The central bank said it would soon set a “hard deadline” for banks to switch to a more secure EMV chip technology for automated teller machine and credit cards from the vulnerable magnetic stripe technology.
The EMV or Europay Mastercard Visa is the global standard for chip-based credit and debit transactions that makes its difficult for fraudsters to hack into, compared with magnetic strip cards. The embedded chip contains unique transaction details that are activated each time the card is used. It is also protected by additional layers of security.
The BSP issued Circular 808 in August 2013, setting out a more than three-year journey for banks and other financial institutions to make the complete shift toward EMV technology.
“At that long journey, at the end of the day on January 1, 2017, the reality is not everyone is completely ready. Others are more ready than some and that is specifically more challenging for the bigger banks with [a big]card base,” Bangko Sentral ng Pilipinas (BSP) Deputy Governor Nestor Espenilla Jr. said.
Based on BSP estimates, the migration to EMV from magnetic stripes is 90 percent complete, but about 76 million cards must be replaced.
Espenilla said the BSP would set a tailor-fit deadline for each non-compliant bank depending on the level of progress and other “challenges.”
“After which, most likely there will be an outer deadline…with hard sanctions. We already have an idea [of when will be the hard deadline],” he said.
Espenilla did not disclose a timeframe for the deadline but said that he was about to submit another report to the Monetary Board regarding the progress in EMV compliance.
“At some point, we will provide you more specific updates where things really are,” he told reporters.
In the meantime, a recent BSP-issued EMV Card Fraud Liability Shift Framework (ECFLSF) will protect customers from any liability that could arise from the use of magnetic stripe cards.
ECFLSF is a market-based enforcement mechanism that operates in such a way that a bank that has adopted the secure EMV technology shall be protected from financial liability arising from losses on counterfeit card fraud.
The liability for this type of fraud shall shift to the financial institution that is not or is only partially compliant with the EMV requirement.
“Since you’re late, if there will be a problem later on, then that will be your liability. There is already, in a way, a market punishment,” Espenilla explained.
The ECFLSF is expected to accelerate compliance and speed up the dispute resolution and restitution process for customers who have valid claims as a result of fraud or skimming attacks.
Until banks attain full migration to EMV technology, the use of magnetic stripes in payment cards and card-accepting devices will be allowed based on conditions set in the framework.