Fraud can target nearly any business, but card-present merchants had been able to breathe a little easier in recent years thanks to the introduction of the EMV chip. This tiny piece of hardware has gone a long way toward reducing fraud from cloned cards and other longstanding methods that exploit the vulnerabilities of older technology like magnetic strips. It’s an undeniable fact, however, that fraud is constantly evolving alongside the technologies developed to stop it. Now, retail merchants are finding themselves increasingly victimized by a new scam that uses deception to circumvent EMV chip security features.
The presence of the EMV chip verifies the authenticity of the card and can allow for customers to use encrypted PINs to authorize transactions. It's much more difficult to steal credit card information from EMV chips, and fraudsters can’t create cloned cards with valid or functional EMV chips. By requiring customers to use EMV chip-verified transactions at the point of sale, merchants can screen out many of the more commonplace forms of credit card fraud.
Unfortunately, not all merchants are willing or able to upgrade their terminals, and most newer terminals are set up to allow for transactions to be processed off of the magnetic strip to accommodate older cards without chips, or cards with malfunctioning chips. This is the loophole that fraudsters are now trying to exploit.
In this new scam, the perpetrator takes a credit card and installs a fake EMV chip in it. When they make a purchase at a retail establishment, they insert the card in the chip reader, which will report an error because the chip cannot be read. Then, they will tell the sales clerk that they’re having problems with the EMV chip on their card and ask if they can complete the transaction by swiping the magnetic strip.
If the clerk says yes, the fraudster can swipe the card and completely bypass the EMV verification.
Chargeback Gurus handled a case where a cardholder made a high-value purchase at a jewelry store, complained that the chip reader wasn’t working, and was allowed to swipe their card. A few days later, they filed and were granted a chargeback on the purchase. They walked away with both the jewelry and their money, and the store took a big hit.
The major card networks have established clear rules around EMV chips in order to encourage their use. If a merchant allows a customer with an EMV-enabled card to make a purchase by swiping the card instead of inserting the card in the EMV enabled terminal, then any chargebacks filed against that transaction will automatically be found in the cardholder’s favor.
In other words, if the merchants won’t enforce the use of anti-fraud technology at their point of sale, then the card networks will hold them liable when fraud inevitably occurs.
The best way for merchants to prevent this new scam is to be very consistent about only running point-of-sale transactions via EMV chip insertion. Allowing customers to swipe EMV-fitted cards exposes them to too much liability and risk, given that they’ll have no standing to dispute any chargebacks filed against those transactions. While it is possible to lose sales and alienate some customers by refusing to allow them to swipe their cards when the EMV reader returns an error, most customers should be understanding. They know that EMV chips protect them, too, and they will typically have another card or some other payment method available.
The consequences for merchants allowing magnetic strip transactions can be severe. For one thing, they put themselves at greater risk of becoming a target for fraud. Fraudsters communicate frequently online, and if a merchant gains a reputation for being an easy target, they can face a swarm of fraudsters seeking to take advantage of them. In addition, while friendly fraud cases can normally be contested and won, any dispute filed on a transaction where a merchant failed to use the EMV chip on a card will be decided automatically in the cardholder's favor, regardless of any evidence the merchant might have to dispute it.
Not only do these chargebacks hurt a merchant's bottom line, they also put merchants at risk of exceeding chargeback ratio thresholds. Having a chargeback rate in excess of 1% for an extended period of time can lead to merchants being dropped by banks and payment processors. Even a smaller increase in chargeback rates can result in banks demanding a higher reserve amount for a merchant account. Most merchants would do well to protect themselves by putting a blanket policy in place that they will not allow magnetic strip transactions.
Thanks for following the Chargeback Gurus blog. Feel free to submit topic suggestions, questions or requests for advice to: win@chargebackgurus.com