumers' personal data than magnetic strip PoS transactions.... Although EMV cards provide greater security than traditional magnetic strip cards, an EMV chip does not stop lost and stolen cards from being used in stores, or for online or telephone purchases when the chip is not physically provided to the merchant. As yet, there has been no legislation introduced in the 114 th Congress that would affect the EMV transition. In the 113 th Congress, no legislation was introduced that would have directly affected the manner in which the transition is taking place. Four bills contained language that would have addressed concerns about improving protection from credit card data theft in other ways. These bills would have, for example— increased protection for consumers whose card data had been compromised (e.g., free credit monitoring for a year); increased penalties for those convicted of identity theft and certain other violations of data privacy and security; provided for criminal penalties against entities that fail to provide required notice of a breach of personally identifiable information; defined thresholds for when public notification would be required after a breach; and/or defined thresholds for when notification of law enforcement or other government entities (e.g., Secret Service, Federal Bureau of Investigation, Congressional Judiciary Committees, Federal Trade Commission) would be required. A resolution was also introduced that would have expressed "the sense of the Senate that the President should pursue extradition authority for international cybercriminals committing credit card theft targeting United States citizens." No further action was taken. To date, there has been one hearing in the 114 th Congress on the EMV transition. On October 7, 2015, the House of Representatives Committee on Small Business held a hearing, "The EMV Deadline and What It Means for Small Businesses." The 113 th Congress held three hearings that addressed data breaches, both generally and in response to specific breaches. Each hearing included questions and discussion about the status of EMV adoption in the United States, such as how the transition was expected to affect the frequency and seriousness of data breaches and the progress being made towards a full EMV migration in the United States. Privacy in the Digital Age—Preventing Data Breaches and Combating Cybercrime. This hearing was held by the Senate Committee on the Judiciary on February 4, 2014. It consisted of two panels of witnesses, the first composed of representatives from the consumer protection, retail, and data security sectors, and the second composed of representatives from federal government agencies charged with investigating the breaches. Of particular interest to committee members was the Target Corporation data breach, as well as the Personal Data Privacy and Security Act, which was reintroduced by Senator Leahy, Judiciary Committee Chair, on January 8, 2014. Among other issues, the hearing explored how quickly companies inform their customers after a data breach, and whether current reporting requirements are adequate or whether legislation is needed. Protecting Consumer Information: Can Data Breaches Be Prevented? This hearing was held on February 5, 2014, by the House Committee on Energy and Commerce and its Subcommittee on Commerce, Manufacturing, and Trade. This hearing was prompted by the Target Corporation data breach. Among other issues, the hearing explored: the relationship between federal law enforcement and the private sector in tracking and responding to breaches of consumer information; how private sector entities work among themselves and with the federal government to develop and maintain best practices; how the tactics and efforts of cybercriminals have changed over time; whether it is possible or realistic for a company to be impervious to data breaches; and whether additional regulation of data security might be necessary. Protecting Consumer Information: Can Data Breaches Be Prevented? Can Technology Protect Americans from International Cybercriminals? This hearing was held on March 6, 2014, by the House Committee on Science, Space, and Technology Subcommittee on Oversight and Subcommittee on Research and Technology. This hearing focused on the consumer privacy and national security aspects of data breaches. Witnesses included federal government officials, payment industry representatives, and a privacy advocacy organization. Members were particularly interested in whether the payments industry was on track to meet the October 1, 2015, deadline. Other issues discussed included the current state of technology and standards to protect consumers from international cybercriminals, and the evolution of cyberattacks against the U.S. industry from rogue hackers to sophisticated international crime syndicates and foreign governments. Questions and concerns remain that Congress might choose to monitor. Data on the impact of EMV signature verification on fraud reduction do not exist because signature verification was not adopted in other countries (they chose to adopt PIN verification). So, while the primary driver of the transition is fraud reduction, it remains to be seen if signature verification will produce the same level of fraud reduction in the United States as PIN verification has produced in other countries. Congress may follow the renewed interest by some states to encourage PIN adoption. The delay reaching agreement over debit card programming could cause the EMV debit card transition to lag behind the EMV credit card transition. One study found that fraud reduction in POS transactions was achieved more quickly by migrating all card products at or near the same time. The payments industry will need to stay on track to achieve the simultaneous transition, which could have an impact on overall fraud reduction, and the relative level of fraud between credit cards and debit cards. Given the broad interest in reducing data breaches and fraud, and the October 1, 2015, transition deadline, the 114 th Congress might examine the effectiveness of the transition to determine whether legislative action may be needed, especially if major breaches continue to occur. Many questions were raised in hearings during the 113 th Congress, including: Are companies implementing the additional security safeguards recommended to decrease c ard- n ot- p resent f raud ? CNP fraud decreased significantly in countries where both card issuers and merchants implemented additional safeguards on such transactions. Card issuers here have implemented various methods to offer those safeguards, but success will be largely dependent on widespread use by merchants. Are companies taking adequate steps to prepare for a data breach? Data breaches will likely continue, but there are steps that companies can take to prepare for them and mitigate their damage. For example, Experian has published a preparation guide for companies that could make post-breach activity easier and more conducive to assisting law enforcement. Are existing post-breach consumer notification procedures adequate and consistent? Consumers might reasonably expect to receive all the information needed, in a timely manner, to protect themselves after a data breach. Additionally, they might expect to receive the same information after every breach, regardless of the company who had been breached or where they are located. Are existing legal and regulatory post-breach thresholds that trigger mandatory reporting to law enforcement adequate and consistent ? Law enforcement is unable to begin investigating breaches until they have been notified that a breach has occurred by the affected company. In addition, nearly all states have their own laws requiring notification; there are no federal laws or guidelines. Of the states that have laws, the circumstances that "trigger" reporting differ. For example, some states define "personal information" narrowly, while others have adopted more expansive definitions. So, in effect, a company might be required to report in some states, but not all, when their data has been breached, as well as report different information in each state. These differing requirements can present a challenge to companies with a presence in more than one state. This is one reason that some in the federal government, including some in Congress and the Federal Trade Commission, have advocated a single federal law to address all aspects of data breach reporting nationwide. Many states with existing, and in many cases long-standing laws, though, have expressed concerns about enacting a federal law. They believe such a law, which would likely supersede state laws, might offer consumers less protection. One compromise that policymakers have discussed would be to allow existing state laws with more stringent protections to take precedence over a federal law. The cost of the EMV transition, the slow pace of adoption, and other issues may have hampered both issuer and retailer efforts to meet the October 2015 deadline. Disagreements over transaction verification methods for credit transactions, chip programming, and the fee structure for debit transactions all played roles in delaying EMV transition planning and adoption. Most issues have been resolved through industry negotiation or litigation. There have been four impediments to EMV adoption in the United States: High Cost of Implementation . Both card issuers and merchants in the United States have balked at transitioning to chip cards. They have already made significant financial investments in existing technology, and the transition will impose immediate, short-term costs on them. The cost of the transition to chip cards for financial institutions and businesses that use POS readers will be significant. Although opinions differ greatly as to the actual amount, most industry observers agree that it will cost between $6 billion and $8 billion. Of that amount, 75% is likely to be paid by merchants, making the transition three times as expensive for them as for the issuers. Costs for Card Issuers: Chip and Card Production . Some analysts have stated that manufacturing chip cards costs between $1.00 and $4.00 per card—2 to 16 times as much as traditional stripe cards, which cost about 25¢ to 50¢ each. Adding to that cost, personalizing the card with the holder's name and other details is about twice as expensive with chip cards as with stripe cards. While the issuing institution would pay initially for the chip and personalization of the card, those costs might be passed down to the consumer. Issuers will also face consideration of the one-time and ongoing costs associated with each type of implementation. Costs for Merchants: POS System Replacement . In addition to the costs to issuers of producing the cards, merchants have to purchase new POS equipment (i.e., chip readers) to process chip card transactions. In 2015, cost estimates ranged from about $100 to $600 each, depending on the number ordered and specific product features. Stripe readers cost approximately $50 to $100 when purchased individually, but less than $20 when purchased in bulk. Estimates prior to the transition were that only 25%-44% of retailers would meet the deadline, with the majority of those being the larger retailers. Minimal Implementation Prior to October 1, 2015 . There are about 1.1 billion credit and debit cards in use in the United States. At the time of the transition, estimates of the share of cards with EMV chips stood between 7% and 15%. Some believe that issuers would have had to replace, on average, about 2 million cards every day until the deadline to achieve 100% transition. Despite the slow start, some experts have predicted that by the beginning of 2016, 90%-95% of cards could be chip cards. About 33% of POS machines are now EMV compliant and that figure would have to increase significantly before the benefits of the chip cards can be realized. Transaction Verification: PIN versus Signature. Despite initial resistance from the retail community, which asserted that PIN verification would be far more likely to reduce fraud, card issuers largely decided to implement chip-and-signature. This could change, however. First, in a June 2015 speech, Federal Reserve System Governor Jerome H. Powell expressed his support for the use of PINs. Then, on November 17, 2015, nine state attorneys general asked leaders at companies including MasterCard, Visa, Discover Financial Services, Bank of America, Capital One, Citigroup, American Express, and JP Morgan Chase—who have collectively begun the nationwide transition to a chip-and-signature card—to move to full chip and PIN technology as soon as possible. This latest renewed interest could indicate a possible shift in the future. Dual Debit Applications . Visa and MasterCard use one proprietary debit processing application, and the major PIN debit networks use another. After lengthy negotiations, both sides finally agreed to cross-license their applications in July 2013, resolving most of the technical issues hampering transition planning. This issue is no longer a matter of contention. Debit Transaction Fees: Delay in Regulatory Certainty . In 2010, as part of a larger financial reform law, the Federal Reserve Board (FRB) was charged with developing rules setting maximum transaction fees ("interchange fees") that merchants can be charged for debit card transactions. In addition, the law specified the framework the FRB was to use in developing those rules. The rules went into effect in October 2011, but the National Retail Federation, representing merchants, appealed the ruling, stating that it believed the fee ceiling had been set too high. In July 2013, a judge for the U.S. District Court for the District of Columbia (D.C.) rejected the FRB's regulations, stating that the agency had set the cap too high on debit-card transactions, and that it had disregarded congressional intent in its proceeding. However, in March 2014, the Court of Appeals for the D.C. Circuit reversed the lower court's decision and upheld the FRB's rules. The merchants again appealed the decision, this time to the U.S. Supreme Court, filing for a writ of certiorari in August 2014. On January 20, 2015, the Court denied the merchants' petition, allowing the FRB's original rules to go into effect. Because of the long-running court case and the other problems described, card issuers lost more than three years of planning time to meet the October 2015 deadline for debit cards (credit cards are unaffected by the fee structure under consideration by the Court). Some issuers were thought to be hesitant to replace their stripe-based debit cards until the issue was resolved. The delay has the potential to cause a lag between when chip-based credit cards are issued and chip-based debit cards are issued. Issuing debit and credit chip cards simultaneously was cited by the FRB as a key to maximizing the benefits of chip cards in reducing fraud: Based on the experiences of chip-and-PIN migrations in other countries, it is imperative that all card-based products should be migrated at, or near, the same time to have a positive impact on reducing face-to-face fraud within a country's borders. As witnessed in Canada, migrating credit before debit resulted in a significant increase in fraud perpetrated with debit cards, ultimately resulting in a minimal reduction of total card fraud. If the United States migrates to chip-and-PIN without market consensus, agreement, or in a timely and concerted effort; those issuers, networks, or merchants who are slow to migrate will see increased fraud levels and the impact on overall fraud levels could be minimal. Ultimately, it remains to be seen what impact the court case will have on debit card replacement.

Summary: Consumer financial card fraud due to data breaches of card information is an ongoing problem in the United States. The majority of breaches are carried out against point-of-sale (POS) systems, and are facilitated by what many consider to be the weak link in the U.S. retail sales payment process: the continued use of magnetic stripe cards (also referred to as stripe-and-signature cards). These cards are still what most U.S. consumers think of when referring to financial cards. In much of the rest of the world, cards that provide a much higher level of security for conducting sales transactions have been used for many years: EMV cards, named for the coalition of card brands Europay, MasterCard, and Visa (the EMV Coalition or EMVCo) that developed the specifications for the system in the 1990s. EMV cards store card information on an embedded microchip and are more commonly called chip cards. With these cards, instead of swiping and signing to make a payment, the cardholder inserts the card into the POS machine, then either enters a personal identification number (PIN) or signs to verify the transaction. On October 1, 2015, the liability for fraudulent transactions involving magnetic stripe cards shifted to the entity—card issuer (e.g., bank, credit union) or merchant—that had not yet made the transition. The transition makes U.S.-issued cards compatible with POS systems and automated teller machines in much of the rest of the world. On October 1, 2016, a new liability shift will occur: automated teller machines (ATM) that accept MasterCard branded cards must be EMV operational. ATMs that accept Visa-branded cards have an additional year to be operational. The 114th Congress may examine the transition and its effectiveness to determine whether any legislative action is needed, especially if major breaches continue to occur despite the transition.