Krebs on Security had an excellent article on this subject in late 2014 (right as the US was starting to transition to chip-and-signature). A few initial details:
- US Point of Sale (POS) systems do generally support chip-and-pin. The issue isn't technology - that technology (PINs) has been in the US for years, allowing deibt cards to be used at POS systems. Adding the chip acceptance was the difficult technological step. If you're European, you may have to enter a PIN at the register.
- Chip and Pin versus Chip and Signature versus Signature priority are chosen by the issuing bank. US banks have all chosen Chip and Signature priority over Chip and PIN. A few banks do allow you to set up a PIN in case you travel to Europe and need to use a machine that is uses offline authentication (which likely will only accept a PIN).
Now - as far as why, Krebs' article notes a few reasons.
First off, Chip and PIN doesn't protect against a very common kind of fraud, nor a very expensive one. The only advantage a PIN gives you is the protection against physical theft. That doesn't happen very often, and when it does happen it often is reported quickly; so it's not very expensive to the banks. Attrition (people choosing to use a different card or no card at all) is a risk when moving to a different technology, and the attrition from requiring PINs may well cost the banks more than the fraud from stolen cards.
The PIN only addresses fraud when the card is lost or stolen, and in the U.S. market lost-and-stolen fraud is very small in comparison with counterfeit card fraud.
Second, Chip and PIN doesn't tend to protect against fraud for very long; criminals adjust their methods, and it ends up being equivalent to pre-Chip and PIN.
Also, as we looked at other geographies — and our research has substantiated this — as you see these geographies go chip-and-PIN, the lost-and-stolen fraud dips a little bit but then the criminals adjust. So in the UK, the lost-and-stolen fraud is now back above where was before the migration.
Third, adding PINs gives thieves another avenue to steal money: ATMs. While many cards have PINs now that allow you to withdraw money, most people don't use them - and so can't have their PINs stolen. Withdrawing money from an ATM can be a more significant loss for the bank. In addition, ATMs don't generally use Chips right now in the US, meaning if the PIN can be stolen (through social engineering, a hack, etc.) it can be combined with magnetic stripe data to steal money from ATMs.
Most card issuing banks and Visa don’t want PINs because the PINs can be stolen and used with the magnetic stripe data on the same cards (that also have a chip card) to withdraw cash from ATM machines. Banks eat the ATM fraud costs. This scenario has happened with the roll-out of chip cards with PIN – in Europe and in Canada.
Fourth, issuers don't want to change two things at once; they'd prefer to roll this out in steps. Some issues in Canada's rollout may have been informative to this.
“We don’t really think we can teach Americans to do two things at once. So we’re going to start with teaching them how to dip, and if we have another watershed event like the Target breach and consumers start clamoring for PIN, then we’ll adjust.” So the issuers I spoke with wanted to keep it simple: Go to market with plain vanilla, and once we get this working, we can evaluate adding some sprinkles and toppings later.
And Canada's issues:
There was a Canadian issuer that — when they did their migration to chip — really botched their chip-and-PIN roll out, and consumers were forgetting their PIN at the point-of-sale. That issuer saw a significant dip in transaction volume as a result. One of the missteps this issuer made was that they sent their PIN mailers out too soon before you could actually do PIN transactions at the point of sale, and consumers forgot. Also, at the time they sent out the cards, [the bank] didn’t have the capability at ATMs or IVRs (automated, phone-based customer service systems) for consumers to reset their PINs to something they could remember.
So there are many reasons - largely reasonable ones, at least from the merchants' point of view - that we haven't moved to Chip and PIN in the US yet. For all of the insulting remarks about Americans not being able to remember PINs (not true, we remember debit PINs fine), that is really quite a small part of it.
One of the analysts mentioned that we may eventually move to get away from the magnetic stripe once Chip and Signature is fully accepted; that would be the most helpful thing in terms of credit card security.
Once mag stripe goes away, chip-and-PIN will be a very strong solution. The estimates are now that by the end of 2015, 50 percent of the cards and terminals will be chip-enabled, but it’s going to be several years before we get closer to full compliance. So, we’re probably looking at about 2018 before we can start making plans to get rid of the magnetic stripe on these cards.
