Chip-card security remains scarce in wallets

Rob Pegoraro | Special for USA TODAY

Q. At what point can I expect to have those EMV chips on all of my credit cards? And when will I be using those chips in any of my shopping?

A. The answer in each case: a great big "it depends."

The odds of your credit card including the tiny EMV chip that encrypts a transaction and prevents the cloning of the card are not as good as you might hope. Last August, an industry group called the Payments Security Task Force reported that nine of the country's top card issuers would have one in two cards chip-enabled… by the end of 2015.

Whether yours will be among them can vary based on the company or companies behind the card, its age, whether it's a business or personal card and if you've asked for an EMV version.

("EMV" stands for "Europay, MasterCard and Visa," the original three developers of this standard, but any card can support it.)

To take one example from my own wallet: While JPMorgan Chase was one of the earliest issuers to support EMV, the airline co-branded business Visa I have with them still doesn't come with a chip.

The list of chip-enabled cards on Chase's site doesn't list the personal version of this card either--but since February, cardmembers have been reporting that an EMV version is available on request.

Then there's actually using a card's chip in a U.S. store. Many already have EMV-capable credit-card terminals, which you can identify by a card-sized slot at the bottom in addition to the standard magnetic-stripe reader.

But if you try dipping a card into that slot instead of swiping at the right, most of the time nothing will happen because the retailer hasn't turned on that feature. A crowdsourced database only lists four compatible stores in Washington, two of them Walmarts that benefited from that retailer's early support of EMV.

If you don't want to use your card's easily compromised magnetic stripe, you'll have better luck using an NFC-payments app on your smartphone such as Apple Pay or Google Wallet -- I've yet to see a credit-card terminal with an EMV slot that didn't also feature an NFC reader.

At a seminar in Washington Thursday organized by the Electronic Transactions Association and Underwriters Laboratories, experts emphasized that the October 1 "EMV deadline" is just a shift in liability. After then, a shop that doesn't take EMV cards will automatically be on the hook for any fraudulent transaction, but some smaller merchants may decide the cost to upgrade their systems isn't worth what they see as a small risk.

The participants also agreed that EMV can still leave a card number exposed for fraudulent use online or over the phone. To fix that, merchants need to take extra steps like scrambling card numbers stored in their systems and encrypting data as it travels through them.

And because most U.S. EMV cards only require a signature to confirm a transaction instead of the personal identification numbers demanded in other countries' implementations, somebody can still steal your wallet and go on a spending spree with your card until the issuer spots the unusual transactions or you report the theft.

These chip-and-signature cards can also pose problems for U.S. travelers overseas when they try to use them at kiosks designed for "chip-and-PIN" cards. Sometimes a chip-and-signature card works fine, and other times it gets rejected outright.

Chip-and-PIN cards, however, can themselves become vulnerable if their users decide they have one too many numbers to remember. Said Maarten Bron, director of innovations for transaction security at UL: "You don't know how many people use the signature panel to write down the PIN."

Tip: Cheaper international roaming at Sprint -- in 15 countries

If you use Sprint, have a world-capable phone (that's almost all of its smartphones) and have foreign travel ahead, you can evade its usual steep roaming rates by signing up for the "International Value Roaming" it introduced earlier this month. This cuts voice-calling costs to 20 cents a minute and allows free text messaging and slow 2G data service.

But unlike T-Mobile's otherwise comparable offer, Sprint's only covers 15 countries: Argentina, Brazil, Chile, Costa Rica, El Salvador, Guatemala, Germany, Japan, Mexico, Nicaragua, Panama, Russia, Spain, South Korea and the United Kingdom. And if you go outside them with International Value Roaming active, your phone becomes a WiFi-only device unless you first switch your phone back to its standard roaming.

If your Sprint account's been in good standing for 90 days, you'll do better having its SIM (Subscriber Identity Module) card slot unlocked for international use, then buying a cheap prepaid SIM once you arrive.

Rob Pegoraro is a tech writer based out of Washington, D.C. To submit a tech question, e-mail Rob at rob@robpegoraro.com. Follow him on Twitter at twitter.com/robpegoraro.