Pets and pilots have helped three credit unions transition to chip-based, fraud-fighting Europay, MasterCard and Visa (EMV) credit cards.

In 2010, United Nations Federal Credit Union ($4.2B, Long Island City, NY), an institution with members in more than 200 countries and territories, became the first American financial institution to offer EMV cards. Despite the fact EMV cards have been common overseas for decades, finding an EMV-enabled terminal in the United States five years ago was especially uncommon. Yet Merrill Halpern, UNFCU’s assistant vice president for card services, encountered one at his dog Snickers’ veterinarian’s office in suburban White Plains, NY.

UNFCU’s Merrill Halpern and his dog, Snickers. The pooch’s need for treats helped shed insight on EMV deployment.	The Azure chip-and-PIN card from UNFCU is one of the first of its kind issued in the United States.

The veterinarian didn’t know much about the point-of-sale machine, except that it cost more and her bank told her she had to upgrade but didn’t tell her why. The situation underscores the importance of educating members about the how and why behind these new cards and terminals as one of the first steps during a rollout.

Halpern found himself testing the technology firsthand by buying treats for Snickers at the vet’s office. Now, four years into its EMV adoption efforts, UNFCU boasts the seventh-highest credit card penetration rate among the nation’s billion-dollar credit unions, averaging 38.36% as of fourth quarter 2014 compared to its peer baseline of 18.66%.

CU QUICK FACTS

UNITED NATIONS FEDERAL CREDIT UNION
data as of 12.31.15

• HQ: Long Island City, NY
• ASSETS: $4.2B
• MEMBERS: 109,570
• BRANCHES: 3
• 12-MO SHARE GROWTH: 5.27%
• 12-MO LOAN GROWTH: 6.68%
• ROA: 0.58%
• Credit Card Processor: First Data
• Credit Card Processor (3rd Party Managed): The Members Group
• Debit Card Signature Processor: First Data
• Debit Card Pin Processor: First Data

Meanwhile, pilots, flight attendants, and their family members have been a driving force for the early testing of EMV cards at Alliant Credit Union ($8.1B, Chicago, IL). This cooperative still serves a large number of United Airlines employees and thus had access to a small group of frequent flyers who started testing EMV cards in the United States as well as abroad in January 2014.

Finally, Genisys Credit Union ($1.7B, Pontiac, MI) worked closely with CO-OP Financial Services and MasterCard to pilot an EMV rollout ahead of the full-scale launch in January 2015. The credit union is now working on adding the chip to debit cards.

Step 1: Decide When To Issue EMV Cards

On Oct. 15, 2015, regulation will dictate that the least-secure piece of the payment rail in a fraudulent transaction will bear the cost. The move is designed to prod card companies, financial institutions, and merchants to deploy more secure technology and shield themselves from risk. Yet regulation is hardly the only factor at play here.

The liability shift did play a part in our decision to go with EMV when we did, but we’re really focusing more on doing our part to help prevent card breaches says Maria Donoulis, card services manager at Alliant.

CU QUICK FACTS

ALLIANT CREDIT UNION
data as of 09.30.14

• HQ: Chicago, IL
• ASSETS: $8.1B
• MEMBERS: 283, 085
• BRANCHES: 14
• 12-MO SHARE GROWTH: -1.42%
• 12-MO LOAN GROWTH: 15.87%
• ROA: 0.87%
• Credit Card Processor: The Members Group
• Credit Card Processor (3rd Party Managed): None
• Debit Card Signature Processor: Visa DPS
• Debit Card Pin Processor: Visa DPS

Like most issuers, Alliant and Genisys are issuing EMV cards to new accounts and current accounts with expiring cards. The credit unions could be more aggressive about replacing mag-stripe cards on current cards, but they’re watching merchant adoption.

We can easily make a shift to an all-EMV card base if merchant adoption increases before the liability shift date says Genisys CEO Jackie Buchanan.

Such a pickup in momentum is not unlikely as MasterCard expects to see half of all debit and credit cards as well as half of all terminals in the U.S. to be EMV-enabled by the end of the year.

Larger retailers are [adopting] earlier, but we’re seeing quite a number of midsize and smaller retailers migrating as well says Carolyn Balfany, the card brand’s group head for U.S. Product Delivery.

Step 2: Choose Between Signature And PIN

EMV terminals communicate with EMV cards to authenticate the user information stored in the embedded chips. After the terminal reads the card, users authenticate either with a signature or a personal identification number (PIN) before they make their transaction.

CU QUICK FACTS

SECU OF MARYLAND
data as of 09.30.14

• HQ: Pontiac, MI
• ASSETS: $1.7B
• MEMBERS: 149,121
• BRANCHES: 14
• 12-MO SHARE GROWTH: 5.54%
• 12-MO LOAN GROWTH: 14.04%
• ROA: 1.68%
• Credit Card Processor: CO-OP
• Credit Card Processor (3rd Party Managed): CO-OP
• Debit Card Signature Processor: CO-OP
• Debit Card PIN Processor: CO-OP

UNFCU chose PIN cards, Halpern says, because they’re more secure than the chip-and-signature cards. The Obama administration apparently agrees, issuing an executive order in October that mandates their use on government payment cards.

However, chip-and-pin cards are also the more expensive of the two options. In addition, American consumers are more accustomed to signing for credit cards and using PINs with debit cards.

Because these are credit cards we chose chip-and-signature says Michelle Mattson, vice president of remote delivery channels at Genisys, which has approximately 14,500 open credit card accounts. In the early stages of EMV adoption in the U.S., we felt cardholder familiarity was an important factor in usage and adoption.

A final variable is whether to add contactless functionality to the cards via another chip, an option that increases cardholder convenience yet also raises the cost of the card.

At Alliant, Donoulis says, We went with chip-and-signature and we decided to not add the NFC chip while we wait to see how the payment industry will react to contactless transactions like Apple Pay.

Next: Decide On Deployment

Step 3: Decide How To Deploy EMV Cards

Halpern says other credit unions have sought UNFCU’s advice frequently in the five years since it went live with EMV cards.

Don’t be afraid of the initial complexity he advises. There are a lot of resources available from the card associations, manufacturers, and networks. They’re staffed to support this effort.

Testing and retesting with all sorts of hardware and in all possible environments is also highly advised, as is keeping it simple.

We recommend avoiding making the initial EMV launch more complicated than necessary says CEO Buchanan at Genisys. There are a variety of choices that can end up making the card non-standard. This would complicate testing and create unnecessary costs.

Step 4: Understand The Hidden Costs

As demand for EMV grows, so do the wait times for plastic card stock. Alliant planned on the delivery of its customized EMV cards for its select employee groups (SEGs) to take eight to 10 weeks, but delivery is taking much longer.

But EMV hidden costs come in the form of time and money.

We knew we’d have to pay more for this plastic, so once board approval came through we included that into our budget model for EMV cards Donoulis says.

We recommend avoiding making the initial EMV launch more complicated than necessary.

UNFCU hasn’t adjusted its pricing for the EMV deployments. The New York-credit union plans to make up for the investment by avoiding card-present fraud losses, which are down approximately 20% to 30% since implementation, Halpern says.

Genisys has budgeted for an increase in production costs as well as an incremental increase in transaction processing expenses, Buchanan says.

Because the fraud savings may take some time to realize, we didn’t anticipate these in our ROI calculations on the new EMV program she adds.

Step Five: Plan For Debit And Card-Not-Present Scenarios

Even with EMV-equipped credit cards, credit unions need to consider two other factors in their card defense strategy.

First, card-not-present fraud remains a concern in today’s world of massive card breaches. The growth of Apple Pay and other tokenization options are expected to help, but the future security of this space remains largely an unknown.

Because this cost would have continued to be felt on a non-EMV card, we didn’t use this as a criteria in making our decision to implement EMV says Buchanan at Genisys.

Second, the larger number of debit cards versus credit cards in circulation, plus application identifier (AID) chip certification and the shakeout around the number of competing processing networks required under the Durbin Amendment have created a waiting game, as has the development of EMV-enabled POS terminal fleets.

Alliant and Genisys are planning to launch EMV debit cards this year and expect at least one common challenge will overlap with their credit card efforts: member education.

We need to be prepared for the questions once those terminals are turned on Donoulis says. That’s where the experience will change.

The Cards Are Coming

A MasterCard executive shares tips to ease members’ transition to EMV cards.

Retraining consumers to put cards into point of sale machines and wait for authorization before entering a PIN or signing is a multifaceted process, but it’s not impossible, says Carolyn Balfany, group head for U.S. product delivery for MasterCard International.

These aren’t monumental changes Balfany says. They’re just focused messages that need to be present.

Here, she provides tips to help credit unions get started.

• Make it clear the EMV card replaces the old card for an existing account and is not a solicitation for a new account.
• Use simple images; they are the most effective way to explain how the new credit cards physically work.
• Provide clear explanations of the security benefits of the new cards.
• Tell members that merchants must have the chip-enabled terminals for EMV cards to be effective.
• Provide on-demand capabilities so members can immediately replace a card if they lose it or if there is a breach.
• Explain that cards still have magnetic stripes for now and will indeed work on non-EMV enabled terminals.