Litan spoke on a panel at the Food Service Tech conference in Washington on Monday where she said restaurant chain IT managers were especially concerned about the deadline. Large retailers like WalMart and Target are ready to accept chip cards, mainly, but that leaves mid-sized and smaller retailers widely unprepared.
At the conference, Litan said some restaurant chains complained they were facing a six-month to nine-month delay in getting new payment terminals certified to perform transactions. EMVCo, an alliance of Visa, MasterCard and EuroPay, which originally created chip cards decades ago, has a process for certifying terminals.
"I didn't realize there is such a backlog of people who have to be certified," Litan said.
It's unclear whether a retailer that has installed working chip-card payment terminals that are not yet certified will face liability for fraud immediately after Oct. 1, Litan said.
She also said retailers now are being told by banks and card processors to store receipts that have been signed digitally by their customers for purchases. Banks and card companies seem to prefer taking a customer's signature with a chip credit card, rather than have customers memorize a PIN to use with a chip credit card.
"Having the stores save the receipts themselves is almost like going back to the stone ages," Litan said. When Canada converted to chip cards, that nation's retailers at first required chip credit card signatures on a digital screen, but have gradually shifted to requiring a PIN code instead, Litan said.
Picard said he wished the credit card industry would push U.S. consumers to learn a PIN for credit card use, just as they have with debit cards. "Adding that four-digit code to a chip credit card would make things much more secure, so why not take the extra step to go to chip and PIN as well as convert cards to chip cards?" Picard added. "We think consumers are pretty smart and savvy at remembering a four-digit number."
Using a PIN instead of accepting a signature would protect against theft or loss of a chip card, since a thief would also need to know the PIN to buy something with the card, said Jordan McKee, an analyst at 451 Research.
"The big worry we have with the chip conversion is particularly for small and medium businesses," McKee said. "Many of them simply don't see the need for chip cards or any clear return on investment. To them, it's just the next shiny object that they constantly get pitched on."
McKee has also urged reluctant retailers to convert warning that if they keep using magnetic stripe technology, thieves will inevitably migrate to their businesses. "Those still married to magnetic stripe are the easiest to attack from the fraud standpoint," he noted.
Sign up for Computerworld eNewsletters.