Target Breach’s Impact On Debit Issuers Tallied

A newly released debit card issuers study paints a vivid picture of the impact the Target breach had on their card programs last year.

Among large banks in 2013, 10 percent of their cards on average were affected by the breach reported in December, while 14 percent of cards at credit unions and 9 percent of cards at community banks were affected, according to the 2014 Debit Issuer Study commissioned by Discover Financial Services’ Pulse network. In all, 84 percent of financial institutions reissued all exposed cards in response to the breach, compared with only 29 percent that typically reissue all exposed cards as a standard response to breaches, Pulse said.

Seventy-one financial institutions – including large banks, credit unions and community banks – participated in the study. Of those institutions, 29 had at least $10 billion in assets, making them subject to Reg II’s (the Durbin amendment’s) debit-interchange cap. Collectively, the participants issue some 142 million debit cards, representing approximately 45 percent of total U.S. debit transactions. The institutions also operate about 76,000 ATMs.

The Target breach helped propel the market toward adopting cards that comply with the EMV chip card standard, 86 percent of financial institutions that responded to the survey stated they plan to begin issuing EMV cards in the next two years, a significant increase from 50 percent who said so in 2012.

The Target breach affected every financial institution that participated in the study, causing fraud loss rates to increase in 2013 and compelling issuers to re-evaluate their strategies for improving card security in 2014, the study found.

Overall, 14 percent of all debit cards were exposed in data breaches in 2013, compared with 5 percent in 2012. The resulting 2013 fraud losses to financial institutions amounted to 5.7 basis points for signature debit and 0.7 basis points for PIN debit, Pulse said. Compared with the prior year, PIN-debit fraud loss rates remained constant at an average of 0.3 cents per transaction while signature-debit loss rates increased to 2.2 cents per transaction, up from 2 cents.

Issuers also reported on fraud loss rates by payment usage point. International transactions caused loss rates of 51 basis points, compared with 8 basis points for domestic card-not-present transactions and 2 basis points for domestic card-present transactions.

The various data breaches, which also affected Neiman Marcus and some other retailers, heightened attention to issues of debit card security. Before the Target incident, many financial institutions were hesitant to commit to EMV because of uncertainty around retailer adoption of chip card point-of-sale terminals, questions about the viability of the business case for migrating from magnetic stripe cards to chip cards, as well as unresolved issues related to regulation and support for merchant routing choice.

In many ways, the Target breach served as a catalyst for the resolution of these issues. Also motivating issuers is a mandate the major card networks set that takes effect in October 2015, when merchants unable to accept a presented EMV card assume liability for the transaction. Among large banks, 76 percent expect to begin issuing EMV debit cards in 2015, while 78 percent of credit unions and 52 percent of community banks intend to do so.

“In the wake of several high-profile data breaches, the industry has come together to look for solutions to increase security and advance EMV implementation,” Steve Sievert, Pulse executive vice president of marketing and communications, said in a statement. “While PIN debit remains the most secure payment method in the market, this year’s study confirms the industry is reaching a tipping point toward EMV. The majority of financial institutions plan to issue EMV debit cards starting in 2015.”

Migration to EMV debit cards will span approximately three years, with many issuers attempting to provide chip cards to their international travelers and heavy debit users in advance of the liability shift, Pulse said. The most common strategy among financial institutions is to provide account holders with an EMV debit card as part of their regular card reissuance cycle. The survey did not delve into whether issuers would support contact, contactless or dual-function EMV cards, or whether they would support PIN-based or signature-based chip card authentication.

Interest in prepaid gift cards showed a decline, as 67 percent of issuers offered such cards last year, down from 73 percent a year earlier. Interest in general purpose reloadable (GPR) cards also dipped, to 33 percent of issuers from 36 percent, as did payroll cards, which fell to 23 percent of issuers from 27 percent. Projected sales growth for GPR cards was 20 percent for 2014, down from 55 percent in 2012.

Among other key findings in the debit issuer report:

• Transactions per active consumer debit card increased to 20.1 per month from 19.4 in 2012, while monthly transactions per active business card per month grew to 14.5 from 13.5.

• Continuing historical trends, signature debit declined in share of total transactions between 2012 and 2013, falling to 62 percent from 64 percent for consumer cards, and to 70 percent from 72 percent for business cards.

• The impact of the cap in debit interchange is affecting debit card rewards programs as issuers look for funding alternatives. Rewards through merchant offers reached 55 percent of issuers, up from 52 percent in 2012 and 38 percent in 2001. Points-based programs, however, fell to 39 percent of issuers from 52 percent in 2012 and 62 percent in 2011.

• In 2013, ATM withdrawals reached a study-wide low of 2.3 per active card per month. Large banks expect ATM transactions to continue to decline, but community banks and credit unions project increased ATM transaction volume as they seek to drive traffic from the branch to the ATM.