The Case for Congressional Attention on Payment Security | Commentary
By Debra Berlyn A bipartisan group of lawmakers from the House Energy and Commerce Committee are asking the Government Accountability Office to review credit card monitoring services after an investigation found a leading provider made false claims. While the review is necessary, it raises an important question: If credit card monitoring may be ineffective at preventing fraud, why aren’t American leaders, including officials in Congress, having a discussion about safeguarding credit cards with two levels of security for payments — chip and PIN?
In the wake of data breaches at government agencies and several companies, credit monitoring services have increasingly been offered to breach victims to help mitigate any fraudulent activity. However, lawmakers — led by Chairman Fred Upton, R-Mich. — have written the GAO requesting answers to a number of questions relating to post-breach consumer protection services. In the letter, lawmakers question the usefulness of providing monitoring services for only a few years along with other packages like identity theft insurance and Internet surveillance.
While those services may have some merit, the best way to protect consumers from fraud is by strengthen security measures at their most fundamental level — at the point-of-sale. Consumer credit card transactions should be much more secure, and could be, but we continue to unnecessarily lag behind the rest of the world because credit card companies and banks insist on using a less secure alternative.
For some time, I have advocated for the implementation of chip and PIN technology. A chip and PIN-equipped card is embedded with a microchip and requires a unique personal identification number upon each point-of-sale transaction. The microchip coupled with the individual PIN make tampering and counterfeiting the cards, along with using stolen financial data, nearly impossible. Should a thief attempt to use a stolen chip and PIN card for an in-store purchase, it would be useless without knowledge of the PIN. Furthermore, we could extend those protections even further if we had more robust mechanisms available to consumers to securely use their PINs during online transactions. The technology certainly exists, it is just not widely used.
Chip and PIN will not only help to reduce fraud, but it also reduces the incentives to perpetrate data breaches in the first place. It diminishes the value of the data that could be stolen because the chip and PIN cards’ two-pronged security measures make it more difficult, if not possible, for thieves to actually use or sell stolen consumer credit card data.
Chip and PIN cards have contributed to dramatic reductions in fraud wherever they have been implemented abroad. Despite the overwhelming body of evidence that demonstrates its effectiveness, the financial services industry has thus far been unwilling to deploy these security measures in the United States.
While the financial institutions are making some effort to replace the fraud-prone magnetic stripe cards we are accustomed to with chip-equipped cards, they are still relying on signatures — not PINs — as a secondary method to ensure transactions are legitimate. They believe that requiring a PIN for credit card transactions could unnecessarily burden consumers who may have difficulty remembering another passcode. However, that argument is not a valid one, and it does not give Americans enough credit (no pun intended). People are perfectly capable of remembering a PIN, especially if it will better protect their finances.
Given the increased momentum on Capitol Hill to protect consumers from financial harm, an opportunity exists for the country’s leaders to help provide those protections by championing chip and PIN. Through two-way conversation and educational opportunities like the panel Protect My Data will host today, the positive differences between chip and PIN technology compared to chip-equipped cards with signature requirements will become abundantly clear. Through subtle or overt pressure from Congress, the more logical and safe solution could become a reality.
It is my hope that Congress will turn its attention to safeguarding consumer transactions in the coming weeks and months. Congress can play an important role by urging the nation’s largest banks and credit card companies to do everything they can to provide American consumers with chip and PIN equipped cards to protect their financial transactions and help reduce fraud.
Debra Berlyn is president of Consumer Policy Solutions and director of the Consumer Awareness Project. She is also the leader of ProtectMyData.org.