An Argument For Waiting To Deploy EMV

Listerhill Credit Union is among the financial institutions questioning the protective benefits of EMV and asking “what’s the rush?” to shift.

 
 

Listerhill Credit Union ($704.9M, Sheffield, AL) completed a core conversion in March 2015, but that’s not the only change on the horizon of the Alabama credit union that spring. In October, a looming EMV liability shift was requiring the credit union to consider what to do with its 13,000 credit cards and 6,500 debit cards.

Listerhill considered simply mass reissuing all its magnetic-swipe cards. But that didn’t happen.

In May, the credit union reissued EMV cards en masse but opted not to do the same for its debit card. In fact, it still hasn’t reissued debit cards.

Why? Because new core processor Symitar passed along a whitepaper detailing sources of card fraud soured the credit union to a whole-cloth EMV migration.

CU QUICK FACTS

listerhill credit union
Data as of 06.30.16
  • HQ: Sheffield, AL
  • ASSETS: $704.9M
  • MEMBERS: 86,169
  • BRANCHES: 18
  • 12-MO SHARE GROWTH: 4.5%
  • 12-MO LOAN GROWTH: 14.9%
  • ROA: 0.7%

In this Q&A, the credit union’s chief financial officer, Clay Morgan, and its vice president of payments, Angie Rutherford, discuss what it was like to have to comply with new security standards so soon after a core conversion, why Listerhill decided against mass reissuing debit cards, and why Morgan wishes the credit union hadn’t mass reissued credit cards either.

Why didn't Listerhill mass reissue both credit and debit cards at the same time, as originally planned?

Clay Morgan: The EMV liability shift was coming and we felt, like the rest of the world, we needed to shift to EMV right away and we needed to shift both portfolios. Credit cards were straightforward so we decided to do those first.

But as we started digging in further, we realized this shift wasn’t going to benefit us from a fraud standpoint because our card not present fraud accounts for the majority of our fraud.

Plus, we were just coming off our conversion and had a few issues after we went live. It was a pretty strenuous nine months, so it was an easy decision to delay the EMV conversion for debit cards.

Angie Rutherford: We have 11 instant issue machines all in different branches, but our previous instant issuer was not ready to issue EMV cards when we were ready to mass reissue.

We found a new provider, which we switched to in September of last year, but it wasn’t able to instant issue EMV at the time. So rather than creating a headache for our members and staff, we decided a mass reissue of debit wasn’t going to be possible.

We’re hoping to have instant issue EMV by the end of the year.

How did you realize EMV was not going to benefit you from a fraud perspective?

AR: Everywhere we went, everything we heard was that we had to shift to EMV. And we were preparing for that. But we were running into problems, specifically that without issuing members new card numbers they were going to have two working cards — one with a magnetic stripe and one with an EMV chip. That was problematic.

Our core provider sent me a whitepaper arguing there wasn’t a need to shift to EMV, that EMV was going to affect just pin fraud. That’s when we asked why we were putting ourselves through all of this work when our pin fraud is not that much. We decided it wasn’t worth it to put our credit union, our staff, and our membership through a mass reissue.

CM: EMV cards were sold to in the industry as something that was going to diminish our fraud. When we saw this whitepaper, we realized the bulk of our fraud was card not present and EMV cards weren’t going to benefit us that much.

In the rest of the world, the majority of the transactions are pin-based. But the United States is not. Transactions are approximately 50% pin-based versus non pin-based, just like we are at Listerhill.

Did you consider pushing back your EMV shift entirely?

CM: We had a discussion about delaying our EMV shift for a year or two or three and seeing where the environment went. But we saw area merchants gearing up for this and we knew as Wal-Mart did, other merchants would quickly follow. We knew the EMV environment would be inevitable, so we joined the party.

The bulk of our fraud was card not present and EMV cards weren’t going to benefit us that much.

What percentage of your fraud is card not present?

CM: We don’t track that yet, though we do have a new infrastructure in place to do that. It’s more than 75%.

AR: We don’t have much counterfeit. We seldom see a true counterfeit card. And when we do, we get hit over a holiday weekend through ATMs in California or Virginia. Our system shuts them down pretty quickly.

You wish you had done a natural reissue on credit cards as well. Why is that?

AR: If we had done a natural reissue it would have been easier on our cardholders. We did this after our core conversion, so we had both projects working on top of each other. From a staff perspective, I would have preferred to go natural knowing what we know now.

What part did the core conversion play in your decision to not mass reissue debit?

CM: Although our core conversion went beautifully, we still had an increase in calls to our call center and other changes to iron out. And it was still in the front of our mind as we discussed the EMV shift. We did not want to change member’s card numbers. We wanted to make sure their old card number in their wallet would be the same as their new EMV card.

AR: The easiest thing is to do would have been to change card numbers and mass reissue.

CM: It would have been easy, but it would have had a huge impact on our membership.

How much would it cost to mass reissue nearly 20,000 cards?

CM: More than six figures. It is not cheap.

At this point, how many debit cards have you replaced?

AR: Approximately half. All non-instant reissues on debit cards are EMV. Based on our current pace, we should be 100% EMV by September of next year.

CM: We’ll let the reissues happen at the speed they’re happening unless there’s some catastrophic fraud event or a merchant breach. We’ll react to those, of course.Otherwise, all our cards have two-year expiration dates.

Any other lessons learned?

AR: Our membership has been open to the EMV shift. Problems at first were more that our local merchants didn’t know how to handle it, so we always said swipe first and let the terminal lead you where you need to go.

—  As told to Erik Payne

 

 

 

Sept. 12, 2016


Comments

 
 
 

No comments have been posted yet. Be the first one.