Noting that the U.S. is the last industrialized country to adopt chip technology, it should make sense to add PIN protection. "We have a chance, but are going halfway, which is really unfortunate," Garner said.
Even some large retailers in her advisory group are not fully ready for the Oct. 1 deadline, she said. Some others, however, have activated chip card readers, and a few have added a requirement that consumers add their own PINs to make purchases. Still others are investing in advanced technology such as tokenization and end-to-end encryption to their chip card systems for more rugged security.
Analysts have said that banks are not pushing chip and PIN technology because banks feel it will be too difficult for consumers to learn a four-digit PIN for credit purchases. But Duncan said consumers have used PINs with debit cards for years without difficulty.
Some banks and credit card officials have said they prefer to wait and see customer buying behaviors with chip and signature approaches. Banks will ultimately be responsible for deciding whether to move from chip and signature to chip and PIN, as has happened in Canada in recent years, analysts have said.
It would make more sense for banks to promote PIN security along with the embedded chip cards, since conversion to the chip technology requires merchants to invest in millions of new card readers, which can cost up to $600 apiece, retailers said.
Retailers also bear the burden of explaining how to use a chip card to consumers, so why not introduce PINs for credit cards at the same time, Duncan asked. It typically takes a few seconds for a chip card reader to read a credit card once it is inserted into the reader, which is different from sliding a magnetic stripe card into today's readers.
Industry experts estimate there are 12 million payment terminals in the U.S., and Duncan estimated just 40% are upgraded so far. With the cost of new terminals and related software updates, he said retailers are spending "tens of billions of dollars" to make the transition, mainly to the benefit of banks which are now paying for fraudulent uses of cards and want to reduce that cost.
Duncan also said the overall conversion to chip cards, with banks sending out new cards, along with new terminals and related duties, could cost companies $30 billion to $35 billion.
Garner also said a majority of the advisory group's members face a backlog in getting access to new chip card readers or to get the new readers certified by EMVCo and others. Certification is needed to ensure that payment terminals work with the new cards and various payment networks.
Sign up for Computerworld eNewsletters.