66% of IT decision makers, including C-suite executives, believe that Chip and Signature does not offer credit card holders sufficient security and that Chip and PIN should be required, according to a new survey on EMV readiness from Randstad Technologies, a leading technology talent and solutions provider. By October 15, 2015, the majority of U.S. businesses must transition to EMV-capable technologies or become liable for any costs incurred from fraud using old magnetic strip technologies.
EMV Survey Results:
Lack of time, deployment expertise cited
as top obstacles to EMV readiness
Europay, Mastercard and Visa (EMV), the standard credit card processing method used widely
throughout the world, has proven effective at signiﬁcantly reducing face-to-face credit card fraud. In
the U.K., for example, starting with EMV’s implementation in 2004, face-to-face credit card fraud fell
70 percent over the next six years. France claims an 80 percent reduction. The U.S. is the last major
market that still uses the outdated mag stripe technology, but that’s about to change. In October of
this year, what’s known as the “liability shift” will take place, meaning liability for the cost of fraud
will fall on the entity using the lesser technology.
One would think the enormity of the potential risk of a credit card security breach would drive
businesses to adopt the chip and PIN technology before the October 1st deadline. But is this actually
the case? To get a fuller picture of how businesses are approaching the upcoming liability shift and
their knowledge of and attitudes towards the pending EMV transition, Randstad Technologies
surveyed C-level executives and IT decision makers representing a cross-section of affected industries.
This report summarizes the ﬁndings of that survey.
Many businesses might miss the deadline
One of the more prominent and puzzling ﬁndings of this survey is that while nearly 60 percent of the respondents indicated they were
actively preparing for the EMV technology transition, the remaining 40 percent were pretty much evenly divided between those
either not preparing or unaware if they were. With time running out to meet the deadline, ﬁrms that have not acted by now,
especially those with numerous and geographically scattered locations, have either decided the risks are worth taking, the deadline will
be extended, or they can scramble and accomplish the transition. Given that consumer transition to the new cards has been slow,
perhaps they feel no urgency to upgrade their systems.
Greatest conversion obstacles — expertise and time
The survey also found that lack of time ranked as the top obstacle to meeting the deadline (comprised 19 percent of responses),
followed by access to technology expertise (comprised 17 percent of responses). It’s not surprising that lack of time is a factor given the
challenges organizations face getting access to the expertise required to meet the deadline. Because so many ﬁrms lack the
experienced internal personnel to handle card reader deployment, they rely on outside ﬁrms for help. Given that many of these outside
ﬁrms are fully committed to fulﬁlling their current workloads, the availability of skilled point-of-sale professionals who know both
deployment and EMV system certiﬁcation is scarce and will only become more so as the deadline nears.
Another survey ﬁnding of note was that 66 percent of respondents believe that Chip and Signature does not offer sufﬁcient security
and that PIN technologies should be required. This ﬁnding, that two-thirds of the respondents would favor the use of a PIN while a
third think that a signature is sufﬁcient, reﬂects the diversity of opinions and even confusion on the subject. The issuing banks are, by
and large, opting for Chip and Signature, and one of their stated reasons is that requiring consumers to remember a PIN might make
them less likely to use their card or to complete a transaction if they forget their PIN. Retailers, on the other hand, appear to realize
that Chip and Signature is not much of an advance over the current mag stripe and that requiring a PIN is the key to a more secure
Chip and Signature – not secure enough for most
Many businesses will make the October deadline, but a signiﬁcant number are either going to miss the deadline (whether
intentionally or unintentionally) or push to try to make it over the next few months.
The major obstacles to conversion are lack of technical deployment expertise and not having enough time to meet the deadline.
Neither of these is going to become more favorable before the deadline. In fact, access to skilled people will only grow more
difﬁcult as October approaches.
Chip and PIN is considered more secure than Chip and Signature, but a signiﬁcant number of banks are issuing only Chip and
Signature. The results of the complete survey follow.
According to survey
respondents, 58 percent
are actively preparing
for the EMV technology
transition, while the
remaining 42 percent
have not taken any
steps towards the
transition or are
unaware of any
What’s surprising isn’t that 3 out
of 5 respondents report actively
preparing for the transition, but
that 2 out of 5 either haven’t or
aren’t sure if they have! Given
the potential liability
organizations face from a
breach, this raises some concern
— especially with so many high
proﬁle cases of credit card fraud.
Has your business taken any steps towards meeting the
Fifty-two percent of
that it takes more than
four months to make
the EMV transition.
Time’s running short to meet
the pending October transition
deadline. Those with large
numbers of sites to upgrade are
going to have to scramble –
and still might miss the deadline.
How much time does the EMV transition take from
beginning to end?
4 - 6 months
1 - 3 months
Aside from not having
enough time to meet
the deadline (19%),
access to technology
(17%) as their top
expertise isn’t just limited to
physical deployment know-how,
but other issues as well -- for
example, how to attain EMV
certiﬁcation. It’s not surprising
that the lack of time is a
prominent factor given that
organizations face challenges
getting access to the right
technology expertise to meet
What are the greatest obstacles your business faces in
meeting the deadline for EMV card readers?
58 percent of survey
that failing to meet the
liability shift deadline
will have either limited
or no impact on their
company’s bottom line.
This reveals that a segment of
organizations have placed their
EMV transition on the back burner.
Some might be discounting the
magnitude of the risk they are
exposing themselves to by missing
the deadline. Others might have
what they consider higher business
priorities commanding their
attention and resources. Perhaps
they plan on transitioning at their
own pace or think that costs
If your business does not make the EMV transition in time, what level of
impact will the liability shift have on your company’s bottom line?
Nearly 30 percent
believe that having
EMV card readers will
encourage customers to
conduct business with
them and another 32
percent are uncertain
about its impact.
Because consumers have
been largely insulated from the costs
of credit card fraud, this ﬁnding
reveals that organizations don’t
necessarily think customers will
change their purchasing behavior
based on their offering a more
secure purchasing option. Also,
communication and marketing
efforts to promote the security
beneﬁts of the EMV system over the
traditional mag stripe technology
to consumers have been spotty.
Do you believe your customers are more likely to conduct
business with you if you have EMV card readers deployed?
The majority (66
percent) believe Chip
and Signature does not
offer ample security and
that PIN technologies
should be required.
If there’s anything surprising in these
numbers it’s that nearly six percent
of respondents believe that mag
stripe technology offers sufﬁcient
security. That’s a perspective that’s
been undercut on many occasions
by costly security breaches to a
number of prominent businesses.
Do you think Chip and Signature cards offer ample security to your
customers, or do you think PINs should also be required?
No. Chip and
PIN should be
Yes. Chip and
Neither. Traditional mag stripe
technology offers enough security
More than half believe
the liability shift should
be delayed (56 percent).
Although the restaurant industry, in particular, has
been advocating for a delay in the transition
deadline, there’s no widespread push for delay,
and there’s nothing right now to indicate that a
delay is probable. Organizations that procrastinate
because they think the deadline is going to be
pushed back might ﬁnd themselves out of luck, as
deployment help will be scarce and the new pin
pads will be nearly impossible to acquire as
October grows near.
Do you think the EMV liability shift deadline should be
and/or will be delayed?
No, it should
No, it should
Given that the liability shift is only a few months away and it’s unlikely to be
delayed, it’s surprising that so many organizations are either waiting until
the last minute to act or are willing to incur the associated risks from
missing the deadline. For those organizations that still think they can make
the October deadline, the longer they wait, the more they are going to ﬁnd
that deployment expertise and the new card readers will be in short supply.
Additionally, those willing to incur the risks should be aware that thieves
will be looking for the weakest link — and if they turn out to be that link,
the price for ignoring the deadline could be steep.
Randstad Technologies surveyed 84 IT decision makers within large-scale*
national businesses to gauge their readiness for the EMV liability shift
deadline in October. Respondents included C-level and director-level staff
within top industries affected by the deadline, including retail, hospitality,
restaurants, ﬁnancial services and others. The survey was conducted from
May 13, 2015 through June 19, 2015.
* according to these results “large-scale” business are those with 100 or more sites