There is an enormous gap between use of cards, and the benefits of the cards.  The simple truth is that people do not associate any benefits with the switch to the smarter cards.

Convenience to drive contactless uptake, but consumers still need convincing | finextra

Convenience, rather than security, will be the driving force behind the UK adopting new payment methods, according to a survey of 1000 British consumers conducted on behalf of Ingenico.

Rogers Wireless joins RBC and Visa m-payments pilot

RBC (Toronto:RY.TO)(NYSE:RY), Visa and Rogers Wireless have come together for the next phase of the mobile phone payment pilot, which will ultimately allow Canadians the flexibility to make purchases securely at the point of sale with a wave of their mobile phone.

Its to be aimed at small payments, and using Motorola phones.  That latter point is a hinderance it its limited to one phone, but hopefully thats only for the pilot.

The technology used is Near Field Communication (NFC) that is described at Wikipedia as –

a short-range high frequency wireless communication technology which enables the exchange of data between devices over about a 10 centimetre (around 4 inches) distance.

In Tokyo last time I noticed the prevalence of smart wireless payment cards.  I have a Pasmo card that was for the subway, and now I can use in convenience stores, and other merchants.  Which all leads to the question of whether the future will be contacless cards or phones.  The answer is likely both.

Others in Japan:

Suica issued by JR East (Railway). Uses RFID.

Pasmo issued by Passnet (other rail providers than JR).  Uses RFID.  Works best for Tokyo people because it works on Tokyo Metro.

It also sounds like it requires no work on the FI end – so its a no brainer to trial this one!

IBM unveils USB stick to fight online banking fraud | Finextra

IBM has unveiled a prototype USB stick designed to secure online banking transactions against malware and man-in-the-middle attacks.

The Zone Trusted Information Channel (ZTIC) plugs into the USB port of any computer to add an extra layer of security on top of existing authentication systems like smart cards, PINs and one-time validation codes.

This device in simple terms bypasses your PC and goes straight out over a secure connection to your bank. 

What the user sees on the ZTIC display is identical to what the server "sees".

In addition it can be supplemented by a smart card log in.

Relevance to Bankwatch:

Kudos to IBM for this.  The two factor tokens to date are not protection against all possible attacks, including man-in-the-middle in particular.  While I have always felt consumers would balk at an additional device, that view was qualified by the limited benefit. 

If in fact a device exists that guarantees security, then that is completely different story.

Views in support or to the contrary welcomed.  This is an important topic for ecommerce, and for online banking.

Canada begins Chip and PIN roll out

Chip cards will continue to carry the magnetic stripe to allow cardholders to use their debit cards in other countries that do not use chip technology.

By definition, that means the card can be cloned, and used in a magstripe country.  We just happen to have the largest magstripe country in the world next door – USA.  The US has no plans to move to chip.  This is a country of 300 million people, and lots of merchants with a less than stellar record for security.

Relevance to Bankwatch:

Why can Canadian banks not issue cards with chip only.  For customers who require the convenience of magstripe in the USA, charge them $20 – $40 for the extra card, with no chip.  That extra card could have access to a limited amount of funds, or a limited time window to accommodate vacations.  Offer up preferences in online banking to manage their magstripe preferences. 

Given the fraud environment in 2008 customers would pay for that service.  Until we get to 100% chip with no magstripe, fraud is just an opportunity for the bad guys.

Thoughts from the chip experts?

I have similar worries for North America as US sticks to mag stripe, and Canada to chip and mag stripe combined.  The opportunities for criminals are simply too great.

I didn’t want to write about fraud yet again, but… | Digital Money Forum

Total card fraud last year was UKP 535 million (about a billion dollars) but the half-yearly figures for 2008 are predicting a full year well in excess of UKP 600 million. The prospects of fraud reducing remain, I think, slightly gloomy.

Digital Money Forum: We should have such problems

Only a sixth of mobile phone subscribers use their handsets as contactless wallets! ONLY A SIXTH!! Well, here in the U.K. it’s about 0.001% so I’m quite jealous. Not just of Japan, but of lots of other places.

Aneace’s Blog: A solution to the interchange dilemma

the only solution to the interchange problem is to raise the price of cash to match its cost, for example through an ATM charge

Aneace is right that this is a political and bank non-starter, because the secondary revolt would out-weigh the benefit.

Prepaid cards acceptance, and cash reduction, can only succeed, once someone figures out a better mousetrap.

Finextra: Brits struggling with PINs – survey

Around a quarter of cardholders in the UK are putting their money at risk by using the same PIN number for all their credit and debit cards, according to research commissioned by price comparison Web site Moneysupermarket.

This is no surprise, and rather than being seen as a problem, should be seen as an opportunity by the industry to consider additional assistance for people. Biometrics spring to mind, such that cards can only be used by the owner.

Digital Money Forum: Slow penetration

When I waved my card at the reader, nothing happened. The woman serving me asked if I really wanted to use the “terminal”. I said yes. She said: “It will be an extra five pence”.

Whether it’s the lack of suitable terminals for the kinds of merchants,
miscommunication between acquirers and merchants about benefits, simple
unfamiliarity or whatever, I hope someone on the business side has a
handle on this.

Interac Association – Media > Press Releases

Toronto, Ontario, September 12, 2007– As part of its commitment to providing the safest and most secure payment network, Interac Association today announced the completion of Canada’s first INTERAC debit card transaction at the point-of-sale terminal using chip technology. The transaction was processed today by TD Merchant Services using a BMO Bank of Montreal chip debit card at Mercato Giovanni’s Fresh Food located in downtown Toronto. The chip debit card transaction was conducted in preparation for the Kitchener-Waterloo, Ontario market trial of chip technology which will begin in fall 2007.

It is essential that Banks, and credit card companies follow through with enhancements such as “Verified by Visa “.

But more so, this article points to the need for online vigilance for card numbers that are available online. This will result in the usual, ‘is it Visa’s job our [the Bank's] job’, but the need is so clear, surely that can be sorted out.

It would be simple for companies like Visa, MasterCard, and Discover to take a list of the most common 8-digit prefixes, query for them every day on Google, and de-activate any new credit card numbers that were found that way. (American Express cards are apparently not vulnerable to this trick, because when their 15-digit card numbers are written with spaces, they are usually written in the format “3xxx xxxxxx xxxxx”, and Googling for the first 10 digits as “3xxx xxxxxx” didn’t yield anything in my random test of ten AmEx numbers. But this is still their problem too, since the searches that turn up “treasure troves” of card numbers usually include AmEx numbers as well.) A Perl programmer could write a script in one afternoon that could run through all the known 8-digit prefixes, parse the search results, and pick out any URLs that weren’t listed as matches the day before. From there, the search results would have to be reviewed by a human, in order to spot any situations where one credit card number was exposed at one URL, and a slight variation on the same URL (such as varying an order ID number) would expose other credit card numbers as well, which was the case with several of the hits that I found.

Simple, but time-consuming with so many different 8-digit prefixes — but every minute of effort expended on tracking down and canceling leaked credit card numbers, would save time and grief later by preventing the numbers from being used by criminals. If it would save them time in the long run and help prevent fraud, then why don’t they do this?

But rather than reducing fraud in total, identity fraudsters have simply shifted their activity to areas that Chip and PIN does not protect.

The first signs came in the cheque fraud figures which showed a rise of 50% in the first six months of 2004, compared with the same period in the previous year. But the cost of cheque fraud is dwarfed by continuing card fraud. “It would be nice if they could pack up their bags and go home, but they are unlikely to and, unfortunately, they will go to another area that is vulnerable,” said Sandra Quinn, an Apacs spokesman. She correctly forecast that card fraud would reach £500m in 2004 (actual figure £504.8M). “We are hoping for containment,” said Ms Quinn. And in 2005, overall card fraud fell back to just under £440M, an early success for the Chip and PIN rollout.

Source: The Retail Bulletin – The complete retail news resource

Barclays customers are set to go green with the launch of the UK’s first carbon neutral debit card. This new card, which is entirely blue including the edge, is being rolled out to the bank’s 11 million debit card users as their current ones expire.

Barclays has worked closely with Axalto, its card manufacturer on this innovative card. Axalto, advised by The Carbon Neutral Company, has undertaken to finance projects that work to reduce carbon emissions in the developing world, effectively balancing out the harmful emissions of the card’s manufacturing process by preventing the release of the same amount of greenhouse gases somewhere else.

Source: Barclays launches ‘carbon netural’ card – AllPayNews: Payment and fraud news, blog, jobs and discussions

Last week, Visa reported that its volume on purchases less than $25 in small ticket segments totaled $27.3 billion in the first six months of the year, an increase of 17 percent over the same period in 2005. Those transactions were performed almost entirely using traditional magnetic stripe cards, not contactless cards.

Source: Aneace’s Blog: Visa’s No Signature Required program is working … how will contactless compete?

This service is apparently particularly relevant for 18- 25 year olds, or GenY (not sure where Gen P as noted comes from)

Visa’s survey results also revealed that Generation “P” or Plastic, referring to consumers ages 18-25, is leading the trend of increased use of payment cards for everyday purchases. Sixty percent of Generation “P” prefers payment cards for purchases less than $25, particularly in new and emerging segments such as digital content, vending machines, public transportation, parking and newspapers.

As Banks move to chip, adding on contactless makes more sense in that its faster than chip, and easier for the consumer.  However in the US where there is no chip strategy, the relevance of contactless is certainly lessened considering the costs involved.

tags: chip+cards+contactless, visa+no+signature, MasterCard+qps

“So if the bank sends me a simple USB smart card reader so that I can log on with my chip and PIN card, that’s convenient.

But the bank could then store either more key pairs, or more certificates, on the smart card and charge other organisation’s (e.g., the government, retailers) for using them. This makes solving the phishing and fraud problem a line of business rather than a cost and, surely, that’s a way to get something done.   

…  the bank might be able to sell several certificates to the same person and it might also be able to sell chip and PIN cards to people for them to use purely for log on and not for payment at all.

Now that’s what I call a disruptive technology!”

Source: “Digital Identity: That whole trust thing – Mozilla Firefox (Build 2006072814)”

The challenge would be in the software management, which isn’t Bank’s core competence.  If that aspect could be outsourced, there might just be a model here.

tags: chip+cards, business+models

Aneace’s Blog: Cool payment technology that makes contactless much more attractive for merchants

I have no idea why a merchant would want to accept basic, “old way to pay” contactless cards that are not of much benefit, unless someone pays him to upgrade his POS terminals (which is what has been happening for the most part) and if interchange fees are dramatically cut. Giving merchants a simple way to target their existing promotions using behaviour data stored in the chip suddenly changes the game.

Merchants immediately get much more value out of payment cards, with no additional investment or effort. The contactless value proposition for merchants suddenly becomes real, and no longer has to rely essentially on free terminal upgrades and slashed interchange fees.

However the problem lies in bank reality.  I wish “old way to pay contactless” was the problem.  The hard reality is that many banks are implementing old style dip chips, and those will be quickly obsolete.

Technorati Tags: chip+card

Aneace’s Blog: The pains of travelling and paying in a world moving to EMV

The explosion in ATM/debit card fraud shows how fraud can move to the US from other parts of the world, like the UK, where card issuers are adopting the more secure EMV chip card standard. Some US banks have responded by putting a temporary hold on all ATM transactions in the UK, leaving some customers stranded. Cardholders are advised to alert their bank when they plan to travel, and to carry multiple cards for multiple accounts and extra travellers’ cheques, just in case. Wow. Blast to the past. Back to the good old days of travellers’ cheques and envelopes filled with cash.

Already we are seeing consumer trends such as:

• carry four separate cards with $5K limit, versus 1 card of $20K
• keep one card with less than 1K limit for internet purchases
• request bank maintain cards separately from other accounts
• hold credit card with another bank, that keeps the card separate from main accounts

Future trends:

• chip card with no mag stripe
• maintain low limit mag stripe card for travel, or non home bank, domestic use

Relevance to Bankwatch:
Card use is not simple nor are behaviours understood.  Chip will reduce some fraud generally, but introduce a high level of complexity in consumers minds that drives aberrant card behaviour.

Relevance to Bankwatch

1. How are payments evolving, and what is the risk to banks competitive position ?
2. What is social computing impact on Banks ?
3. How will online banking look in 2020 ?
4. How will the branch look in 2020 ?
5. Is chip and PIN viable security ?

More to come on the sub-questions behind these, later.Tags:

1. Payments
2. Social computing
3. Online Banking
4. Branch
5. Chip card

Technorati Tags: social+computing, payments, online+banking, chip+card, branch

Update:   Dave Birch provided an update in the comment, that I support, regarding online authentication:

"This is incorrect. If you use even an SDA card for online authentication (eg, using token authentication) then the authenticating host will spot the clone. "
Bank chiefs defend Chip and Pin security | 24dash.com – Bill Payments

The experts, who spoke to the Daily Mail newspaper, claimed the problem could have been avoided if banks had opted for the more expensive Dynamic Data Authentication (DDA) system in cards, which is used abroad, rather than the cheaper Static Data Authentication (SDA) which is widely used in the UK.A card terminal can tell if a cloned DDA card is being used even if it is offline, but it can only tell if an SDA one is being used if it is online.

But payment body Apacs, which represents the banking industry, said that while it was true that most banks used SDA technology, they were not reliant on the technology in the chip to spot a fraudulent card.

Apacs spokeswoman Jemma Jones said: "The system is set up to spot cloned cards.

"80% of transactions in this country are online, so there is a high chance it would get caught out."

She said that even if someone had managed to clone a chip and pin card, they would still need to have the cardholder's pin to use it.

Technorati Tags: chip+card, chip+pin

Finextra: Intel teams with Microsoft, BitWallet to promote FeliCa contactless technology

Intel is teaming with both Microsoft and Bitwallet – which provides the EDY contactless payment system – to triple the number of personal computers equipped with FeliCa-reading functions and double the number of Internet services compatible with the technology.

This will put not just a card reader on your home PC, but a contactless one. This truly makes ecommerce and online banking more secure and remain convenient. It bypasses the old style chip cards too.

Technorati Tags: felica, chip+cards, sony

CHIP-AND-PIN systems introduced to foil credit and debit-card fraudsters are making it easier to commit certain types of financial crime, a reformed con man warned last week.

And the evidence is mounting to support his contention.

Chip and pin ‘makes fraud even easier’ – Money – Times Online

He does not believe that chip-and-pin technology, which requires transactions to be verified with a four-digit number rather than a signature, will prove much of a challenge for professional fraudsters.

The information sent out by the hand-held card reading devices used in restaurants is not encrypted, for example. Any criminals nearby with an information receiver can therefore capture the data, including the pin entered — actually making it easier for them to commit certain types of fraud.

The details on the earlier Shell fraud is outlined here.  This fraud resulted in cloning of the card data into mag strip cards.

His concerns about the vulnerability of chip-and-pin were reinforced last week by news that 600 Shell petrol stations have suspended use of chip-and-pin terminals after more than £1m was stolen from customers’ accounts. Fraudsters masquerading as engineers sent to test the equipment instead fitted the keypads with memory chips that logged customers’ card numbers and pin codes.

They then used the information to plunder accounts by making counterfeit cards and using them to withdraw cash from cash machines. Fraudsters were only able to clone the cards’ magnetic strips, rather than the chips, but many ATMs are not yet fitted with chip readers and therefore still use the strips.

The predominant method used by the criminals remains card not present fraud.

Another unfortunate side effect of chip and pin has been to boost internet and telephone credit-card fraud, known as “card-not-present”, for which criminals do not need to know your pin. The cost of this kind of card crime leapt from £151m in 2004 to £183m last year.

It is still being predicted that chip cards can be copied, but this isn’t proven yet.  However it may be possible to circumvent the card security in other ways.

Fears are growing, though, that identity cards will simply make life even easier for fraudsters. Abagnale said: “Within six months the new identity card will have been replicated perfectly. And because it condenses all the information on an individual in one place, the fraudster won’t have to find it.”

Relevance to Bankwatch:

The underlying question remains.  Can the criminals gather chip card information, and close the chip cards.  More research to come, including the relevance of card security schemes (DDA/ SDA).

Technorati Tags: chip+cards, security

Millions at risk from chip and Pin | This is Money

Security experts say there is a one in five chance that a terminal in a shop or garage will not spot a ‘cloned’ card. It means criminals who copy people’s cards can go on shopping sprees and spend thousands of pounds. The alarming gap in security is being blamed on the issuing banks, for choosing the cheapest version of the new cards. Banks in France and some other countries are already using a more secure system.

The cloning seems ridiculously easy.

Some experts warned soon after the launch of the system in February that criminals could clone the new cards using equipment readily available over the Internet and costing only some £300 or £400.

And the results are horrendous!

Last month the Daily Mail revealed that criminals had stolen more than £1m after using copied cards to withdraw money from cash machines abroad.

This is because repeated transactions at these terminals no longer register with banks’ head offices as a suspicious pattern of withdrawals.

The root cause appears to lie in the choice of technology by certain banks.

Now it emerges that there may be a similar absence of protection on transactions in this country. The reason is that more than 140m credit, debit and charge cards issued in the UK over the last few years use a technology known as SDA, which stands for ‘static data authentication’.

This is the cheapest option that could have been chosen by the big five banks, which made profits of £33bn last year, and other card issuers. Banks abroad, however, prefer the safer option of the DDA system, which stands for ‘dynamic data authentication’.

Relevance to Bankwatch:
Nothing is simple.  The criminals are very capable, and shortcuts in this space will be devastating.

Technorati Tags: chip+card, fraud, DDA, SDA

We have to understand this dynamic, and both individual banks, and industry groups need to get on top of it.

MoneyExpert.com – Financial news article

“Chip and pin security is fallible,” a spokesman for credit payments association Apacs, which conducted the survey, told the Times. Recent research has suggested that cash machines are not always able to discern the difference between genuine cards and cards that have been cloned.

Relevance to Bankwatch:
Its been assumed as part of the business case for chip that fraud could be successfully managed down.  So while enormous cost has gone into the introduction of chip, yet consumers remain sceptical.

Card Technology, The Smart Card News Source

Three of Japan’s largest convenience store chains are reportedly in talks to accept multiple brands of contactless credit and electronic purses on the same card readers. Without interoperable readers, consumers would be confused about where they could use a particular brand of contactless payment and merchants would have to install multiple readers.

Japan, South Korea lead world in contactless payments : Contactless News

In Japan, FeliCa has created innovative businesses such as Suica (East Japan Railways’ transit card) and Edy (BitWallet’s e-money service), through which credit card and financial services, transportation and mobile service companies have aggressively adopted FeliCa-based smartcard payment solutions.

Furthermore, FeliCa has been installed in mobile handsets, so called ‘Osaifu-Keitai’ and ‘Mobile FeliCa’, allowing them to be used in a wide variety of contexts: as credit card, pre-paid e-money, transit card, and as identification for entrance management.

Japan, South Korea lead world in contactless payments
Thursday, May 25 2006

Due to nationwide implementation programs, Japan and South Korea are leading the word in contactless payment adoption, according to a recent ABI Research report. Innovative programs from FeliCa in Japan and SK Telecom, Visa and MasterCard in South Korea are the reasons why.

Oyster Bay, NY–Japan and South Korea lead the world in adopting contactless payment solutions. Both countries have implemented nationwide services on a commercial scale.

Mobile operators and issuers address a varied range of market opportunities in the region. According to Senior ABI Research analyst Andy Bae, “Small payment transactions are a major goal for Japanese and South Korean credit card companies. To spot new opportunities and increase revenue, mobile operators and card issuers must continually assess their positions in the value chain.”

In Japan, FeliCa has created innovative businesses such as Suica (East Japan Railways’ transit card) and Edy (BitWallet’s e-money service), through which credit card and financial services, transportation and mobile service companies have aggressively adopted FeliCa-based smartcard payment solutions.

Furthermore, FeliCa has been installed in mobile handsets, so called ‘Osaifu-Keitai’ and ‘Mobile FeliCa’, allowing them to be used in a wide variety of contexts: as credit card, pre-paid e-money, transit card, and as identification for entrance management.

For users, the major incentive to adopt a contactless payment service is easy, convenient transactions. Merchants can expect to enhance the customer relationship by offering “point” and “coupon” benefits, and by delivering product item information over the air.

The maturity of contactless payment solutions in Japan is closely related to the activities of East Japan Railways. The company has a nationwide infrastructure, and there are stations within which users can access entire facilities simply by waving the card. Using East Japan Railways’ resources, Suica has enlarged the range of services beyond simple transit, to involve the merchant communities in the station and its vicinity.

In South Korea, mobile operators SK Telecom and KTF will introduce USIM (Universal Subscriber Identification Module) to offer an integrated mobile card solution that includes banking, transit, stock transaction, and contactless payment via 13.56 MHz. Andy Bae notes, “With a high adoption rate in the mobile handset, South Korean users will have an integrated smartcard solution in their mobile devices.”

In addition, contactless payment solutions from Visa Wave and MasterCard PayPass have operated successfully in South Korean retail environments since 1Q 2006.

Contactless Payment Markets in Japan and South Korea examines business models, tracks merchant uptakes, and gauges card issuers’ and consumers’ expectations in both markets. The report includes forecasts of shipments and revenues for chip, reader, and contactless payment solution-enabled devices to 2012. It forms part of ABI Research’s subscription Contactless Commerce Research Service, which includes research reports, regular market updates, forecast and industry databases, ABI Insights, and analyst inquiry time.

Founded in 1990 and headquartered in New York, ABI Research maintains global operations that support annual research programs, intelligence services and market reports in wireless, automotive, semiconductors, broadband, and energy. For more information please visit www.abiresearch.com, or call +1.516.624.2500.

Technorati Tags: chip+card, smart+card, wireless,

Contactless Payment To Shift from Cards to Cell Phones, Says ABI Research | Tekrati Research News

“Contactless commerce is on a steep growth curve, but cards are only an intermediate step,” says Erik Michielsen, director of ABI Research’s RFID and M2M practice. “By 2010, more than 50% of cellular handsets–some 500 million units–will incorporate NFC capabilities that will be used not only for payments at points of sale and remotely, but also to access information from ‘smart objects.’

Imagine, for example, seeing a poster advertising a concert you want to attend. Hold your phone near the poster, and it connects you to a website where you buy your tickets, download them to the phone, and tap the phone at the turnstile to enter the show.”

Relevance to Bankwatch:
Its probably true that most banks have the chip card strategy in the ATM group, but it would be a mistake to exclude your technology strategists, and online banking people who probably see more of where this is really going.  Most are basing their chip strategy on fraud reduction.  The real meat, and consumer expectation will be more of a mobile / wireless / ecommerce play.

Technorati Tags: smart+cards, chip+cards, ecommerce

Why chip & Pin won't stop fraud | This is Money

The fastest growing area is 'cardholder not present' fraud. According to the  clearing banks' association Apacs, it shot up 29pc to £90m in the first six  months of 2005 and accounted for more than 40% of total card fraud losses.

Its worth noting the fraud escalation is not an intrinsic weakness in chip and pin. In fact we are not intruducing chip and pin, and will not be until circa 2015 at the earliest. Only then will the entire world be on chip and pin, and then we will see the strength of the technology.

Far from it. KPMG's latest Fraud Barometer found that it had rocketed to  nearly £1bn in 2005 – the highest level for a decade. The battle is far from  over and none of us can afford to relax.

The truth is that as antifraud measures evolve, so do the scams. Fraudsters  have moved on from stealing or skimming cards. Now their emphasis is on  identity fraud – obtaining your personal details and making remote purchases  over the internet or by phone.

Technorati Tags: chip_cards, fraud, identity_theft

Bank says overseas card fraud on the rise – Money – Times Online

Lloyds TSB has reported a leap in the number of fraudulent withdrawals from overseas ATMs. The bank says criminals are increasingly using cloned debit or credit cards in countries where chip and pin technology has not yet been introduced.

The weakest link theory applies here.  Those countries that lag moving to chip and pin, will suffer increased fraud.

Lloyds TSB has reported a leap in the number of fraudulent withdrawals from overseas ATMs. The bank says criminals are increasingly using cloned debit or credit cards in countries where chip and pin technology has not yet been introduced.

Nearly all UK ATMs have chip and pin technology which would leave fraudsters empty-handed if they tried to make a withdrawal with a fake card.

Technorati Tags: chip_cards, smart_cards

WSJ.com – The Envelope-Free ATM

In Russia, a consumer can put rubles into an automated-teller machine and get U.S. dollars in return. In Brazil and Venezuela, the machines print checks. And banking customers in Indonesia can use an ATM to schedule and pay for the ritual sacrifice of a goat.

However something as simple as envelopeless cheque depositing which sounds cool, is not necessarily a good use of investment.

Unlike traditional machines that swallow an envelope and require the customer to key in the deposited amount, the new versions read checks and count cash themselves. They can display an image of the check on the screen, and also print an image of the deposited check on a customer’s receipt. Bank executives literally “oohed” and “aahed” when a representative of ATM maker NCR Corp. demonstrated the technology at an industry conference last fall.

The costs of the cameras and cheque handing, to achieve this are significant, and given cheques are going away, does this make sense?  Perhaps the North Americans have this part right.

Relevance to Bankwatch:
The ATM manufacturers find it easy to wow Bank Executives in the ATM space because those folks generally haven’t been engaged in the online banking space.  The online bankers know innovation, and understand the importance (now, post dot com crash) of not getting caught up in the technology, and remaining focussed on the customers needs.

Banks Are Testing Versions
To Read Checks, Count Cash;
Twizzlers Wrapper Is Rejected
By ROBIN SIDEL and IAN MCDONALD
May 6, 2006

In Russia, a consumer can put rubles into an automated-teller machine and get U.S. dollars in return. In Brazil and Venezuela, the machines print checks. And banking customers in Indonesia can use an ATM to schedule and pay for the ritual sacrifice of a goat.

In the U.S., ATMs don’t do any of those things. Despite a slew of predictions a few years ago that U.S. consumers would use ATMs to apply for loans, buy ski-lift tickets and receive coupons for soft drinks, today’s bank machines pretty much just spit out greenbacks because that’s the service U.S. bank customers typically want.

Now, the biggest makers of ATMs are trying to sell a new generation of machines. Instead of razzle-dazzle features that turn the machines into mini-media centers, however, they allow customers to do something far less glamorous: deposit cash or checks without an envelope.

Unlike traditional machines that swallow an envelope and require the customer to key in the deposited amount, the new versions read checks and count cash themselves. They can display an image of the check on the screen, and also print an image of the deposited check on a customer’s receipt. Bank executives literally “oohed” and “aahed” when a representative of ATM maker NCR Corp. demonstrated the technology at an industry conference last fall.

In addition to looking slick, the new machines could ultimately save banks millions of dollars by scanning images of the checks and eliminating the need to haul physical pieces of paper around the country for processing. Consulting firm TowerGroup, a unit of MasterCard International Inc., last year estimated that envelope deposits made at ATMs and by tellers cost about $1.70 each to process, while electronically scanned versions cost 40 cents. The checks also clear faster for customers.

Eliminating the envelope also is expected to reduce the number of fraudulent transactions that occur when swindlers claim to have deposited money, but merely feed an empty envelope into the machine.

“Deposit automation will have huge and positive ramifications for banks and their customers,” says Tom Swidarski, chief executive of Diebold Inc., another big maker of ATMs.

It’s been 30 years since ATMs became ubiquitous in American life. The first ATM in the world was installed at a Chemical Bank branch in Long Island, N.Y., in 1969.

Of the 10.5 billion ATM transactions last year in the U.S., about 80% involved cash withdrawals, according to industry data. Deposits accounted for less than 10% of the activity — an amount that has remained fairly constant over the past decade even as check usage is declining due to the popularity of direct-deposit and online bill payment. The rest covers such things as balance inquiries and account transfers.

While new to most consumers, ATM-makers and banks have been experimenting with envelope-free check deposits for more than a decade. The technology recently received a boost from a new federal law, known as “Check 21,” which permits banks to process checks by exchanging digital images. Of the more than 400,000 ATMs in use in the U.S., only a little more than 1% accept “no-envelope” check deposits, according to Diebold and NCR.

So far, most big banks are still experimenting with the technology in small pilot tests, but the new machines are expected to start showing up more frequently later this year as banks upgrade their “back-office” operations to accommodate the new electronic images.

The slow rate of adoption is partly due to the cost: check-scanning versions can add 30% or more to the price of a traditional ATM, which typically run about $25,000. As it is, banks are already expected to spend more than $340 million on basic ATM hardware in 2007, up 20% from this year, according to TowerGroup.

Bank of America Corp., which has nearly 17,000 ATMs around the country, promotes the technology in television commercials and plans to introduce some 1,500 of the machines nationwide by the end of the year. The big bank operates 50 of the machines in North and South Carolina and plans to soon expand the test in other markets nationwide.

Wells Fargo & Co. has been experimenting with the envelope-free ATMs since 2002 and has 61 of them in northern California. “We are definitely going to be putting more in the market this year,” says Jonathan Velline, senior vice president of ATM banking at Wells Fargo. Deposits represent 20% of Wells Fargo’s ATM transactions; some 20% of the deposits are in cash.

In Jersey City, N.J., customers who deposit a check in the ATM at a local branch of PNC Financial Services Corp. can choose between an envelope or envelope-free transaction. Checks without envelopes are inserted face-up into a slot in the machine. An image of the check quickly pops up on the screen, and the customer then selects the account in which the funds are to be deposited. The image isn’t printed on the receipt. Of the 197 deposits made at the ATM on Feb. 24, 56 didn’t include an envelope.

PNC, a regional bank based in Pittsburgh, first introduced the envelope-free machine in 1992. Of the bank’s 1,000 ATMs that accept deposits, 400 of them accept checks without an envelope today.

“We started to do this because it is a lot easier to deal with the deposit,” says James Walker, a PNC senior vice president who is responsible for the bank’s network of 3,600 ATMs. He says the digital method takes about 10 seconds to process versus a minute for the manual method, which requires bank employees to open the envelope, separate the check and verify that it matches the amount keyed into the machine by the customer.

But not all banks are embracing the technology. They gripe that multiple versions of the machines can confuse customers, delay transactions and don’t justify the expense of the new machines. Indeed, some of the ATMs accept multiple checks at a time and others require checks to be fed individually. PNC’s machines, for instance, don’t accept cash deposits without an envelope.

“There is an inconsistency perspective that we have concerns about. One ATM works one way and another works another way,” says Dominic Venturo, senior vice president for products and marketing at U.S. Bancorp. The Minneapolis-based bank has about 5,000 ATMs.

When J.P. Morgan Chase & Co. ordered 1,300 new ATMs from Diebold earlier this year, it didn’t buy the new models. The big bank, which has about 7,300 ATMs, has been testing about 20 of the envelope-free type in Ohio, Indiana and Kentucky for about two years. “We have stuck with the meat-and-potato variety because everything else slows people down,” says Thomas Kelly, a spokesman for the bank.

At Diebold’s headquarters in North Canton, Ohio, a team of engineers is working to ensure that the new ATMs work. Last month, senior engineer Dean Abraham repeatedly folded and crumpled a check for $101.30 before feeding it into a machine. The ATM accepted the crinkled paper, scanned it and read the amount correctly. Then he pushed a stack of more than three dozen bills — a mix of ones, fives, 10s, and 20s facing in different directions — into the machine, which accurately sorted and counted the money. In another recent test, Diebold engineers fed a Twizzlers candy wrapper into the ATM, which recognized that it wasn’t a check and spit it out without a jam.

Despite the hesitancy, most bank executives acknowledge that the new machines will ultimately become standard for the industry. Says Bob Tramontano, head of global marketing and engineering for NCR’s financial solutions division: “When no one has it, no one needs it, but that’s changing because consumers like it.”

Technorati Tags: ATM

Guardian Unlimited | UK Latest | Eight held over chip and pin fraud

The scam works by criminals implanting devices into chip and pin machines which can copy a bank card's magnetic strip and record a person's pin number.The device cannot copy the chip, which means any fake card can only be used in machines where chip and pin is not implemented – often abroad.

Relevance to Bankwatch:
As predicted in an earlier 'relevance' I remain convinced that combo cards could be the death of chip, and the better approach would be to issue chip cards only with no mag stripe. If customers need a mag stripe for travel or other purposes, then they can get those. The problem is the transition of merchants to chip, so customers desire to have chip only cards is the best impetus for them.

Technorati Tags: chip_cards, debit_cards, credit_cards

[May 06, 2006] Hundreds of drivers caught out by GBP1m chip-and-PIN sting (Daily Mail Via Thomson Dialog NewsEdge)CRIMINALS have stolen more than GBP1million after copying the credit and debit card details of hundreds of petrol station customers. The fraud, which affects outlets across the country, highlights serious flaws in the chip-and-PIN payment system which is meant to offer more protection against crime and theft. Gangs are understood to have targeted petrol stations operated by Shell, BP and other well-known chains to steal card details. Last night, Shell suspended the chip-and-PIN system in all 600 of its company- owned petrol stations. The company said drastic action was necessary to protect customers from the possibility of fraud. Conservative estimates suggest the criminals have cloned more than 1,000 debit and credit cards, stealing more than GBP1million. A Shell spokesman said: 'In the interests of our customers, we have temporarily suspended chip-and-PIN availability in our UK companyowned service stations. 'This is a precautionary measure to protect the security of our customers' transactions.' The company said customers would be able to pay for fuel, goods and services using their signatures as proof of identity. 'We will reintroduce chip and PIN as soon as it is possible, following consultation with the terminal manufacturer, card companies and the relevant authorities, to ensure that customers can be confident that their transactions are fully secure.' Four hundred Shell petrol stations which are run by outside franchises will continue to operate chip and PIN. There is evidence that criminals have posed as technicians to implant devices into till terminals at the petrol stations. These devices captured both the card details on the magnetic strip and the four digit PINs – personal identification numbers – used by customers to authorise purchases. The information was then used to create cloned cards, which were used to withdraw huge sums of money from cash machines in Britain and abroad. Shell stressed that all its till terminals had been approved by the banking industry before the chip and PIN regime became compulsory in February. However, it is apparent that bank industry standards are not sufficiently stringent to ensure that the terminals cannot be tampered with. Consequently, the problems experienced by Shell could equally apply to thousands of new terminals installed in stores, restaurants and other outlets. The till terminals at the centre of the Shell fraud investigation were made by a company called Trintech, which supplies many businesses across Britain and the world. Shell said it was aware of cases of fraud at fewer than ten of its petrol stations. BP has also admitted a problem with customer card details being stolen from at least one of its stations. This did not involve a chip-and-PIN terminal. Criminals have attempted to tamper with till pads at petrol stations operated by at least one other major chain. These cases are unlikely to reflect the full scale of the problem as sophisticated gangs find ways to outsmart the new security regime. The developments are a huge embarrassment for the banks who assured the nation the chip-and-PIN system would kill card crime. The finance industry and retailers have spent GBP1billion issuing 141 million new 'secure' cards and installing new terminalsat which they can be used. The Association of Payment Clearing Services, which speaks for the banks on plastic card issues, claimed the chipand-PIN system was reducing fraud. Spokesman Sandra Quinn confirmed the problems at Shell. She said there criminals had also attempted to tamper with till terminals at one other petrol company at least. However, she tried to play down the significance of the problem. While she was unable to say how many card details had been stolen, she insisted only a small number of petrol stations were implicated. 'We are confident this is not a systemic issue. This is about a specific till pad and the way it is configured in Shell petrol stations,' she said. THE CLONING CHEATS COST US GBP1,300 MARY Adkins lost GBP1,300 from her account when her debit card was cloned after a visit to a Shell petrol station. The theft became apparent in early April when the card was rejected at a store and she and her husband James were told to contact their bank. 'The bank's fraud department told us there had been cash withdrawals in Paris,' said Mrs Adkins from the couple's home near Guildford, Surrey. 'I subsequently found out that more than GBP1,300 had been taken out in a series of withdrawals. 'My confidence in the chip-and- PIN regime has been severely shaken. This technology ought to be secure. 'Now, more than a month later, we are still waiting to get our money back.' Chris Monk, 53, an electronics engineer from Surrey, believes his card was cloned at a Shell garage in March. He lost GBP600 in what he described as 'mugging by stealth'. Mr Monk said he always suspected that chip and PIN was not a failsafe system. 'Once digital information has been captured on a device there is scope to copy it,' he said. 'I now face a question over who I can trust when making a purchase. 'In fact I have been using cash over the last two weeks.'

Banking Briefs – Business news

Bulbank said on April 6 it successfully ended the needed certification and can now process chip cards in the country’s network of ATMs. As of now, more than half of the total ATM network has been upgraded, mainly in the bigger cities and seaside resorts.

Daily, more than 100 chip card transactions are processed, and the number is expected to increase with the summer season, the bank said in a statement. Bulbank is one of the first European banks migrating successfully to the new messaging standard that MasterCard implemented last year – IPM (integrated product messages).

The standard was adopted after a decision of MasterCard to unify its operations in Europe and North America. The IPM standard is now a mandatory for bank as prerequisite to upgrade to chip-based cards.

Banks aiming to alleviate online banking fears – Financial Services – Breaking Business and Technology News at silicon.com

Barclays recently announced it is stepping up its fight against fraudsters by using technology to check that each customer's spending behaviour matches his or her profile.

First, lets look at what Banks' are using:

Two factor software, that will, to differing degrees, analyse aspects of the customers "state", their PC, their connection, their usage patterns, etc, such that they can determine if that is in fact the right user, for that banking relationship.

• Cyota (Barclays announced use of them)
• Passmark
• Digital Resolve

Physical hardware, to authenticate online banking customers with "something they have"

• RSA tokens
• Vasko tokens

ATM security, to protect against PIN and card data theft

• ATM anti skimming devices being added to ATM's.

The silicon.com article goes on …

But will two-factor be a success? The technology has its strengths and
weaknesses but as it has not yet been tested on a wide scale, it's too
soon to tell.

This is the right question, because the criminals will be moving ahead, and some examples exist, and its unclear how the current suite of two-factor systems will address these evolving methods.

A leading security expert in the US has criticised the use of
two-factor authentication. Last year Bruce Schneier, CTO of
Counterpane, said it fails to address today's problems today.

Fraudsters,
he explained, will still be able to use the 'man in the middle attack',
where phishers set up dummy websites to intercept single-use passcodes,
or use malware
to piggyback on a session once a user logs into their account. More
than a year ago, security company MessageLabs encountered a piece of
malware that did this.

So, we have some way to go on this journey. Unfortunately the legislative approach adopted in the US, whereby Banks are required to adopt two-factor authentication, makes the situation worse by suggesting the government have the answer, whereas, clearly no-one does. We need grater effort to get ahead of the criminals, and thats where the government and business need to focus their efforts.

Relevance to Bankwatch:

Customer confidence, and reputational risk are at stake and a portfolio mix of efforts, including educational, and software are required to ensure safety of banks and customers information. Chip will help, but should not be held out as the complete answer, because criminals will be working on creative workarounds.

• Worldwide acceptance of Visa while accessing your own savings. You can make purchases online, over the phone and at more than 24 million outlets around the world.
• No credit application necessary.
• Your choice of card design. Your ANZ Everyday Visa Debit comes in three unique designs you can choose from. Unlimited ANZ transactions for $6 a month.
• This includes ANZ ATMs, EFTPOS, ANZ Phone and Internet Banking and ANZ branches.
• ANZ's Online Guarantee for greater protection on Internet purchases plus ANZ Falcon™ monitoring for suspicious transactions.

However, generally, this is one of the next payment frontiers, and it has banks confused. Visa debit. Its expected that Visa will offer this in North America shortly, and that will be in competition with Bank's own debit offer, unlike the Australian situation above.

Expect to see some Banks offer Visa/ Credit/ debit all on one card, specifically on a chip carrd. Now that really is an interesting offer, and although it might be confusing for customers, some will appreciate the convenience of one card for all. Its also confusing for banks, because the marketing of credit is traditionally separate from banking, and thats a distinction that needs to be blurred.
Relevance to Bankwatch:

Banks have to figure out the value of the customer offer with Visa debit, how they manage that offer alongside credit card offerings, and in conjunction with chip.

Payments News: More About NACHA's "Credit Push" Initiative – March 24, 2006

if the pilot can prove the service to be an net enabler of additional eCommerce growth. …."The real key", according to Samantha, "is what impact credit push will have on the payments mix"."

There are several things going on at the same time here:

1. introduction of "debit" activity to the ecommerce space
2. introduction of chip cards (debit and credit)
3. introduction of PIN verification for credit cards

1. Introduction of "debit" activity to the ecommerce space

For a variety of reasons, credit cards owned the ecommerce space until now. A key contributing factor was the easy sell, that you can call your credit card company and claim the purchase was not yours, and generally, you will be refunded. This fit well with the doubts and misconceptions about the early days of internet.

Since that time, ecommerce has come a long way, and despite consumers concerns about privacy and security, its well embedded in todays world. So its timely for Banks to offer consumers a choice relative to their purchases, exactly as occurs in bricks and mortar stores.

From other channel experience, we know that channel use profilerates as channels are added. Consumers tend to migrate less than use everything available based on their needs.

2. introduction of chip cards

Chip cards are the proverbial "spanner in the works". This will be disruptive technology, and of that there is little doubt. Banks are deploying chip to counter fraud, primarily at the ATM, but that is just the beginning.

The first obvious disruption will be micropayments and stored value. Smart Banks will soon offer ability to make small payments, say up to $25/50 and this will promote cash displacement. Handy for consumers, and cost reduction for Banks.

But chip also provides security, and as PC's gain chip readers, and they become as pervasive as floppy disk drives used to be, then there is no reason chip cards cannot authorise payment activity online.

3. introduction of PIN verification for credit cards

Back to 1. above, one of the early reasons for credit card adoption for online purchases was the $50 limit on liability for purchases. This provided consumers with the confidence that if the merchant did not come through with the purchase, they had an out. Consumers don't worry about the likes of Amazon delivering any more.
But the introdcution of PIN verification is accompanied with shift of liability to the consumer. This will mean that once the PIN is entered, the consumer is liable for the transaction, because no-one else could have performed the transaction if the PIN has been kept securely. We don't necessarily know how this will play out, because that liability shift was developed before phishing was prevalent. I know the answer will be that chip cards cannot be replicated, but it all gets confused in the consumers mind, and there may be marketing opportunites to manage that liability shift differently.

In any event, the sum of all of the above, brings us to the point that there is little difference between the channels (store and online) and little difference between the cards (credit and debit). Consumers will determine how they spend based on their preceptions of risk, and their financial standing.

The Canadian experience with Interac Online Debit suggests the answer is twofold:

1. customers will use this new function for smaller amounts and continue to use credit cards for larger purchases.
2. a new e-commerce market opportunity is presented for those without credit cards

So the first results in canabilisation of credit card transactions, while the second is a new market. In time this mix may shift once we feel the impact of credit card PIN verification. We don't really know how consumers will react to that, coupled with the liability shift to the consumer which accompanies PIN.

Relevance to Bankwatch:

Banks can never go wrong by offering consumers a choice. But consumers will use everything, so pricing is key.

An insider’s look … from Palm Desert, Calif. | ATM Marketplace News

One program to which PDNB pays special attention is debit. Often a behind-the-scenes player, PDNB is taking a lead role in spear-heading the prepaid debit-card effort.

One alternative noted here at Palm Desert National Bank’s annual partner conference is prepaid debit.

Similar to efforts launched with Portland, Ore.-based financial solutions provider Vero Inc., the outside-the-box financial institution is working to identify and capture a market stronghold in diversified products that cater not only to underbanked segments but fill a void in the financial services space.

In fact, Tingey expects the overall debit and prepaid market to grow between 100 percent and 150 percent over the next 12 to18 months.

“I think the industry as a whole is just scratching the surface with prepaid products,” Nutting said, in between bites at the corner cafe. “By focusing only on the underbanked, you miss a lot of opportunity for some prepaid products that cater to the already banked. The banks are the ones that already understand these cards and how to use them, and to ignore them is one-sighted.”

So what is the potential for prepaid debit?

Wachovia have a commercial product, sold to facilitate relocation expenses, or petty cash disbursements. PrepaidDebitCardBrochure.pdf

Prepaid MasterCard, such as Western Union.

Starbucks prepaid cards, now with loyalty points. While Banks traditionally resist small transactions, and they and traditional merchants charge extra (refer note below), Starbucks recognise the reality of cheap networking and are encouraging small transactions. So why do Starbucks see an advantage for small payments, and yet Banks do not? Someone must have it right.

Vendors:

• Metavante
• Cardis
• Netspend

Note re small transactions from Forbes.

It wasn’t that long ago that small-ticket retailers–such as convenience stores, delis and local restaurants–had a minimum charge for credit cards to cover the costs associated with running the transaction. The credit card associations, like MasterCard or Visa, or cards like Morgan Stanley‘s (nyse: MWD – news – people ) Discover or the American Express (nyse: AXP – news – people ) card, often charge a base rate per transaction plus a percent of the total each time a card is swiped.

Early conclusions:

1. Credit cards are winning this battle hands down and banks are allowing them. I judge this by a simple Google search for prepaid debit, and all that shows up are credit cards.
2. Prepaid have two primary benefits, a) card solutions for the unbanked, and b) cash replacement for small transactions (micropayments)
3. Starbucks and other merchants (Sears etc) have figured out the value of prepaid, but banks have not.

Relevance to Bankwatch:

A great opportunity exists for Banks to get into prepaid debit for the mass market. such cards can be toppped up at the ATM. This will produce revenue from card sales and transaction revenue. This eliminates cash handling costs, because there will be less cash in circulation.

The McKinsey Quarterly: How Europe’s banks should prepare for payments reform

1. Institutions in the United Kingdom and France are “balance earners.” UK banks earn revenue largely from the interest on credit card balances, while their French counterparts generate income from interest rate margins3 on current accounts.2. “fee-oriented” banks, including institutions in Italy, Poland, and Spain—charge their customers for everything from transactions to account maintenance. Such activities are largely profitable for institutions in Italy and Spain (2002 profits totaled €3.9 billion and €1.5 billion, respectively) but not for those in Poland. Indeed, the higher costs associated with handling cash (still a substantial part of Poland’s developing economy) contributed to a loss of €700 million on payments activities there.

3.Belgian, Dutch, German, and Swedish banks are “efficiency focused.” They charge lower fees and earn a lower income from account balances but also keep processing costs down—by automating credit transfers, for example.

Their context is the Single European Payments Area (SEPA). singleeuropaymentsarea200602en.pdf

“Within the SEPA, customers will be able to make payments throughout the whole euro area as efficiently and safely as in the national context today. If they so wish, they will be able to do so using a single payment account and a single payment card”

This seems to imply that all Banks will have to connect to a common network in order to participate as a Bank. The McKinsey article makes the point that understanding and controlling costs is critical to thrive in this new environment.

But to thrive in a single-payments area, European banks need to grasp the fundamental economics of their operations. By subsidizing loss-making activities (such as check processing) with profitable ones (such as merchant fees from credit card transactions), banks leave themselves vulnerable to new entrants.Attackers, including banks that operate solely over the telephone and the Internet, can process large volumes of payments electronically, without the burden of expensive branches. In advance of harmonization, such banks are beginning to offer high-yield savings accounts to attract customers.

Relevance to Bankwatch:
This is a new and important evolving space, that we will watch. New category for SEPA.
There are opportunities for new entrants, unburdened with old cost and branch structures to make inroads.

USATODAY.com – Security breaks could curtail debit card use

PIN-based debit card transactions have been seen as more secure than signature-based debit card purchases

The assumption has been that PIN will eliminate ‘card present’ fraud.  The combination of a chip card that can’t be replicated and a PIN is the panacea.  However the Citi ATM situation just validates what your internal security guys will always tell you.  The best you can do is manage fraud;  you cannot eliminate it because the bad guys are always one step ahead of you, and have already factored your new security into their plans.
Some things are clear, and this varies a little between Europe and North America, but not much:

Relevance to Bankwatch:

1. Simple introduction of PIN and shift of liability to the consumer could be an unmitigated disaster, without consumer support from the banks – consumers look to banks to provide security, not excuses
2. The management of concurrent mag stripe/ chip, and signature/ PIN could result in the worst of both worlds.  Increased operating costs, and increased fraud.
   

Security breaks could curtail debit card use

By Kathy Chu, USA TODAY

A recent spate of fraudulent bank card transactions is complicating a question that arises each time you reach the checkout register: debit or credit?

Citibank, Wells Fargo and Bank of America are among the banks that have reissued U.S. debit cards in recent months after a third-party security breach allowed fraudsters to obtain bank card information — including some customers’ personal identification numbers, or PINs.

The banks haven’t identified the source of the breach or how many cards have been reissued.

But as more people become aware of the incidents, “I think consumers will think twice before they enter a PIN anywhere,” says Avivah Litan, an analyst at Gartner.

Some consumers could decide it’s safer to sign for bank card purchases with a Visa or MasterCard logo, Litan says.

At the least, “People may be more leery about making sure that no one’s behind them when they type in their PIN numbers,” says Chris Allen of Dove Consulting, a research firm.

The security breach comes as consumers are increasingly using debit cards to pay at the cash register. Debit transactions are the fastest-growing form of electronic payments; they nearly doubled, to 15.6 billion transactions, in 2003 compared with 2000, according to the most recent Federal Reserve data.

Much of the growth of debit cards in that period came from signature transactions, rather than PIN-based ones.

Historically, though, PIN-based debit card transactions have been seen as more secure than signature-based debit card purchases. A 2005 study by Pulse, a debit card network, showed that a PIN debit card transaction was about 15 times safer than its signature counterpart, based on losses per transaction and per sales volume.

That’s because fraudsters who obtain a traditional ATM card — without a MasterCard or Visa logo — would have to know the PIN to make a purchase. But the recent breaches could shake public confidence in the security, Litan says.

Also, the industry may have to rethink how it detects fraud, because, “Systems around PIN debit are not as advanced as the ones around signature debit,” she says. “There was never a need.”

If fraud occurs in a credit card transaction, you usually have no liability. Signature debit card transactions often enjoy the same protection. But if fraud occurs with a PIN debit card transaction, the consumer’s protection can vary by bank.

Wells Fargo, Bank of America and Citibank say customers have zero liability from fraudulent debit card transactions, whether signature or PIN-based. Consumers should notify the banks, however, within 60 days of when the statement is mailed.

By law, banks must limit debit card liability to $50 if you notify them within two business days after a debit card has been lost or stolen.

If you notify your bank within 60 days of when the statement is mailed, you could be liable for $500. Wait longer than that, and you could lose much more.