Nov 18, 2015

Attorneys General call for PIN numbers on new credit cards

The National Retail Federation welcomed a letter sent by nine attorneys general to the nation’s top credit card companies and banks calling for the use of personal identification numbers rather than signatures to approve purchases made with new chip-based credit cards.

“This is further proof that top law enforcement officials and security experts agree that continued reliance on an illegible scrawl isn’t good enough to protect American consumers when the technology of a secret, secure PIN is readily available,” NRF Senior Vice President and General Counsel Mallory Duncan said. “Banks and credit card companies should heed the advice being given them and immediately implement chip-and-PIN. That’s the standard used around the world and U.S. consumers deserve nothing less.”

The request was made in a letter sent today by the attorneys general of Connecticut, Illinois, Maine, Massachusetts, New York, Rhode Island, Vermont, Washington state and the District of Columbia to the chief executives of Visa, MasterCard, American Express, Discover, Bank of America, Capital One Finance Group, Citigroup and J.P. Morgan Chase.

“The chip-and-PIN approach is considered by many to be the gold standard currently for payment card security,” the letter said. “Countries that have implemented chip-and-PIN cards have seen significant reductions in fraudulent transactions.”

Chip-and-PIN is used in approximately 80 countries from Asia to Europe but chip cards being issued in the United States use chip-and-signature instead.

“There can be no doubt that this is a less secure standard since signatures can easily be forged or copied or even ignored,” the attorneys general said. “Unlike signatures, PIN numbers can be changed easily and as frequently as needed by the consumer. Absent this additional protection, your customers and our citizens will be more vulnerable to damaging data breaches. This is something we cannot accept.”

The letter dismissed claims that using a PIN would be burdensome for consumers, noting that consumers already use PINs with debit cards. The attorneys general said they were not seeking legislation requiring PINs but rather calling on card companies and banks to make the change “as good corporate citizens.”

Last month, the Federal Bureau of Investigations issued a warning that said PINs were more secure than signatures, then revised the statement after receiving objections from the banking industry. Last year, President Obama issued an executive order requiring PINs on credit cards issued to government workers.

NRF has argued for years that the new cards should replace fraud-prone signatures with a more secure PIN. While chips make the new cards more difficult to counterfeit than traditional magnetic stripe cards, the chip can be circumvented, and the chips do nothing to protect lost and stolen cards from being used. A PIN could prevent fraud with lost, stolen or counterfeit cards even without a chip.