Federal Reserve's Powell concerned about security of chip and signature
Speaking at a Federal Reserve conference in Missouri, Jerome Powell called EMV card deployment a step forward but questioned the security of cards that use signatures, not PINs, for authentication.
Just five days before Payment Card Industry Data Security Standard (PCI DSS) Version 3.0 became effective, Federal Reserve Governor Jerome Powell expressed concern that, while “the deployment of EMV chip cards…represent[s] an important step forward,” the industry hasn't gone far enough.
“We should not stop there,” said Powell, questioning use of chip and signature domestically, rather than the chip and PIN cards that banks have been issuing for years overseas.
"New approaches to authentication increasingly offer greater assurance and protection,” he said, speaking at a Federal Reserve Bank of Kansas City conference in Missouri. “Given the current technologies that we have at our disposal, we should assess the continued use of signatures as a means of authenticating card transactions."
Debra Berlyn, the President of Consumer Policy Solutions and leader of the consumer education campaign ProtectMyData, agreed with Powell that layering security tools and procedures is important, noting in a statement sent to SCMagazine.com that her group has “long advocated” for the industry to “pair chip-equipped cards with unique PINs” to provide American consumers added security.
She also took issue with the financial industry's argument that consumers either don't want or won't be able to remember a PIN, calling the claim a “baseless diversion” so the industry won't have to put dollars into an infrastructure that supports chip and PIN.
"While it is certainly not a cure-all, chip and PIN is the best available technology for consumers today,” Berlyn said, noting that it should be the standard in the U.S. as it is in other countries. “If the industry is already investing billions to upgrade cards and their hardware, they should be upgrading it to accept the most advanced technology available."
Chip and signature, she explained, “still allows widespread fraud in the case of lost and stolen cards.”But if banks and credit card companies continue to push signature verification, Berlyn called on Powell and other leaders in government to promote chip and PIN “as a baseline means of protection.”