New-style credit cards will leave consumers vulnerable

A quiz: What technology has been arriving unbidden in your mail lately, teasing you with the prospect of extra security but not fully delivering?

The answer: chip-based credit and debit cards, replacing those with only the familiar magnetic stripe.

This fall, as new Visa and MasterCard rules push U.S. merchants to install chip-card readers by Oct. 1, consumers will increasingly encounter a technology long used on payment cards in Europe, Canada, and around the globe. But we won't be as protected as consumers in other countries, where chip-based debit and credit cards are commonly used in combination with PIN codes.

Just as they did years ago, when they foisted "signature debit" on U.S. consumers to supplant the safer PIN-based networks that preceded them, Visa and MasterCard and their big-bank allies insist that signature verification is all we need, even with chip cards.

The result? Fraud will remain more of a problem here than elsewhere, while Visa, MasterCard and card issuers will make out like financial bandits - in other words, pretty much as always.

Why we're stuck in this situation is a trickier question. As a consumer, you have little power to alter it short of demanding changes from politicians and regulators. But it's always good to know the lay of the marketplace.

The big picture: The long-touted "cashless society" is slowly unfolding, not by fully replacing cash, but by offering plastic and electronic payments as alternatives. The result is we have two monetary systems: one public and one private. And, as it often does, privatization has created some troubling incentives. To see how, just follow the money.

The public system for cash and checks operates as always: If you pay Joe Retailer $100, Joe puts $100 into his bank account. It's not that money-printing and check-clearing are free - taxes and bank fees cover many of those costs. But what you pay is what Joe gets.

Parallel to that are Visa, MasterCard, and the big U.S. banks, which essentially sit atop a privatized monetary system - one that gives them a cut of every transaction. If you pay Joe with plastic, he doesn't get $100. He forks over sizable fees - often 3 percent or more of a payment.

How lucrative is that? Think about "cash back" credit cards promising kickbacks on your payments. Or consider the investment and energy poured into alternative systems such as PayPal and Bitcoin, or the long fight over fees charged to retailers that led to the "Durbin amendment" to 2010's Dodd-Frank financial reforms.

Durbin addressed one of the most egregious aspects of the private system: that Visa and MasterCard, when they beat out PIN-based networks such as Philadelphia's MAC system, did so in part by offering banks percentage fees similar to what they received on credit cards.

Debit payments are less risky than credit, because they draw on your bank account. Thanks to Durbin, large banks are limited to taking about 22 cents per debit payment, though smaller banks' fees still average about twice that much.

There are, of course, other costs to transactions. One of those is their fraud risk, which brings us back to the new chip cards - known as EMV, for Europay, MasterCard, and Visa.

The Merchant Advisory Group, a coalition of companies reliant on plastic payments, had long urged Visa and MasterCard to adopt the chip cards as an anti-fraud tool - and to require PINs with them, as are used almost everywhere else.

Why did it fail? Mark Horwedel, the group's CEO, says a key reason is that different rules cover different kinds of fraud - and that, once again, Visa, MasterCard, and the big banks are chiefly taking care of themselves.

Card issuers have historically covered most costs resulting from counterfeit-card fraud - a problem chip-based cards will largely eliminate. To push merchants to be ready for EMVs, the liability burden shifts in October: If merchants fail to install new equipment, they'll bear all those losses.

But merchants and banks typically split the cost of lost- and stolen-card fraud, with online merchants required to cover the entire risk, Horwedel says. Those are the kinds of fraud that PINs would minimize but that EMVs alone do nothing to address.

Studies show that PINs cut fraud losses by as much as 85 percent or more - one reason their use is also urged by such advocates as U.S. PIRG's Ed Mierzwinski, who says consumers ultimately pay the costs of fraud either indirectly or as its victims. If your bank account can be easily looted, a card network's "zero liability" promise offers limited reassurance and sometimes no quick help, he says.

Mierzwinski calls the new EMVs a missed opportunity. "They could have given consumers a better product, but instead they went halfway."

Newer technologies such as "tokenization," which replaces card numbers to protect purchases, hold promise, but PINs are proven. The only reason we don't have them is who profits without them.

In America, it's clear that Visa, MasterCard, and the big banks still hold - and issue - almost all the cards.

215-854-2776@jeffgelles

www.philly.com/consumer