New Guidance or Not, Bankers Move Forward

But some banks and credit unions say they can't wait for guidance; they're already moving forward with investments in new technologies, including end-to-end encryption and EMV, the EuroPay, MasterCard, Visa standard.

Take Jacksonville, Fla.-based JM Associates Federal Credit Union as an example. The $86 million credit union recently signed with First Data Corp.'s STAR Network to start rolling out contactless chip-based debit cards during the second quarter to its 7,100 members. The program JM Associates signed for: CertiFlash, which was announced by STAR in September.

We've got to move off of the mag-stripe as much and as soon as possible. - Jim Ryan, JM Associates FCU 

Jim Ryan, JM Associates' president, says his institution can't wait for new guidance. "I think our members are already somewhat accustomed to this technology," Ryan says. "And I think we want to get them prepared to use this technology from an FI perspective, before it comes from competition from non-financial services sources."

Why the rush? Escalating incidents of card fraud, Ryan says. "We've got to move off of the mag-stripe as much and as soon as possible."

Complying with any new authentication requirements is not the focus. "It's not about the requirements," he says. "There are requirements for merchants, but those requirements do not always fully protect the consumers from fraud. FIs have to look at that and make sure there they are protecting consumers, even if it's the merchant's responsibility, because of the cost associated with that fraud. The authentication piece makes sense, obviously, but we have to look ahead of even that."

Contactless payments have been tried before in the U.S. and they weren't unsuccessful. MasterCard PayPass and Visa payWave both failed to gain significant market acceptance. This time, coming from a processing network like STAR, the merchant buy-in preceded the institution buy-in.

"Certiflash offered a backbone," Ryan says. "The merchants are already using this, so we know the cards will be accepted." And the card technology is much more secure. For each transaction, the card's chip encrypts and transmits a card number good for only a single transaction. The transaction also requires a PIN for transactions that exceed $25, so it's not the tap-and-go method first introduced by PayPass and payWave.

Not exposing the card number or allowing the merchant to store the number during or after the transaction will dramatically reduce fraud, Ryan says. "And that makes a huge difference for us as a financial institution."