PINless Debit Needs to Be Taken Seriously by the ABA, CUNA, & ICBA

Dan Fisher

With over 35 years in the financial industry, Dan M. Fisher has proven himself as a leader in the financial industry holding roles as the former director of the Federal Reserve Bank of Minneapolis and former Chairman of the ABA Payment Committee.

PINless Debit Impacts Community Banks & Credit Unions by Millions of Dollars & Growing

Community financial institutions, meaning exempt institutions as defined by Regulation II, are being targeted by Card Payment Networks using practices that shift hundreds of millions of dollars in transaction liability from the merchant to the issuer (Bank or Credit Union), using PINless Debit Card Transaction rules.

It is about time that the American Bankers Association (ABA), the Credit Union National Association (CUNA) and The Independent Community Bankers Association (ICBA) begin taking this issue seriously. The impact on community financial institutions is in the millions annually and growing. Community financial institutions are being exploited through bad vendor practices and vendors need to be publicly confronted.

See the bottom of the article for a Glossary of Terms.  

PINless Debit Transaction Facts

The 2019 Federal Reserve Study (using 2018 payment volumes) cites that non-prepaid debit cards Card Present (CP) transactions accounted for 86.1 billion payments. The Fed has also pointed out that the combined use of EMV Chip & PIN authentication is substantially increasing transaction security by reducing third-party payment fraud.

The alarming fact is the number of No-PIN transactions associated with cards that have a Chip (31%) and the number of No-PIN transactions with cards that do not have a chip (Mag-stripe only) at 28.8%. Based on those numbers, we calculate a total of 25.87 billion transactions were PINLess Debit transactions in 2018.

If we assume that 50% of these PINless debit transactions are fraudulent and multiply this number by $50.00, the liability in total dollar value Card Payment Networks are shifting away from the merchant and onto the issuer equates to an excess of $1.293 trillion annually. Merchants love the PINless Debit Rule, why wouldn’t they with numbers like this? Not to mention, we feel the 50% number we used to calculate the above statistic is conservative. We presume the number is closer to 70% and soon vendors will increase the PINless debit maximum value to eclipse $50.00 pushing these numbers even higher.

The important aspect here is that due to Card Payment Network rules, community financial institutions do not have charge back rights to the merchant for fraudulent PINLess Debit transactions. This is not to say that all of these transactions are fraudulent, that we would unrealistic, but using any percentage is still a big number growing each year, and it is a risk to grow higher if no one does anything about it.

Card Payment Network Monopolies

Card Payment Networks say that PINLess Debit transactions are convenience transactions meaning that customers and merchants both want through-put at the register. Our research is that the time for each transaction is the same, and the reason merchants prefer it pertains to fraudulent transaction liability shift. They don’t have to worry if the transaction is fraudulent, because they are not on the hook. Card Payment Networks thrive on this volume because when the interchange on this transaction is low, the transaction fee charged to the merchant is low. Therefore, the merchant will select the cheapest route if the issuers’ card is not configured to route the transaction on one of the two unaffiliated POS switch options required by Regulation II. How can that be?

We have also found through our research that covered institutions can force the use of EMV Chip & PIN at the point of sale, including the big box stores, where community banks and credit unions are prevented from doing so due to the Card Network Operating Rules. More importantly, when these institutions ask to opt-out of PINLess debit they are told, “No”! We expect that the Card Payment Networks have other tricks up their sleeves to make this matter worse.

Question: Why do covered institutions under Regulation II have the ability to impose Chip + PIN, but Community Banks and Credit Unions are prevented from doing so, even when the Federal Reserve proves that Chip + PIN reduces fraud losses?

PINLess Debit is just not right! There is no legitimate reason to coerce or compel institutions to agree to this product.

This product and the associated tactics target the small financial institutions that can’t unwind their agreements. This results in the vendor holding the institution hostage through the Network Operating Rules, until their agreement expires.

Linkage Language Community Banks and Credit Unions Do Not Know About Pertaining to PINless Debit

Another challenge is that Card Payment Networks have devised linkage criteria that gives them the ability to insert their network ahead of the issuers’ preferred choices configured on the card. These linkage schemes become complex “if then else” statements that are buried in the Network Operating Rules, much like the PINLess Debit product rules.

If your fraud is going up, and your interchange is going down, this situation may be happening to your institution.

How?

For example:

Let’s say, you, the issuer, configure your cards to select Mastercard or Visa to process transactions. You assume all transactions are included in this configuration. Due to certain non-obvious vendor relationships or vendor-merchant relationships, this may not be true.

Sometimes, ABC Vendor will require your institution to join the ABC Vendor Card Payment Network even though you were trying to avoid them by configuring your cards to process with Mastercard/Visa. Furthermore, ABC Vendor does not have to disclose to you they just auto-enrolled you in their Network. This means you are following the ABC Vendor Network Operating rules without knowing it all the while thinking you were processing under Mastercard/Visa.

What needs to happen

1. Exempt Financial institutions should have the right to join any Network they choose and only the Networks they choose.
2. Exempt Financial institutions should have the right to select how their debit card payments are processed and in the order of which transactions are processed as long as it complies with Regulation II. Card payment networks should not be allowed to usurp these preferences or enable merchants to go around through processing back-doors.
3. PINLess Debit Transactions that unilaterally shift transaction liability from the merchant to the issuer should be banned.
4. Linkage Language in membership agreements and Network Operating Rules that force Financial Institutions to join Card Payment Networks that the financial institution chooses not to be a part of should be banned.
5. Exempt Financial Institutions should have the right to require the use of a PIN on POS transactions.

FTC Involvement

We feel strongly that this type of activity is anti-competitive and exploits small financial institutions. In addition, as institutions begin to dig deeper into these rules they become increasingly discouraged by the vendor due to the fact the vendor has the unilateral authority to change the rules, the pricing, fees and their interchange income. When the financial institution realizes they can’t do anything about this but wait until their contract expires, they grow in frustration.

The tactics employed today by Card Payment Networks imposing unavoidable unilateral rules on exempt financial institutions needs FTC and DOJ scrutiny.

This is only becoming worse and needs to stop. We also feel that the DOJ missed the mark when they approved certain core application vendors’ purchase of merchant networks when they also own card payment networks.

ABA, CUNA and the ICBA

The three national industry associations need to take this situation seriously and begin to work together to stop these abusive practices. Vendors are hiding behind the shroud of NDA’s regarding network operating rules, so they can’t be called out openly and publicly. Consequently, these bad practices can only be obliquely referred to.

One course of action is for the three top industry advocates to propose legislation to bring this out into the open. Another angle would be to ask the Federal Reserve to review the scope of Regulation II and how these tactics are neutralizing the intent of income protection for Exempt institutions. The third course of action could be to request an investigation via the FTC or DOJ bringing these rules out into the open.

As a member of the ABA, CUNA or the ICBA, you should reach out directly to your association with a call to action. Afterall, don’t they work for you?

Community Banks and Credit Unions

Our recommendation is that you should work quickly to protect on your Debit Card Profitability and the centerpiece of your millennial technology strategy. If you don’t,  your trusted partner AKA your vendor will take it away from you.

We recommend that you reach out to the ABA, CUNA, the ICBA and your state associations and tell them that you are not happy and you need their action. After all, the cold fact is that they won’t make it an issue until you make it an issue. Of course, there is a fear that the associations will lose significant revenue from these vendors if they call out the bad practices, so it is time for you to make some noise.

Look at the numbers, your monthly debit card profits have been siphoned off by your card payment network vendor one transaction at a time. So much for the Durbin Amendment protecting your income. Call your vendor and tell them you are not happy!

Finally, it is amazing what somebody will do when they think nobody is watching. If you want to figure it out, read your network operating rules, you will be amazed!

So, why is your interchange income declining and your card fraud increasing? You now know where to start looking and you are not going to like what you find.

-Dan M. Fisher

Glossary of Terms

1. Exempt Institutions: Financial institutions less than $10 billion in assets are exempt under 12 CFR Part 232.5 Exemptions.
2. Covered Institutions: Financial institutions less than $10 billion in assets are exempt to PINless Debit Transactions under 12 CFR Part 232.5. 
3. Regulation II: Regulation II (Debit Card Interchange Fees and Routing) establishes standards for assessing whether a debit card interchange fee received by a debit card issuer for an electronic debit transaction is reasonable and proportional to the costs incurred by the issuer with respect to the transaction. 
4. Issuer: Community Banks or Credit Unions that issue debit or credit cards to consumers. 
5. Merchant: A company involved in wholesale trade.
6. $50.00: The maximum dollar amount required to trigger a PINless Debit Transaction. 
7. Durbin Amendment: Debit interchange regulation which includes a variety of parameters and directs the Federal Reserve to be involved with establishing “reasonable” rates. The Durbin Amendment, part of the Dodd-Frank Act of 2010, sets caps on swipe and/or interchange fees fr debit card transactions. 
8. PINless Debit Transaction: A transaction in which the card-holder does not have to enter his or her PIN at POS.
9. Card Payment Network: The company that provides a communication system between a merchant and issuer to process a transaction. Examples: STAR, NYCE, ACCEL, PULSE, SHAZAM, etc. 

Dan Fisher

With over 35 years in the financial industry, Dan M. Fisher has proven himself as a leader in the financial industry holding roles as the former director of the Federal Reserve Bank of Minneapolis and former Chairman of the ABA Payment Committee.