Untitled Document

Monday, October 23, 2017 | MANILA, PHILIPPINES
Untitled Document
   banking report
Date posted: Tuesday, February 28, 2017 | Manila, Philippines

4th Quarter Banking Report (2016)

Why shift to EMV is a problem for cardholders

THE GOOD news is that at least 90% of banks and other financial institutions in the country have complied with the Bangko Sentral ng Pilipinas (BSP) directive to shift to the Europay Mastercard Visa (EMV) standard in their cards business.

The bad news is that the BSP can’t say who comprise the 10%. In lieu of identifying the laggards, the regulator cited timelines indicated in the submitted status reports that show most of banks fully migrating by the fourth quarter of this year.

So cardholders beware, as even EMV micro chip-equipped cards may not be entirely fraud-free if the accepting device in an acquiring institution is not yet ready to process the transaction using the new technology.

Last December, the BSP announced that around 90% of banks and other financial institutions have already “substantially complied” with almost all of the technical requirements for the mandated shift to EMV technology. That is in terms of software upgrades to EMV technology, and ensuring that automated teller machines (ATMs), point-of-sale (POS) terminals and clients’ cards are EMV-equipped.

Under Circular 859, which it issued in 2014, the BSP gave card issuers until January 1, 2017 to move away from the use of magnetic strip technology. The mandated shift to EMV technology is aimed at guarding cardholders against fraud, which happens when a non-compliant card is used in a transaction or a compliant card is used in a non-compliant accepting device such as an ATM (automated teller machine), point-of-sale (POS) terminal and similar payment devices used by an accepting institution (see diagram).

The international standard EMV chip technology is said to be more secure against fraud because it has a unique cryptogram that is generated each time the card is used, and which is authenticated by the card terminal. This makes card cloning more difficult and easier to detect.

The new technology can also prevent the transfer of data through skimming, which is a scheme employed by criminals to copy information stored in a card. The EMV micro-chip also has greater capacity to store data compared to the magnetic strip.

Alex G. Ilagan, Credit Card Association of the Philippines (CCAP) executive director, said before EMV, banks deployed risk-based transactional parameters to detect suspected fraud transactions. Some banks have real-time review and decline fraud transactions, while others observe Day Two checking.

BSP data show that cyber fraud-related cases are significant in the Philippines, with losses amounting to some P200 billion in 2015 alone. Of this amount, 75% were related to credit card and ATM skimming.

“The EMV chip technology has been proven effective in significantly reducing counterfeit fraud, skimming and other related attacks perpetrated in magnetic stripe payment cards,” BSP Deputy Governor Nestor A. Espenilla, Jr. said. “While such may be the case, it is not a silver bullet or a one-time solution.”

The Ayala-led Bank of the Philippine Islands (BSP) is the first to migrate all of its 1.3 million credit cards in circulation, said BPI Cards Vice-President Jenelyn Z. Lacerna.

Metropolitan Bank & Trust Co. (Metrobank) also had announced that it was set to issue its EMV cards before 2016 ended.

“The [EMV-chipped] cards are going to be available within the year (2016) so customers will be able to replace [their old] cards,” Mark B. Perez, senior vice-president and retail banking group head of Metrobank, said.

“So the expectation is that from an issuing perspective as well as from the acquiring perspective, it should be fine. So in our case we already have the cards, we are already able to produce the cards that are already certified... so it’s just a matter of getting the cards to the hands of the customer,” Mr. Perez added.

East West Banking Corp. also has fully-equipped its credit cards with the new micro-chip ahead of the deadline.

“All EastWest credit cards issued are now EMV chip-enabled in compliance with the BSP’s mandate to adopt chip technology for better card security. EastWest was able to comply ahead of BSP’s deadline to implement the initiative,” the Gotianun-led bank said in a statement.

Union Bank of the Philippines (UnionBank) also said early last year that they were looking to secure all its cards with EMV chip technology ahead of the deadline.

“Credit cards are already EMV. Debit cards ongoing. We will complete before the deadline,” Edwin R. Bautista, UnionBank president and chief operating officer, said in a text message when asked for an update on the bank’s efforts to convert to EMV technology.

“By the time we complete the migration, we would have converted 2.5 million cards,” he added, noting that the listed lender has embarked on the conversion starting 2014.

Likewise, Philippine Savings Bank (PSBank) was aiming to complete conversion of cards to EMV technology as early as the middle of last year.

“By 2017, all cards should be chipped. We’re going ahead and we’re hoping to start any time third or fourth quarter,” PSBank Senior Vice-President and Marketing and Customer Experience Group Head Noel A. Tuazon said in an interview.

“Hopefully by no later than mid-2016, we are already done,” he added.

Also last year, Asia United Bank Corp. (AUB) said the bank was on track to beat the deadline. “We are not yet compliant but [we will] be ready by 2017,” AUB President Abraham T. Co said in a text message, adding that the banking arm of tycoon Jacinto Ng’s Republic Biscuit Corp. (Rebisco) will be able to comply by the deadline.

The Philippine Business Bank (PBB), according to President and Chief Executive Officer Rolando R. Avante, the bank’s migration to EMV is ongoing, with target completion as early as second quarter of this year.

Same with PNB Savings Bank, as the migration is expected to be completed in the first quarter of this year.

“The process has started. Our active ATM card users [are] about 25,000 only of total customer base. We will be starting to issue EMV cards this month,” said PNB Savings Bank President Jovencio DB. Hernandez.

“The cards are already available. We are just making sure that the connections, the ATM switch are ready and certified. And we already have this certification. So, by the first quarter, we will be fully complied.”

“The BSP understands that the EMV migration process is a major and complex undertaking involving series of activities which require technological upgrade, process enhancements, testing as well as collaboration among BSP supervised financial institutions (BSFIs), domestic switches and other payment network players,” Mr. Espenilla, said.

For this reason, some banks’ migration efforts and activities were in different stages of completion as of the deadline. Nonetheless, the migration of the underlying systems, payment devices and terminals for most BSFIs was already nearing completion, according to the BSP.

As most of the cards are EMV ready, not all terminals are compatible with the upgrade, which is a key for completion.

“The magnetic strip was still kept active because not all terminals accepted chip cards,” said CCAP’s Ilagan. “No losses on fraud due to the liability shift but cards still needed to be replaced.”

One of the biggest challenges is the delivery of the cards to the customers as this is costly and time consuming.

“[T]he expense [is] you have to replace your ATMs if they are not EMV compliant. The switch, where they interconnect to the Bancnet switch, and to other bank’s switch,” PNB Savings Bank’s Mr. Hernandez said. “And the cost of the card is expensive, at least triple versus the regular plastic card.”

The BSP’s Mr. Espenilla agreed that replacing cards in the possession of bank clients is a big hurdle: “Although EMV migration for the updating of softwares and upgrading ATM and POS terminals, and replacing credit cards are substantially on track, most BSFIs encounter significant challenges in the replacement and distribution of debit and prepaid cards.”

Despite this, “PNB Savings Bank’s Mr. Hernandez said the banking industry acknowledges that “this is the way to go to protect the customers. We’re looking at it as a part of doing business.”

According to CCAP, skimming incidents in credit cards had been reduced by 80%. Unfortunately, the fraudsters have migrated to ATM skimming and “card-not-present” transactions.

PNB Savings Bank’s Mr. Hernandez said that it’s too early to tell if EMV works because the banks have just adopted the compliant cards.

“But I think it will be at least 90% to 95%,” he said, referring to the expected reduction in fraud cases.

“Skimming devices for EMV-compliant ATMs still have a lot to catch up with the new technology. This is true even abroad. So, the EMV still is a very potent security measure for customers and for the banks,” he added.

In recognition of the complexity and magnitude of the entire EMV migration process, the BSP last December put in place the EMV Card Fraud Liability Shift Framework (ECFLSF) as a market-based enforcement mechanism. This sets forth the general principles in the allocation of liability and resolution of disputes on fraudulent transactions arising from counterfeit cards.

The ECFLSF operates in such a way that a BSFI that has adopted the secure EMV technology shall be protected from financial liability arising from losses on counterfeit card fraud.

The liability for this type of fraud shall shift to the BSFI which is not or is only partially compliant with the EMV requirement. The ECFLSF framework is laid down under BSP Circular No. 936.

The issuance of the ECFLSF is expected to accelerate EMV compliance efforts as well as speed up the dispute resolution and restitution process for customers who have valid claims arising from counterfeit fraud or skimming attacks.

Going forward, banks shouldn’t stop at adopting EMV technology, according to BSP’s Mr. Espenilla, adding that BSFIs should continuously monitor developments and assess risks associated with their payment networks and systems given the rapidly evolving cyber-threats and the increasing ability of fraudsters to circumvent existing controls.

He said BSFIs should ensure that an interplay of technology, people and processes on top of adequate governance and risk management mechanisms are in place to effectively address emerging payment systems risks and threats. -- Ranier Olson R. Reusora

For inquiries, send e-mail to research@bworldonline.com

Other Stories