Chip cards offer better security — but at a cost

More than 18,000 Hawaii retailers must switch to new technology capable of reading microchips on credit cards by October or assume liability in case of fraud.

Under new rules set by card associations such as Visa and MasterCard, businesses are gearing up for a major shift that will make merchants liable for the first time for fraudulent charges if their credit card readers can’t read the so-called chip cards, which use a small embedded microchip — instead of a magnetic stripe — to encrypt account information.

Banks also could be held liable if they don’t issue chip cards, also known as EMV (which stands for Europay, MasterCard and Visa, the three companies that created the security standards), and fraud occurs with a merchant that has the new technology.

"It’s establishing a hierarchy, and whoever has the highest level of security has the benefit of not taking the fraud loss," said Chris Dods, First Hawaiian Bank executive vice president and marketing communications division manager. "Through this hierarchy, the associations are creating a financial incentive for both the issuing banks and the merchants to invest in the technology to make the payment channel more secure for the customer. If everybody has the same level of security, the issuing bank takes the responsibility for the fraud."

But the new technology comes at a high price.

"To meet the new requirements … we need to invest in new hardware as well as labor to upgrade and certify new software," said Toby Tani­gu­chi, executive vice president of store operations for KTA Super Stores. "Depending on the number of programmers you place on the job, it could take several months to complete this. The hardware itself is in the high five figures. Add to that the software programming, as well as certification proc­ess, and the investment becomes substantial for any business."

Retail Merchants of Hawaii estimates retailers will need to spend anywhere from $10,000 to more than $100,000 to change their cash registers, terminal systems and card readers.

"Say a grocery store has 11 checkout lines. Every single checkout line needs to be switched out with a new machine by Oct. 1, or else the liability will be placed on them," said Sheri Saka­moto, president of the retail association. "It’s definitely one more added cost. Any business that accepts credit cards will be affected."

Credit card fraud accounts for 22 percent of the overall fraud reported in the state, Saka­moto said. There are 18,439 retail establishments in Hawaii, according to the retail group’s estimates.

It’s also a significant cost to financial institutions.

The microchip-embedded cards are as much as 10 times more expensive to make than magnetic stripe cards, according to Ed Pei, executive director of the Hawaii Bankers Association. In large quantities, magnetic stripe cards cost around 10 cents, while the chip cards cost about $1. In smaller quantities the ratio is 30 cents to $3, he said.

"The banks also have a huge investment to make," Pei said. "It’s not just the merchants."

First Hawaiian is working on including EMV chips in its credit cards, Dods said, but the timing is uncertain.

"How we roll out chip cards in the market will depend on what makes sense for the customer and how widely adopted the technology is with merchants," he said. "It doesn’t make sense to disrupt a customer by reissuing them a new card if the chip is not widely accepted. The technology only improves security when both the issuer and the merchant have invested in EMV."

A spokesman for ABC Stores, ubiquitous in Wai­kiki, said the convenience store company is making a significant investment in rolling out new cash register systems capable of reading the EMV cards at 77 stores in Hawaii, Las Vegas and Sai­pan.

"Like all businesses, it’s going to cost us money to be compliant," said Neil Ishida, ABC’s public relations director, who declined to say how much the new systems will cost the company but said it is in the range estimated by Retail Merchants. "There is a lot of theft and fraudulent attempts. It’s always been a problem. If we are compliant, it’s a lot safer until the time somebody finds a way to counterfeit the chip. There’s always people that are going to figure out how to get around the system."

Mark Hollander, chief executive officer and president of Crazy Shirts, upgraded his sales terminals in late 2013 to be chip card compliant at his roughly 40 stores.

"Everybody takes data and Internet and personal security so seriously because of the sheer volume of hacks and fraud," he said. "There are so many of the smaller merchants out there who will definitely have to keep up with this. In the short term it may sting quite a bit. Unfortunately, it’s a part of the times we live in."

Not all retailers may be ready to make the upgrades by the liability shift deadline.

Nearly 60 percent of small business owners nationwide surveyed by software firm Intuit cited the cost of new terminals as the main barrier to complying with the rules, while 85 percent of businesses who have not made the switch are largely unaware of the financial liabilities they could be responsible for after October.

"I feel for (small businesses) because when you step back and look at regulation after regulation being passed by Congress and the Legislature, it’s very difficult to survive," Saka­moto said. "We (the Hawaiian Islands) are the worst place to do business. That’s why you see mom-and-pops unable to make a go and have closed. It’s really critical for retailers."