Certifiable

A scene in an episode of the HBO series Vinyl likely had MI retailers laughing. James Jagger – yes, the son of Sir Mick – plays the leader of a punk band in New York circa 1973.

He’s strumming a Les Paul in a corner of a nondescript music store as a second guitarist picks up his pattern from across the room on a Telecaster, its price tag dangling, and begins jamming. (We know this is not Manny’s because within seconds Stuart would have been yelling at them to knock it off or buy something.) When the Tele player asks the store clerk if he has one with a rosewood fingerboard, the clerk grumpily stalks into the back to search one out. Guitarist Number Two then bolts out of the story clutching the Fender, followed by Jagger and the Gibson.

Not too many MI storeowners, then or now, would have left a couple of unknown kids alone in the shop like that. However, MI retailers could already be feeling the heat from another kind of insidious situation related to theft, and this one’s not being perpetrated by some kids.

E.M.V.

U.S. retailers were supposed to have implemented the E.M.V. POS payment system as of October 1 last year. E.M.V., which stands for Europay, MasterCard, and Visa, the technology’s early advocates, embeds a microchip in the card that is putatively more secure than the easily accessed magnetic strip on credit cards. The chip reduces fraud because it contains a cryptographic key that authenticates the card as a legitimate bankcard and also generates a one-time code with each transaction.

It’s been slow going – according to a CardHub survey in March, 42 percent of retailers have not updated the terminals in any of their stores. However, aside from the cost of converting their POS systems to the E.M.V. technology, retailers are discovering another problem: every step of the E.M.V. system – each hardware terminal and each payment network, like Visa or MasterCard – has to be separately certified. To get that certification, businesses have to work with a highly constricted number of payment processors like First Data and Vantiv. The problem is that the certification process is backed up worse than airplanes over O’Hare in December. But without that certification, that investment in the new POS system is worthless.

Complaints have been coming especially from mid-sized retailers, according to the New York Times, which also points out that the same banks that process credit-card payment have significant equity stakes in those same certification service providers; for instance; Fifth Third Bank has an approximately 18 percent stake in Vantiv; Bank of America’s processing arm, Bank of America Merchant Services, is a joint venture between the bank and First Data.

Here’s where that October 1 conversion deadline becomes ominous. It was at that point in time that the onus of covering fraudulent charges shifted from the banks that processed the payments to the retailers who accepted them. It leaves small and mid-sized retailers – like most MI stores – in the position of being on the hook for the kind of fraud that the big banks used to have to eat while those same banks, indirectly or otherwise, are now part of the problem that’s slowing the integration of the new payment system.

Real Costs

The costs are very real. A study released earlier this year, by IBM and the Ponemon Institute, determined that the average total cost of a data breach increased 23 percent over the past two years, to $3.79 million, and that the average cost paid for each lost or stolen record containing sensitive and confidential information increased six percent, jumping from $145 in 2014 to $154 in 2015. The retail industry’s share of average cost increased most dramatically, from $105 last year to $165. The shift in payment processing, which will see its first full year of implementation this year, will likely see retailers’ share of that increase again.

There is at least one class-action lawsuit in motion at the moment, pitting retailers against banks and certification services, asserting that the major card networks have deliberately created impossible goals for merchants to achieve in a short period of time. Banks, however, contend that retailers waited until the last minute to make the switch to E.M.V., overwhelming the certification process. Assuming some validity in both arguments, the way forward for MI retailers is to acknowledge that payment processing has entered a fluid stage, which is ultimately good, because that’s where the fraudsters have always been anyway.