Report warns it will take companies 30 weeks to implement chip
and Pin
The largest ever trial of chip and Pin technology has been
completed, and for the UK's banks and retailers it is now "all
systems go" for the £1.1bn anti-fraud initiative.
Chip and Pin, which aims to slash card fraud by 50% by requiring
cardholders to authenticate purchases with a personal
identification number rather than a signature, was trialled between
May and July at more than 1,000 retail outlets in
Northampton.
With the trial complete, banks and retailers are poised to begin
the national roll-out of chip and Pin, which is due to be completed
by the end of 2004. Implementation is likely to start in the next
month, possibly on a sector-by-sector basis, according to the Chip
and Pin Programme Management Organisation (PMO).
The trial, which saw 200,000 chip-enabled cards issued and 180 cash
machines upgraded, was deemed a success by the PMO, but it also
provided valuable lessons.
The British Retail Consortium said information gained from the
trial will help retail IT directors implement what is the biggest
change in payment technology since decimalisation. The nationwide
programme will see more than 850,000 point of sale systems, 120
million cards and 40,000 cash machines upgraded by 2005.
"It is a massive and complex undertaking," said Amanda Miller,
director of retail services at the BRC. "The trial has shown that
early planning and close collaboration with banks and suppliers is
essential to its success."
The need to allow enough time to test and implement chip and Pin
technology was the overriding lesson from retailers that
participated in the trial. This is key because the implementation
process will take a minimum of 30 weeks for the majority of
organisations, the report said.
It urged retailers that own their own integrated point of sale
systems to implement chip and Pin without delay. In January 2005
the liability for fraudulent transactions will shift from banks to
retailers if they do not have chip and Pin-enabled point of sale
systems.
Safeway, which was the first UK supermarket to install chip and
Pin-compliant systems in all of its stores, said moving early has
given it a competitive edge.
"It was a new experience for us and our acquirer," said Jeremy
Wyman, business systems manager at Safeway. "I am glad we are now
ahead of the game but at times it was tough and no one should
underestimate the time and resources needed."
Fashion retailer River Island said the trial revealed that some
aspects of the implementation process took longer than many
companies had first estimated.
For example, said Tim Barton, retail systems manager at River
Island, acquirer acceptance testing - the process of ensuring that
every bank's credit card works with new chip and Pin-compliant
point of sale systems - takes at least six weeks.
"While the initial execution of the first cycle of acquirer
acceptance testing may only take two or three days on-site and four
to five days off-site for review and packaging up of test results,
it is likely that acquirer acceptance testing will require a number
of test cycles," he said. "Integrated point of sale retailers such
as River Island should allow an absolute minimum of six weeks to
complete acquirer acceptance testing."
Although January 2005 is the deadline for the liability shift,
companies should have completed chip and Pin implementations by
October 2004, Barton said.
"That is really the deadline when retailers should have found,
installed and trained in a system that is right for their business
before they begin the Christmas peak," he said. "Directly after
Christmas the liability shift kicks in and from that date the
retailer is vulnerable."
Barton revealed that a "major name in clothing and footwear" has
taken the decision not to do anything, choosing to risk liability.
"I think this is very dangerous," he said. "Fraudsters will soon
suss who is chip and Pin-enabled and who is not, and fraud will
simply migrate to those who are unprepared."
Although the majority of customers using chip and Pin during the
Northampton trial were positive about the technology - 83% said
they were in favour of the scheme - a number raised privacy fears,
the report revealed.
To combat apprehension about other shoppers being able to see
customers entering Pins, retailers can take a number of steps, the
report said.
"Retailers should make sure Pin pads are placed as near to
horizontal as possible and ensure that privacy shields are used
correctly and are not removed," it said. "If customers are still
apprehensive about a transaction, they should be reminded they can
change their Pin at cash machines at any time."
The needs of disabled customers need to be addressed early in the
process, the report warned. To help with factors such as the design
of Pin pads and where they are positioned, retailers should consult
the Implementation Guidelines for Retailers, produced by the
Disability Rights Commission.
When discussions about chip and Pin began in 2001, retailers were
sceptical about the return they would get on their £1.1bn
investment, claiming that banks would be the main beneficiaries.
However, following the Northampton trial, retailers have learned
that the technology provides direct benefits to them, in addition
to cutting card fraud.
Administration costs relating to fraud will be cut significantly
because retailers will no longer need to keep till receipts.
Safeway has estimated that this will lead to an annual saving of
£500,000.
The sophistication of chip cards will mean retailers can support
add-on services, such as loyalty cards or an electronic
purse.
And the improved security the chip cards will bring will also allow
retailers to expand on the use of unattended terminals, such as in
petrol stations, car parks and self-scanning checkouts in
supermarkets and high street stores.
Why retailers need chip and Pin
UK credit and debit card fraud reached a record high in 2002,
with £424m worth of fraudulent transactions, according to UK
payments body Apacs.
Without the introduction of chip and Pin technology, which
requires cardholders to authenticate purchases with a personal
identification number rather than a signature, this fraud would
reach £1bn by the end of the decade, Apacs believes.
Chip and Pin is designed to tackle more than 60% of card fraud
by targeting crime committed on counterfeit and lost or stolen
cards. The UK's banks and retailers hope that chip and Pin, which
is based on global Europay/MasterCard Visa specifications, will cut
card fraud by at least 50%. A domestic Pin-based system in France
has led to an 80% reduction in fraud since its introduction more
than 10 years ago.
Further information
www.chipandpin.co.uk