New credit-card security takes hold slowly

At Best Buy and other stores in Kalispell, shoppers are enjoying a new level of credit-card fraud security. Rather than swiping their cards, customers insert them into the card-reading terminal and remove them after a few seconds and a prompt from the machine.

Best Buy is one of a growing number of Kalispell retailers with the new system. Store Manager Bob Bridges said the tech retailer made the transition to new payment method in early October. The change hasn’t produced any problems yet, he said; it’s simply a matter of learning a new system.

“It’s just a learning curve on both sides of the counter,” Bridges said.

The U.S. credit-card security standard is finally catching up with the rest of the globe via microchip technology that has been available in Europe for nearly 20 years.

Revamped credit card terminals now allow for a “dipping” method, where customers insert their chip card rather than swipe the magnetic strip. The strip, which contains the cardholder’s account information, has been the main pathway to fraud when hackers breach account information.

EMV — short for Europay, Master Card and Visa — cards are meant to curb data breaches and account information theft by creating a unique transaction code at each purchase. The code is later translated between the business and its bank, and then becomes useless in obtaining information on the account.

While the liability has never fallen on the cardholder, as of Oct. 1 it shifted from the bank to the retailer that has yet to install EMV terminals.

Bridges said because Best Buy is a major national retailer, the corporate office made early strides in updating its system.

Vic Direito, store manager at Home Depot in Kalispell, echoed those comments.

“When our company rolls something out, it hits pretty fast,” Direito said.

Home Depot installed the new terminals about three months ago, according to Direito. He said the transition only took a day or two to install the terminals and software — the Home Depot corporate office did the heavy lifting in connecting the payment processor and the banks with the new system.

Some smaller retailers also have made the switch to card-reading terminals.

Tim Miller, store manager at Army Navy in Evergreen, said the retailer had the terminal installed and updated in mid-November by its payment processing company. He said the transition was done in a day and hasn’t caused any complications between Army Navy and its bank or customers.

“They programmed it, we just had to plug it in,” Miller said. It was that simple, he said.

Mark Blasdel, the owner of Vista Linda Catering, said his restaurant and catering company has had the EMV readers for more than a month.

The initial installation took about eight days; after he couldn’t get the software to install in his system, the processing company representative took the machine home to install it himself.

Aside from that hiccup, it has been a smooth process since, Blasdel said.

While retailers and banks around the globe are finally catching up with Europe’s credit-card security measures, Northwest Montana isn’t exactly on the leading edge.

In Kalispell, several businesses have received the terminals but haven’t installed the software to operate with chip cards.

URM, a grocery store chain based in Washington that does payment processing, operates with several stores around the Flathead Valley.

In 2013, URM suffered a massive data breach involving Rosauers, Super 1 Foods, Harvest Foods and Family Foods stores across Western Montana. Thousands of customers’ accounts were compromised and area banks took the hit.

URM has placed the new EMV terminals at its grocers in the Flathead Valley area, but the stores are still waiting for the new software to be installed to make the chip-card readers operable.

NXGEN Payment Services, a global payment processing company based in Whitefish, has been using EMV terminals for nearly 10 years with retailers in Europe, Canada and Mexico.

NXGEN President Giuseppe Caltabiano said that most payment processing companies waited too long before the transition. NXGEN began rolling out the new terminals to U.S. retailers beginning in January 2014.

Almost two years later, most of NXGEN’s 15,000 retailers are successfully running the new terminals and software. Only a few hundred around the country are still waiting.

“If you have 10 customers, you can update them all in a day. But that’s not the case,” Caltabiano said. “All the American players learned it in a simulated manner, but when the rubber hits the road, problems happen.”

Travis Taylor, chief executive officer of Glacier Payments, another global processing company based in the Flathead Valley, said local merchants actually may be resisting the cost of a new system while some processing companies might not be reaching out to their retailers to educate them on the new system. Glacier Payments has already completed upgrades to all of its retailers.

“Merchants may not want to adapt to the changes just yet,” Taylor said. “We’ll most likely see these merchants adapt as they begin to incur the cost of fraudulent transactions.”

Both Caltabiano and Taylor said it’s likely there are less than a dozen major processing companies serving merchants in the Flathead Valley. These major processing companies might not have reached Montana in transitioning the thousands of businesses across the country.

While retailers wait on new machines, many customers have yet to receive their new EMV cards.

Marcia Johnson, chief of operations officer at Glacier Bancorp, said the six-state financial institution hasn’t begun reissuing cards to its 55,000 cardholders.

“The change is minimal to us at this point because we’re pretty much liable in most cases when there is fraud,” Johnson said.

Johnson said the cost of issuing new chip cards is much higher than the cost of the regular magnetic strip cards.

Glacier Bancorp, she said, has been waiting to roll out the new cards until next year when the company undergoes a major computer systems upgrade to put all 13 divisions on the same platform.

This will all occur in the spring, Johnson said, and Glacier Bank customers will be the first to receive cards. The entire process is expected to last from February to October.

Steve Turkiewicz, president of the Montana Bankers Association, said liability only falls on retailers who have not updated their payment processing system. Banks are taking on their own complications from the transition, which has contributed to the slow turnover.

“Banks have to pay to reissue chip cards and those costs can be significant,” Turkiewicz said. “They willingly do so to protect their customers, but it would be nice if the retailers would do their part by both turning on the chip machines and, more importantly, locking down their computer systems to protect against breaches in the first place.”

Turkiewicz said the transition was fully expected to take some time to complete.

“When there are over 300 million consumers, 8 million-plus merchants and tens of thousands of financial institutions and processors, it takes a while to implement a change,” he said. “It’s important to remember that this is a process, not an event.”

The transition was expected to take a few years. The Montana Credit Union Network published a document where three different national studies suggested the transition wouldn’t be fully completed until 2018.

Brad Griffin, president of the Montana Retailers Association, said the process has been clunky for retailers as well.

“There was just a gap in communication and there’s a lot of retailers now that don’t have the new terminals,” Griffin said. “I don’t know where the breakdown was — whether it’s at the manufacturing level, the banks, the companies who process the transactions and issue the machines or if it’s all the above.”

Griffin said it’s obviously a security upgrade from which cardholders, banks and retailers could benefit. The transition should have been fairly simple, he said, with the biggest change being the customer’s pay method.

“Let’s go at least as far as the Europeans and Canadians have gone,” Griffin said. “We’ve got a 1980s method now meshed with state-of-the-art technology.”

Griffin said he hasn’t heard of any retailers holding out on the transition until after the upcoming holiday shopping season, but that’s a possible reason why merchants don’t want to slow lines down in their stores.

He said it’s likely large incorporated businesses such as Best Buy that will be among the first to complete the update.

Despite the measured leap into the global standard of credit-card security, the EMV cards are not 100 percent secure.

Johnson, from Glacier Bancorp, said customers should remain diligent is monitoring their own accounts and being wary of unsecure online shops.

“Shopping online will continue to be a risky area,” Johnson said. “So it’s important to know they’re legitimate websites. And always keep an eye on the account.”

Reporter Seaborn Larson may be reached at 758-4441 or by email at slarson@dailyinterlake.com.