American consumers increasingly rely on credit and debit cards to pay for goods and services. Between 1997 and 2011, card payments rose from accounting for 23% of payments to 48%. During the same period, payment by cash and checks dropped from 70% to 35%. In 2011, consumers made 49 billion debit transactions totaling $1.8 trillion and 26 billion credit transactions totaling $2.1 trillion. This shift makes card security and fraud prevention more important than ever. In 2012, MasterCard and Visa—also called "payment brands" —set October 1, 2015, as the date by which U.S. card issuers—banks and credit unions—would need to have replaced existing credit and debit magnetic stripe cards with chip cards, and for merchants to begin accepting them. Chip cards are formally known as "EMV" cards, named for the coalition of three companies, Europay, MasterCard, and Visa, that developed the specifications for the standard. EMVCo membership has now expanded to include the payment brands of American Express, JCB, Discover, and UnionPay. There were four significant drivers of EMV adoption in the United States: L iability Shift. The October 1, 2015, deadline that shifted liability to the party that has not switched to chip cards is seen as a strong incentive for merchants and issuers to make the switch. Increasing Financial Impact of Fraud. In 2012, credit card losses in the United States totaled $5.33 billion, an increase of 14.5% from 2011. Between 2004 and 2010, fraud using U.S.-issued bank credit cards rose 70%. Merchants, card issuers, and consumers are adversely affected by increases in fraud. Increasing Concern o ver Data Breaches. Although the number of breaches dipped significantly between 2011 and 2012, there has been a modest increase between 2012 and 2013. Although the number of incidents in 2013 (198) is small compared to 2011 (855), a lot of attention has been paid to those breaches in the news. That attention appears to have created the perception that the number of breaches is increasing more than it actually is, raising concern among consumers, as well as policymakers. Better Security for Cards and Transactions. Chip cards make data stolen in a breach much more difficult to use: Counterfeiting is significantly more difficult than with stripe cards. Most observers, including the Federal Reserve Bank, agree that chip cards, "regardless of the verification method used, will provide a more secure payment environment." The cost of a complete transition in the United States is expected to be at least $6 billion, but the costs for issuers and merchants that do not meet the adoption deadline could be even greater: Now that the deadline has passed, the liability for fraudulent transactions will shift to the party that has not switched to chip cards. For example, if a merchant does not accept chip cards and the customer has a chip card, the transaction will still be processed using the magnetic stripe still present on the back of the card, but the merchant will bear responsibility for any fraudulent activity. If the merchant has a chip point-of-sale (POS) terminal, but the bank has not issued a chip card to the customer, the bank will be liable. If neither or both parties have complied, the fraud liability will remain the same as it is today. Historically, the issuer has paid about 60% of losses and retailers have paid 40%. Issuers picked up most of the losses when the card was present but was fraudulent, while merchants picked up the bulk of losses when cards were not present. Now that October 1, 2015, has passed, exploring and understanding the ramifications of the transition—or the failure to transition—is likely to become increasingly important for Congress, especially if additional major breaches occur. Additionally, new deadlines are coming in 2016 and 2017 for card-branded ATM cards. There are many policy issues related to EMV adoption in the United States and elsewhere in the world. This report describes the financial harm caused by data breaches and explains how those breaches are carried out. It provides information about the effect of the transition in selected foreign countries. The report also discusses resolved and remaining impediments to completing the EMV transition in the United States and identifies areas of potential congressional interest. EMV cards offer a significantly higher level of data security than stripe cards: Data on the chip is secured using both hardware and software security measures, so even if the card data is compromised, the chip itself will still be difficult to counterfeit. The EMV chip carries cardholder and account data, and is programmed to make decisions about a transaction and control its outcome, that is, approve or decline it. Chip cards can be produced as "chip-and-PIN," "chip-and-signature," or "chip-and-choice" (which allows the use of either a personal identification number [PIN] or signature). Transactions are verified in the method programmed into the chip. If the card is to have a PIN associated with it, the PIN is programmed into the chip before it is embedded in the card and sent to the cardholder. EMV is the global standard for the chip technology embedded in financial payment cards. Much of the rest of the world—Europe, Canada, Latin America, and the Asia-Pacific region—has already transitioned to chip cards. In the fourth quarter of 2012, there were 1.62 billion chip cards in use across 80 countries, leaving the United States as the last major country to implement what is now the de facto global standard. Globally, card fraud totaled $11.3 billion in 2012, an increase of 15% from 2011. In the United States, although fraud constituted less than 1% of total expenditures, credit card losses totaled $5.33 billion in 2012, an increase of 14.5% from 2011. The United States has been disproportionately affected by fraud: Since 2003, the United States has consistently accounted for about half of the total global loss, but for only about a quarter of the total volume of card payments ( Figure 1 ). Between 2004 and 2010, fraud committed on U.S.-issued bank credit cards rose 70% ( Figure 2 ). Debit card fraud also rose, with cards using a signature for verification accounting for 91% of the fraud and cards using a PIN for verification accounting for 9% ( Figure 3 ). Card fraud can be conducted in a number of ways, but it always begins with the theft of card information. The scale of the theft can range from small, such as stealing a wallet, to large, such as skimming or a data breach. Data breaches can be carried out in more than one way (and for reasons other than committing fraud), but the most common method is hacking into a POS system used to make card-based purchases. These breaches are called "POS intrusions." In 2013, 75% of breaches in the travel/hospitality sector and 31% in the retail sector were POS intrusions aimed at stealing credit and debit card data. POS intrusions and the ensuing card fraud are facilitated by what many consider to be the weak link in the U.S. card payment process: the continued use of magnetic stripe cards that carry unencrypted data. A hacker can gain access to a company's POS systems in a number of ways. Sometimes the hacker will use a "brute force" approach, systematically checking all possible keys or passwords until the correct one is found, or exploiting inadequately managed Internet connections to the POS system. Another common way is through the use of stolen third-party (vendor) credentials (sign-on information). For example, some POS system vendors do not change the default password to access the system. That password is often included in the system documentation, making it easy for anyone, especially a hacker, to find the information online. Once the hacker has gained access to the computer system used to manage the POS system, he or she installs malware that copies the unencrypted data on cards as they are swiped. The most common type of malware used in POS intrusions is called a "RAM scraper," so named because it allows the hacker to "scrape" data out of the memory of the POS system. The RAM scraper exploits the very brief period that the card data is in the POS reader, before it is encrypted and sent to complete the payment process. Europe has transitioned between about 73% and 80% of cards and about 95% of POS terminals to EMV technology. Other regions around the world have transitioned to varying degrees ( Figure 4 ). A 2012 study of five countries by the Federal Reserve Bank (FRB) of Atlanta examined fraud trends experienced by the United Kingdom, Canada, France, Australia, and the Netherlands as they transitioned from stripe cards to chip-and-PIN cards; none of the countries studied issued chip-and-signature cards. Three of the five countries studied in the report experienced decreases in both the rates and total amounts of card fraud ( Figure 5 ), with some exceptions attributed to factors other than the security of the chip itself. For example, when the United Kingdom began issuing chip cards, the cards continued to carry a magnetic stripe, too. If the card was swiped to make a purchase and the card data was compromised, it could be used in card-not-present (CNP) environments or to make counterfeit cards for use in non-chip countries.