Walmart: EMV Signatures Are Worthless

Walmart’s top payments executive told a conference last week that letting banks issue EMV credit cards without PINs makes a mockery of EMV security, CNN Money reported.

“Signature is worthless as a form of authentication,” Walmart senior VP and assistant treasurer Mike Cook said during a presentation at the Electronic Transaction Association’s Transact conference in San Francisco. Unlike EMV rollouts in Europe, in the U.S., banks are being allowed to issue EMV credit cards that only require a signature to use instead of a PIN. Debit cards, which already use PINs, are expected to continue to use PINs in their EMV versions.

“If you look at the Target and Home Depot breaches,” Cook added, “not a single PIN debit card needed to be reissued in those breaches. The card number was worthless to the individual thief and fraudsters, because they didn’t know the PIN.” PINs would protect U.S.-issued credit cards the same way, and banks should use them for all cards, Cook said.

He told a CNN Money reporter, “The fact that we didn’t go to PIN is such a joke.”

Most banks aren’t planning to add PINs to their EMV credit cards, although millions of EMV credit cards issued to government employees will use chip-and-PIN under a White House plan announced last fall.

But card brands Visa and MasterCard, which are allowing banks to issue PIN-free credit cards, argue that the security improvements aren’t worth the high cost of retrofitting credit card-processing systems. “We don’t see a need for it,” Visa VP of risk products Stephanie Ericksen told CNN Money, noting that card counterfeiting makes up the largest share of card fraud, and it will be harder to create counterfeit EMV cards, even if they use signatures for authentication.

Ericksen added that chip-and-PIN “will have a shorter shelf life. We’re moving to new technologies and innovation,” she said, including point-to-point encryption and the tokenization that underlies Apple Pay. Both those technologies hide actual payment-card numbers from both retailers and cyberthieves, and banks and card brands hope those technologies will become mainstream payment methods within the next few years.