EMV Adoption Slower Than Expected; Companies Should Take Steps to Mitigate Lurking Attacks

Payment card fraud did not end once the EMV, or chip, cards started being widely accepted among merchants. In fact, even though the deadline for adopting the EMV technology has long since passed (October 2015), only 44% of merchants have implemented the terminals. That’s according to a study by the management consulting firm Strawhecker Group. It’s also opposing the same group’s estimate that over half would have completed it by now.

This gives hackers an opening to attack. Therefore, companies still need to be prepared to seal up, or at least take steps to mitigate that continuing threat.

One way to do this is to implement multifactor authentication (MFA). This supplements passwords and could be accomplished by adding in text authentication codes, token technologies, or biometrics for example.

Another option is to implement point-to-point (P2P) encryption. This encrypts the data from the point of interaction, such as a swipe until it gets to the end point where it is decrypted. In other words, while it’s transitioning through networks, it is unreadable and therefore “useless” if it gets stolen.

A third way, is implementing technologies that use dynamic data points to confirm normal card use activity, rather than static. This would mean using IP Addresses or location information rather than birthdates or other information that doesn’t change.

Ideally, merchants who have not yet been able to put the EMV technology into place would implement some combination of these items to secure their systems as much as possible. However, they should also keep them in place even after they have put in the EMV terminals. More security is better than less, in this case.

What is likely to happen as more companies do adopt the chip card terminals is an increase in card not present (CNP) fraud. This is when information from the payment cards is used online. This did happen when Europe transitioned years ago. According to Experian, this increased 15% in 2016 in the U.S. Certainly contributing to this was that in the first three quarters of 2016, data breaches increased 15%, according to the Identity Theft Research Center (ITRC). Cyber thieves are also coming up with more sophisticated ways to phish, such as pretending to be Apple alerting you that your iPhone was found after you used the Find My iPhone features. Another crafty one involved capturing data that is saved in browsers for the autofill features. In addition, malware is evolving perhaps so fast that it can quickly and sometimes stealthily get loaded on to a device and steal all kinds of information. A recent Trojan that evolved from previous ones, being called Bankbot can intercept text messages (therefore intercepting text MFA) and steal sensitive information that is stored on Android devices (consider what’s saved on those these days).

So, take some time to review your organization’s security strategy when it comes to payment cards. If you haven’t gotten your EMV terminal in place, look at what other options you have to lower your risk of becoming the next company making news due to a data breach.