Report warns it will take companies 30 weeks to implement chip and Pin
The largest ever trial of chip and Pin technology has been completed, and for the UK's banks and retailers it is now "all systems go" for the £1.1bn anti-fraud initiative.
Chip and Pin, which aims to slash card fraud by 50% by requiring cardholders to authenticate purchases with a personal identification number rather than a signature, was trialled between May and July at more than 1,000 retail outlets in Northampton.
With the trial complete, banks and retailers are poised to begin the national roll-out of chip and Pin, which is due to be completed by the end of 2004. Implementation is likely to start in the next month, possibly on a sector-by-sector basis, according to the Chip and Pin Programme Management Organisation (PMO).
The trial, which saw 200,000 chip-enabled cards issued and 180 cash machines upgraded, was deemed a success by the PMO, but it also provided valuable lessons.
The British Retail Consortium said information gained from the trial will help retail IT directors implement what is the biggest change in payment technology since decimalisation. The nationwide programme will see more than 850,000 point of sale systems, 120 million cards and 40,000 cash machines upgraded by 2005.
"It is a massive and complex undertaking," said Amanda Miller, director of retail services at the BRC. "The trial has shown that early planning and close collaboration with banks and suppliers is essential to its success."
The need to allow enough time to test and implement chip and Pin technology was the overriding lesson from retailers that participated in the trial. This is key because the implementation process will take a minimum of 30 weeks for the majority of organisations, the report said.
It urged retailers that own their own integrated point of sale systems to implement chip and Pin without delay. In January 2005 the liability for fraudulent transactions will shift from banks to retailers if they do not have chip and Pin-enabled point of sale systems.
Safeway, which was the first UK supermarket to install chip and Pin-compliant systems in all of its stores, said moving early has given it a competitive edge.
"It was a new experience for us and our acquirer," said Jeremy Wyman, business systems manager at Safeway. "I am glad we are now ahead of the game but at times it was tough and no one should underestimate the time and resources needed."
Fashion retailer River Island said the trial revealed that some aspects of the implementation process took longer than many companies had first estimated.
For example, said Tim Barton, retail systems manager at River Island, acquirer acceptance testing - the process of ensuring that every bank's credit card works with new chip and Pin-compliant point of sale systems - takes at least six weeks.
"While the initial execution of the first cycle of acquirer acceptance testing may only take two or three days on-site and four to five days off-site for review and packaging up of test results, it is likely that acquirer acceptance testing will require a number of test cycles," he said. "Integrated point of sale retailers such as River Island should allow an absolute minimum of six weeks to complete acquirer acceptance testing."
Although January 2005 is the deadline for the liability shift, companies should have completed chip and Pin implementations by October 2004, Barton said.
"That is really the deadline when retailers should have found, installed and trained in a system that is right for their business before they begin the Christmas peak," he said. "Directly after Christmas the liability shift kicks in and from that date the retailer is vulnerable."
Barton revealed that a "major name in clothing and footwear" has taken the decision not to do anything, choosing to risk liability. "I think this is very dangerous," he said. "Fraudsters will soon suss who is chip and Pin-enabled and who is not, and fraud will simply migrate to those who are unprepared."
Although the majority of customers using chip and Pin during the Northampton trial were positive about the technology - 83% said they were in favour of the scheme - a number raised privacy fears, the report revealed.
To combat apprehension about other shoppers being able to see customers entering Pins, retailers can take a number of steps, the report said.
"Retailers should make sure Pin pads are placed as near to horizontal as possible and ensure that privacy shields are used correctly and are not removed," it said. "If customers are still apprehensive about a transaction, they should be reminded they can change their Pin at cash machines at any time."
The needs of disabled customers need to be addressed early in the process, the report warned. To help with factors such as the design of Pin pads and where they are positioned, retailers should consult the Implementation Guidelines for Retailers, produced by the Disability Rights Commission.
When discussions about chip and Pin began in 2001, retailers were sceptical about the return they would get on their £1.1bn investment, claiming that banks would be the main beneficiaries. However, following the Northampton trial, retailers have learned that the technology provides direct benefits to them, in addition to cutting card fraud.
Administration costs relating to fraud will be cut significantly because retailers will no longer need to keep till receipts. Safeway has estimated that this will lead to an annual saving of £500,000.
The sophistication of chip cards will mean retailers can support add-on services, such as loyalty cards or an electronic purse.
And the improved security the chip cards will bring will also allow retailers to expand on the use of unattended terminals, such as in petrol stations, car parks and self-scanning checkouts in supermarkets and high street stores.
Why retailers need chip and Pin
UK credit and debit card fraud reached a record high in 2002, with £424m worth of fraudulent transactions, according to UK payments body Apacs.
Without the introduction of chip and Pin technology, which requires cardholders to authenticate purchases with a personal identification number rather than a signature, this fraud would reach £1bn by the end of the decade, Apacs believes.
Chip and Pin is designed to tackle more than 60% of card fraud by targeting crime committed on counterfeit and lost or stolen cards. The UK's banks and retailers hope that chip and Pin, which is based on global Europay/MasterCard Visa specifications, will cut card fraud by at least 50%. A domestic Pin-based system in France has led to an 80% reduction in fraud since its introduction more than 10 years ago.