November 16, 2015

Attorney General George Jepsen was joined today by eight fellow attorneys general from around the country in urging leadership of the nation's largest credit card issuers to speed up implementation of chip and PIN technology, which is widely considered a more secure means of processing credit card transactions than traditional magnetic -stripe payment cards and the chip-and-signature card process now being rolled out.

The attorneys general asked leaders at companies including MasterCard, Visa, Discover Financial Services, Bank of America, Capital One, Citigroup, American Express and JP Morgan Chase – who have collectively begun the nationwide transition to a chip-and-signature card – to move to full chip and PIN technology as soon as possible. The attorneys general said that doing so would be in the best interest of consumers, who are now routinely impacted by breaches involving credit and debit cards, and of local businesses, which are at risk of increased financial risks as well as harm to their reputations and loss of consumer trust if they experience a breach.

"Over the last few years, breaches at major retailers that involved credit and debit card information have really shown a giant spotlight at the inherent weakness and vulnerability of magnetic strip cards even when the cards are lost or stolen," Attorney General Jepsen. "We know, based on experiences in other countries, that chip and PIN cards offer greater security to consumers – security that I believe far outweighs any initial burden or confusion that always comes when we need to get used to a new way of doing things, like using a credit card. Consumers in Connecticut and across the country deserve access to the absolute best that the industry has to offer. Right now, that is chip and PIN, and I believe it's my responsibility to advocate on their behalf for it."

The attorneys general said that while the ongoing implementation of chip-enabled cards in the United States is "imperative in order to provide stronger payment security and assurance to consumers," most chip cards currently being issued in the country rely on a signature, rather than a PIN, as the secondary form of verification.

"There can be no doubt that this is a less secure standard, since signatures can easily be forged or copied or even ignored at the point of sale," the attorneys general wrote. "In order to better protect consumers, the chip-enabled cards issued in this country must be reinforced with the requirement that consumers enter a PIN to verify the transaction….absent this additional protection, your customers and our citizens will be more vulnerable to damaging data breaches. This is something we cannot accept, and nor should you."

The Connecticut Office of the Attorney General received approximately 515 data breach notifications in Fiscal Year 2014 to 2015 – or about 42 notifications per month. In total, about 2.5 million Connecticut residents are reported to have been affected by these data breaches, with varying categories of personal information implicated. Nearly half of the reported breaches involving Connecticut residents – 235 breaches – involved compromised credit and debit card information.

"I am not calling for chip and PIN or any other particular technology to be codified in federal or state law as a legal mandate on card issuers," Attorney General Jepsen said. "Rather, I am urging credit card issuers, as good corporate citizens, to voluntarily expedite the implementation of a technology that exists now and offers substantial security benefits and to continue to adapt and improve security as quickly as possible as newer and even better technology arises in the future.  No technology will prevent all credit card fraud, but chip and PIN promises to substantially curtail lost and stolen card fraud and the disruptions it causes to consumers and businesses. I recognize that issuers should consider and minimize disruptions to consumers and retailers as they implement new technology to improve security, but I believe they can and should do more to expedite implementation of chip and PIN technology."

By the end of 2015, there were 1.62 billion chip cards in use across 80 countries around the world. Countries including France, Canada and the United Kingdom have reported significant reductions the various types of payment card fraud since their adoption of chip and PIN technology. Since 2003, the United States has consistently accounted for about half of the global loss from fraudulent transactions, despite being responsible for only a quarter of total card payments.

In addition to Connecticut, attorneys general from Illinois, Maine, Massachusetts, New York, Rhode Island, Vermont, Washington and the District of Columbia joined in today's letter.

Assistant Attorneys General Michele Lucan and Matthew Fitzsimmons, head of the Privacy and Data Security Department, are assisting the Attorney General with this matter.

###