Durbin Questions Whether Credit / Debit Card Chip Technology Rollout is Adequately Protecting Competition & Consumers
[WASHINGTON, D.C.] – U.S. Senator Dick Durbin (D-IL) today questioned the Chairman of EMVCo – an organization that controls the specifications governing credit and debit card chip technology – seeking information on whether the deployment of this technology in the United States is adequately preserving competition and protecting consumers.
“Magnetic stripe debit and credit cards have long been a key vulnerability that has put consumers’ sensitive financial information at risk,” said Durbin. “Chip technology is designed to be safer and more secure for customers, but there are significant questions about whether the deployment of this technology in the United States is adequately protecting competition and consumers. Today I am seeking answers from EMVCo, an organization owned by six giant card networks that sets the rules for chip card technology. I hope their answers will help clarify how security and competition in the U.S. payment card market can be further improved.”
Durbin has long advocated for enhancing payment card security technology in the United States. While most other industrialized countries transitioned long ago to chip-based cards with authentication measures like PINs that provide greater fraud protection, many payment card providers in the United States still use insecure, 1970s-era magnetic stripe technology. As a result, according to The Nilson Report, in 2012 the U.S. accounted for nearly half of global payment card fraud losses despite representing less than one-quarter of the world’s payment card volume. In 2010, Durbin authored debit card swipe fee reform legislation that aimed to incentivize greater card security in the United States by conditioning a portion of banks’ swipe fees on the banks’ adoption of effective fraud prevention steps.
Text of today’s letter is below.
March 17, 2016
Mike Matan
Chairman, Executive Committee
EMVCo
901 Metro Center Boulevard
Foster City, California 94404
Dear Mr. Matan:
I write to seek information about EMVCo, its governance, its operations, and the impact its specifications may have on competition and choice between electronic payment networks. In light of the enormous influence EMVCo wields over the deployment of Europay MasterCard Visa (EMV) technology in the United States, it is important for lawmakers to have a clear picture of how EMVCo operates and how its work affects American businesses and consumers. Accordingly, I ask that you provide answers within 30 days to the following questions:
1. EMVCo controls the specifications and certification processes for EMV chip technology that is now used in approximately 3.4 billion payment cards worldwide. EMVCo is owned by six “member organizations” which are the giant payment card networks American Express, Discover, MasterCard, Visa, JCB (a Japanese-based payments company) and UnionPay (a Chinese bankcard association). EMVCo is managed by a Board of Managers and an Executive Committee, both of which appear to consist entirely of representatives from the six giant networks.
A. Please provide a current list of EMVCo Executive Committee members and members of the Board of Managers.
B. Please explain how members of the Executive Committee and the Board of Managers are selected.
C. Please explain the decisionmaking authority that JCB and UnionPay exert in determining how EMV technology is developed and implemented in the United States.
2. What is the primary U.S. federal regulatory authority that exerts oversight over EMVCo’s operations as they affect the American electronic payment system? What, if any, non-public information does EMVCo share with that regulator as EMVCo develops or implements specifications and certification processes?
3. Does EMVCo, or do JCB or UnionPay, share non-public information about EMVCo’s specifications, certification processes, or other operations with government authorities in China or Japan? If so, what information is shared?
4. EMVCo does not appear to provide other U.S. stakeholders in the electronic payment system with any meaningful decisionmaking authority in the development of its specifications or certification processes. Smaller payment networks and those who accept electronic payments (such as merchants) are relegated to “associate” status in EMVCo which appears to be purely advisory in nature. Please explain why these stakeholders are unrepresented on EMVCo’s Executive Committee and Board of Managers.
5. What safeguards are built into EMV technology and specifications to ensure that smaller U.S. payment networks are able to fairly compete for consumer business against the six giant networks that control EMVCo? For example, what assurance does a small network have that EMVCo’s specifications will not have the effect of steering consumers or card acceptors away from small networks and toward EMVCo’s six member organizations?
6. Are all U.S. payment networks given access to EMVCo technical specifications at the same time that EMVCo’s six member organizations are given access to those specifications? If not, why not?
7. On October 1, 2015, the major card networks in the United States implemented a liability shift to encourage use of EMV technology.
A. Does EMVCo monitor market data regarding the number of card transactions handled by each U.S. card network before October 1, 2015 and after that date? If so, please provide this information.
B. Is EMVCo aware of any shift in market share after October 1, 2015 away from the small networks that are not among EMVCo’s six member organizations? If so, please provide this market share information.
8. What percentage of EMV cards worldwide are enabled for PIN authentication on every transaction, and what percentage of EMV cards in the United States are enabled for PIN authentication on every transaction?
9. Several of EMVCo’s member organizations have advocated against the use of EMV chip-and-PIN authentication in the United States. Does EMVCo believe that EMV chip-and-PIN authentication should be discontinued in Europe, Asia, or other non-U.S. markets?
10. Is EMVCo working on standards for biometric cardholder authentication? If so, will those standards be open so that all American payment networks can use them?
Thank you for your attention to this request. I look forward to your prompt response.