Corporate cards with chips finally are coming to the United States en masse. How travel departments should deal with them depends on the circumstances. Chip cards requiring a PIN for authentication are more secure and more widely accepted globally than chip-and-signature cards. But many corporate program managers aren’t getting chip-and-PIN from their payment firm.
Payments industry analyst Frank Martien of First Annapolis Consulting said chip-and-signature may be the interim step, with banks ultimately going to chip-and-PIN.
Open Society Foundations global travel manager Chris Gremski said the topic has been “a pain point for us a for long time.” In exploring chip-and-PIN during the past few years, he found that “U.S. issuers were dismissive of that setup.”
Some companies provide chip-and-PIN cards to international travelers because certain merchants outside the United States require that flavor for card transactions. Gremski noted that chip-and-signature cards may not work at unattended train ticket kiosks or gas stations. Although some terminals allow for PIN or signature, merchants may not understand the difference.
These hurdles can create corporate policy compliance and data reporting issues.
“I think the United States is going in the wrong direction with chip-and-signature,” said Meritor global travel manager Jack Reynaert.
All Meritor cardholders as of last July have chip-and-PIN cards via a small bank issuer on the MasterCard network and, in Europe, a major bank issuer on the Visa network. The company started first with international travelers about four years ago. Acknowledging that chip cards are more expensive for issuers to supply to clients, Reynaert argued that it’s a good investment because of greater utilization — and corporate program compliance — through wider acceptance.
Representing the world’s largest managed travel program, the U.S. General Services Administration isn’t taking “signature” for an answer. GSA this month began a program to issue more than 1 million chip-and-PIN cards by year-end. The move follows a presidential executive order in October 2014 to improve government payment security and promote wider adoption of more secure cards and transaction terminals that can read them. GSA’s SmartPay program includes travel, purchasing, integrated and fleet cards. The contracting banks are Citi, J.P. Morgan Chase and U.S. Bank.
David Shea, director of GSA’s Office of Charge Card Management, in an email explained that SmartPay is going with chip-and-PIN technology “to avail government cardholders of the maximum additional security possible for card present transactions.” GSA noted that most vendors accepting GSA SmartPay travel and purchasing cards will convert their systems by October 2015. Most fuel vendors for the SmartPay fleet card will convert by October 2017.
U.S. Bank has been providing chip-and-signature cards that also have PINs, covering travelers faced with either scenario. “We really began migration in earnest about three or four months ago,” said U.S. Bank senior vice president Mary Miklethun. “Every new card we issue is chip-enabled. We are doing some early reissues over the course of this year for the corporate travel portfolio.”
About three years ago, Bank of America opted to go with chip-and-PIN based on customer demand. Why not chip-and-signature cards with PIN capability? “The experience at the point of sale is quite cumbersome and makes you have to think more whereas simple chip-and-PIN will be increasingly ubiquitous around the globe,” said Bank of America Merrill Lynch head of global cards and comprehensive payables Kevin Phalen. He noted that all new programs as of about 18 months ago have been chip-and-PIN enabled and that “a large percentage” of existing corporate travel clients will complete migration this year.
Flipping The Switch
Martien anticipates more banks will “flip the switch” on PIN cards because of an October deadline. At that time, the networks of American Express, Discover, MasterCard and Visa will transfer liability for certain types of fraudulent transactions. Traditionally held by the issuer, liability often will fall on merchants that haven’t installed terminals to read chip cards. Despite the shift, Miklethun and Phalen said their firms would continue assisting clients exposed to fraud. “It’s probably no impact, perhaps a non-event,” Phalen said. “We tend to get involved and resolve [incidents of fraud] with the merchant, without clients getting in the middle of it. We won’t bring them into this conversation.”
Those issuers that for now favor chip-and-signature cards do so because they are “faster to implement, lower cost and less complicated for consumers to adjust to,” said Randy Vanderhoof, executive director of the Smart Card Alliance, a non-profit that promotes new card technologies.
American Express has been providing chip-and-signature cards as replacements and renewals for existing corporate clients and for new accounts. “In the U.S., there is still work that must be done and investments that must be made across many payment industry stakeholder groups, including issuers, acquirers and merchants, to ensure seamless chip-and-PIN usability at the point of sale,” according to a spokesperson. Amex for a while has issued chip-and-PIN cards in the United Kingdom, France, Germany, Spain, Australia and Canada.
Chip-and-signature cards still are more secure than traditional magnetic stripe-only cards. “The PIN adds protection in case of a lost or stolen card, a piece of data that presumably only the cardholder knows,” Miklethun explained. “But lost and stolen fraud is by far the smallest component of fraud that exists in the market today.”
According to Vanderhoof, the October milestone will raise questions on why some cards have chips and some don’t, and why some merchants will accept magnetic stripe swipes and some won’t. “It is going to be a tough time to be a major bank, retailer or payment brand for the next few years until the hysteria around all this change subsides and consumers and payments providers and acceptors get used to the technology,” he wrote in a January Smart Card Alliance member bulletin. “It is really hard to get one’s mind wrapped around the prospect that another 500 million cards are going to be issued in the next 12 months, and an estimated 7 million EMV-capable terminals will start rejecting card swipes in favor of chip insertions by the start of the 2016.” EMV represents standards for chip cards.
Knowing What To Do
Traveler education campaigns should help corporate card program managers switch to chip cards (which have gold or silver metallic squares on the front, but also still have mag stripes on the back). New processes at the point of sale seem simple enough (dipping a chip card in a reader rather swiping it, or inputting a PIN rather than signing a receipt). But any change to a decades-long norm may take some getting used to.
With chip-and-signature, if a merchant doesn’t accept the card, travelers should know what to do. With chip-and-PIN, resetting a forgotten PIN en-route during travel “can be holy havoc,” said Meritor’s Reynaert.
“That was one of the points of friction we anticipated in the U.S. environment,” Miklethun said. It’s a reason why U.S. Bank maintained signature authentication as an option for its chip-cardholders.
She added that program administrators still will field lots of questions from travelers. “The biggest thing they can do is communicate with their cardholders as they hear from their issuing banks. We are trying to minimize that by getting [corporate clients] information ahead of time.”
Bank of America executives shared a similar message, noting the benefits of tailoring education to traveler types. “It’s about being super-proactive and handing clients sample written instructions that they may want to provide to cardholders in advance,” said Harmeet Soin, the bank’s managing director of product management.
According to some estimates, chip technology will be present in about half of U.S. payment cards and larger retailers by the end of this year.