State AGs Seek Support for Requiring PINs with EMV Cards
State attorneys general in Connecticut and Georgia asked attorneys general of other states to join them in signing a letter addressed to the payment networks and several card issuers asking for PIN authentication for EMV card transactions, rather than signature authentication.
The security of EMV cards has been under increased scrutiny since the Oct. 1, 2015, EMV liability shift, in which network liability rules shifted responsibility for card fraud, in certain situations, from the issuer or processor to the merchant. Most recently, the FBI posted an advisory on the security of EMV cards that included, but was later amended to remove, a statement that EMV cards with PIN authentication were more secure than those with signature authentication. The letter from the state attorneys general voices similar concerns regarding the safety of EMV cards that do not require PIN authentication, suggesting that the debate over mandatory PIN authentication for EMV cards is moving to the state level. For their part, card issuers and the networks have maintained that mandated PIN authentication is unnecessary as EMV cards with signature verification prevent counterfeit cards, which represent the most prevalent type of fraud.
The NBPCA has learned that various trade groups and other interested parties, after reviewing a copy of the proposed letter, have lobbied the state attorneys general to refrain from signing the letter without first convening a panel of affected stakeholders to discuss payment card security. They believe that once the experts explain the payment card security issues in more detail, the state attorneys general will understand that their proposed letter asks for the wrong policy solution.
The deadline for other states attorneys general to participate was Oct. 28. As of press time, it’s not clear how many state attorneys general have agreed to sign the letter.
