GET THE FREE NATIONAL CYBER SECURITY APP FOR YOUR PHONE AND TABLET
Right now in small shops and restaurants across Boulder County, sales are being made and credit cards handed over in a process that has remained unchanged for more than 45 years, when the first magnetic stripped-card was used at Chicago’s O’Hare Airport.
The first big deadline in the process is Oct. 1. But dozens of Boulder County’s independently owned businesses, who weren’t aware of the new rules, won’t be ready in time. And that could mean thousands of dollars in penalties.
After Oct. 1, American Express, Discover, Mastercard and Visa will no longer accept liability for fraudulent charges. Instead, the responsibility will pass to either banks or retailers — whichever party is the least compliant.
A July survey conducted by Wells Fargo and Gallup found that 49 percent of small business owners in the U.S were unaware of the pending liability shift.
Shops preparing, but not fast enough
A stroll down Boulder’s Pearl Street Mall finds that most of the merchants are at least aware of the new cards and the need to update their equipment to process them — but many didn’t know why.
At Peppercorn, managers met Sept. 10 to discuss the need to make its eight point of sale (POS) systems compliant, at a cost of $400 to $500 each. The machines will be in place by Oct. 1, but multiple managers at the store weren’t aware of the deadline imposed by the major credit card companies.
“I guess it’s good we’re going to be ready,” manager Gwen Kraegel said, “because if something happens, we have to pay.”
EMV cards — short for Europay, Mastercard and Visa, the developers of the standard — are embedded with a microprocessor chips. For each transaction, the chip creates a unique security code that cannot be used again, which blocks the cards’ data from being duplicated. That duplication is the major source of credit card fraud in the world.
Pearl Street merchants said card fraud is a major issue on the mall, a high-traffic, high-tourist area.
“It’s always been a big problem on Pearl Street,” said manager Angel Brick of El Loro. “It doesn’t happen often here (at El Loro) because we’re better at checking signatures and IDs than some others, but anywhere tourists, there’s fraud.”
Even understanding those risks, Brick said the shop might not have the new POS systems by Oct. 1.
“Hopefully we’ll have them ahead of the holiday shopping season.”
Priority on big-box stores mean small shops get left behind
El Loro isn’t alone.
The Wells Fargo survey found that just 60 percent of small business owners in the U.S. would have smart card readers in place by Oct. 1. A further 34 percent said they would be upgrading after that date.
According to Javelin Strategy & Research, there are 15 million POS devices in the U.S. — and all of them will need to be upgraded, at an estimated cost of $6.75 billion.
In many cases, the payment processing companies that manage the devices have been slow to reach their smaller clients.
“If an organization has a large client base, they may be only servicing a portion of that base in a period of time — larger first, then smaller- and medium-sized companies,” said Randy Vanderhoof, spokesperson for Smart Card Alliance, a multi-industry nonprofit group advocating for the switch to EMV.
Vanderhoof said those payment processing companies were the party most likely to inform business owners that there was a need to switch in the first place, which is perhaps why so many smaller merchants were left in the dark.
“Small business owners might not get the same attention that some of the large companies do.”
Because of the priority placed on big-box retailers — more likely to be targets of large-scale credit card fraud — small businesses have to look to other sources for information.
Arsen Kashkashian, inventory control manager at Boulder Bookstore, said his team first learned of the shift from industry groups such as the Independent Booksellers Consortium.
Others relied on business groups such as Downtown Boulder Inc., which sends out monthly newsletters to all downtown businesses and members.
Terri Takata-Smith, marketing director for DBI, said she included the item in a January and July newsletter. But she admitted she was still compiling resources for upcoming correspondence and updates to DBI’s website — less than two weeks before the liability shift.
Neither the Boulder or Longmont chambers of commerce conducted any education efforts for members, according to spokespersons at those entities, and a search for “EMV” on the Boulder Small Business Development Center website returned no results.
Accelerated rollout causes complications, consternation
Experts say the switch will likely take several years to fully implement.
“Our projections are that for the end of 2015, there will be about 600 million EMV cards issued,” Vanderhoof said — about half of all credit cards in the U.S.
“The U.S. market is larger than all of the European countries combined in their migration to EMV,” Vanderhoof said. “And we’re trying to do it at one time with no mandate and no government regulation forcing merchants or issuers to make this change over.”
In comparison, Canada, the most recent nation to make the switch, took seven years to implement the EMV standard, with a market one-tenth the size.
The pace of change, while impressive to some, has been frustrating to others.
“They’re trying to cram 10 years of technology into one year,” said Jurgen Deno, a customer at Crystal Galleries who was at the Pearl Street store last week.
Carla Gratkowski, a manager there, said they have had an EMV-compatible machine for a few months, but it has yet to work properly.
Both Deno and Gratkowski thought the change was good for U.S. consumers, who are victim to 47 percent of the world’s credit card fraud, despite accounting for only 24 percent of card volume, according to a June report from Barclays.
But, Gratkowski said, “It’s hard for businesses down here,” with customers growing impatient with the new technology.
“(The new system) would be great if it worked,” she said.
Those complications have played a part in some retailers delaying or declining to make the change, despite the financial risk of increased liability.
Among Longmont’s Main Street merchants, there were a handful of holdouts.
Mark Chamberlain of Chamberlain Coins & Collectibles said he’ll stick to his cash-only policy for sales of gold and silver. As for the credit card sales of supplies and services, he said he’ll just have to trust his customers.
Other business owners echoed Chamberlain’s sentiment.
“In 10 years of business, I’ve had two bad checks and no credit card issues,” said Forrest Fleming of Instant Imprints, who is not planning to update his machine unless “the credit card companies say it’s necessary.”
Twenty-one percent of U.S. small businesses surveyed by Wells Fargo said they weren’t planning on implementing the EMV standard.
Compared to Boulder’s bustling Pearl Street Mall, credit card fraud isn’t as big an issue on Longmont’s Main Street, home to music shops, bookstores and printing services that draw few if any tourists and criminals.
“Someone who steals a credit card is buying big-ticket items,” said Linda Uhrich, co-owner of Used Book Emporium. “They’re not bringing it to a used book store.”
The cost of noncompliance
Still, Uhrich made an investment in an EMV card processor, as did the majority of businesses along Main Street.
That’s a smart move, Vanderhoof said.
Chain stores like Walmart and Best Buy might be targets now, but as they move to the EMV system, criminals will set their sights on whatever shops are left unprotected.
“Because other merchants will have higher security, that’s where fraudsters will go.”
That could cost small retailers big. According to a LexisNexis study, merchants paid $3.08 per dollar of fraud in 2014.
Those costs were higher for mobile payments: $3.34 per fraudulent dollar.
That’s particularly worrisome considering that mobile POS systems such as Square are not yet available with EMV readers.
Square is accepting pre-orders for an EMV-capable system, retailing for $49. But the devices won’t ship to merchants until late this year or early next.
That leaves dozens of Boulder County vendors vulnerable — including food trucks and brick-and-mortar shops that use tablets as POS systems.
Lindsey Cunningham, co-owner of Rolling Greens mobile food truck and catering, said shouldering liability for fraud was unfair when devices weren’t made available in time for the liability shift.
“That could put somebody under if they couldn’t afford to cover a dispute,” Cunningham said. “I don’t understand why we would have to be faced with a liability like that.”