Card Verification Methods: PIN vs. Signature vs. None
There’s a lot of confusion within the payments industry in the United States regarding the various card verification methods that can be used with a chip card. Should we require a PIN for all chip transactions? Is signature “good enough”? When is no cardholder verification acceptable?
One of the primary benefits of EMV (the payments industry standard for chip) is that it is extremely difficult, if not impossible, to counterfeit the chip in a chip card. In countries where EMV has been implemented, counterfeit card fraud has therefore been significantly reduced. When you use your chip card, and it is authenticated by the issuer, the likelihood of the card being counterfeit is extremely low.
However, counterfeit fraud is only one type of card fraud. Let’s say that your chip card is stolen, and the thief uses it at a POS terminal that does not require PIN or signature to verify that the true cardholder is actually performing the transaction. The issuer authenticates the card and approves the transaction. You then report that your card was stolen, so the transaction performed by the thief is deemed fraudulent. Although the chip card itself was genuine, the person using it was not the authentic cardholder. So the chip card alone, when used without any method of cardholder verification, cannot prevent lost or stolen fraud.
When no PIN, signature, or other method of verifying the cardholder is required at the terminal, this is known as ‘no cardholder verification’. This is common at POS devices where the transaction amount is low, and the merchant considers the risk acceptable.
Most U.S. cardholders today are used to entering their PIN when performing a transaction at an ATM, and providing a signature when they use their credit card for transactions at terminals other than ATMs. Unlike the PIN, the signature is not carried online to the host, and therefore is not verified as part of the transaction authorization process. A criminal who steals your credit card could sign your name when the terminal requests a signature, and rarely does anyone compare that signature to any form of identification (which could also be false). If the transaction is later deemed fraudulent, the issuer typically requests a copy of the signature from the merchant, and compares it with the signature of the true cardholder as one means of confirming the fraud.
When signature is used as the cardholder verification method for a chip card transaction, this process does not change. The signature is not passed to the host and is not verified as part of the transaction authorization process. If the transaction is later deemed fraudulent, the issuer must follow the current process to obtain a copy of the signature from the merchant. Signature, therefore, is of little to no value in preventing lost or stolen fraud.
A PIN is a very strong cardholder verification method, since the true cardholder is typically the only person who knows the PIN that is associated with their card. When coupled with the chip card (something only the true cardholder has), the PIN (something only the true cardholder knows) provides a strong, second authentication factor for a transaction. Countries that have implemented “chip and PIN” have seen a significant reduction in lost and stolen fraud as well as counterfeit fraud.
Given the obvious benefits of “chip and PIN”, why should issuers, acquirers, and the various payment systems in the U.S. hesitate to implement “chip and PIN” for debit and credit transactions? Customers are already used to using a PIN for every ATM transaction. When EMV was rolled out in Canada, issuers were afraid that their customers would not want to use a PIN for credit card transactions, or would be confused by this new requirement, but these fears turned out to be unfounded. Perhaps Visa and MasterCard are not giving the public enough credit, assuming we cannot learn to use a PIN for a credit card transaction! Personally, I am eager to embrace “chip and PIN”, and I suspect that anyone who is truly anxious to combat multiple forms of card fraud feels the same.