The deluge of data breaches in the past two years is prompting many banks and credit unions to issue a different type of credit and debit card.

The more advanced plastic contains EMV chips – named for Europay, MasterCard and Visa, the first three companies to develop the technology.

"It is a much more secure method of payment," said Melissa Shaw, spokeswoman for 3Rivers Federal Credit Union. Hacker attacks, she said, are "all related to that magnetic stripe on the back" of the cards.

Even so, experts say the EMV-embedded cards won’t eliminate all identity theft.

The technology can’t be used everywhere either. Many transactions over the next few months will have to be completed by magnetic stripe because some retailers have yet to invest in new credit card terminals.

Retailers and banks will steadily migrate to EMV before October, when liability for fraudulent transactions shifts from banks to retailers if the sale was paid for with a chip-embedded card but was processed using magnetic stripe because the merchant didn’t have a sales terminal capable of reading an EMV chip.

Card issuers, including Visa and MasterCard, adopted the policy because, they said, retailers under those circumstances would be the weakest link in the security chain. MasterCard began warning merchants about the timeline three years ago.

Making the switch

Some northeast Indiana financial institutions are already providing cards with EMV chips.

3Rivers replaced all members’ Visa-brand credit cards in April with MasterCard-brand credit cards bearing both magnetic stripes and EMV chips.

Credit union officials researched available offerings and chose MasterCard for a few reasons, including the company’s technology emphasis, customer rewards program and cancer research donations, Shaw said.

The Fort Wayne credit union has issued 15,398 credit cards to its 69,221 members.

Old National Bank plans to replace all customers’ debit cards with EMV chip cards in stages by the end of the year. The Evansville bank uses a third-party provider for credit cards.

Lake City Bank is replacing customers’ credit cards throughout this year as they expire. The Warsaw bank is replacing all customers’ debit cards this summer.

Mary Horan, Lake City’s spokeswoman, said the bank’s credit card holders can request an EMV-equipped replacement credit card before the scheduled expiration-related replacement would normally be mailed.

Chase is issuing debit and credit cards with EMV chips throughout this year. Any customer who doesn’t want to wait can request one be sent sooner, spokeswoman Christine Holevas said in an email.

How it works

When a consumer swipes a credit card through a reader, the information on the magnetic stripe is recognized and transmitted through the network provided by the retailer’s financial institution.

That personal information includes the names of the bank and the cardholder, the card number and the amount of the sale.

Even though approval is transmitted back to the checkout in mere moments, the actual transaction is typically not sent to the merchant’s bank until the end of the day by an employee "sitting in a back room eating Doritos," said 3Rivers’ Jim Johnson, vice president of member services.

That process of sending all the day’s transactions to the bank at once is called "batching."

With EMV chips, personal data isn’t stored by retailers’ computers – even for those few hours – so it can’t be stolen, Johnson said.

Credit or debit cards with EMV chips are inserted into a slot in the front of the chip card reader. The card is left in place until the purchase is complete.

"If a (personal identification number) or signature is required, just enter, and always remember to take your card when you’re done," Chase’s Holevas said.

Each time a chip-enabled transaction is processed, the system generates a unique code that can’t be reused. That one-time code is what’s stored in the merchant’s computer system, not the account number and cardholder’s name.

The cardholder also must validate his identity by entering a PIN or signing for the purchase.

Evolving technology

During the transition, cards need both stripes and chips until all retailers install the technology needed to read EMV cards.

That leaves debit and credit cards vulnerable to having data stolen by skimming devices, which are sometimes installed on ATMs or checkout terminals to steal identifying data off magnetic stripes.

Identity thieves then copy the stolen data onto another magnetic stripe and use that plastic card to buy large amounts of goods they can sell for cash.

"Chip-based cards are designed to be far more expensive and difficult for thieves to counterfeit than regular credit cards that most U.S. consumers have in their wallets," Brian Krebs wrote on his website, Krebs on Security.

He is a former journalist who has become a technology security expert respected by financial services professionals, 3Rivers Federal Credit Union officials said.

The U.S. lags the rest of the developed world in the transition.

Chip technology has already proven successful in reducing fraud in more than 130 countries around the world, Holevas said in an email. EMV chips are the standard in Canada, Mexico, South America, Europe and Asia, she said.

Experts have estimated that half of credit cards, debit cards and terminals in the U.S. will be chip-enabled by the end of this year. Avivah Litan, a Gartner Inc. analyst, predicted it will be 2018 before all magnetic stripes have disappeared from cards.

Walmart, the world’s largest retailer, installed EMV-enabled terminals at all Walmart and Sam’s Club stores in the U.S. eight years ago, spokesman Randy Hargrove said last week.

The terminals located in stores that serve international travelers were enabled some time ago. The rest went live for EMV chip transactions on Nov. 1, he said.

All Walmart- and Sam’s Club-branded credit cards include EMV chips, leading to a growing number of store transactions that rely on the technology, Hargrove said. He didn’t know the percentage of Walmart transactions that use EMV chips.

sslater@jg.net