KARACHI: December 31st, 2019, was the last day for banks across Pakistan to switch from magnetic strip cards to Europay Mastercard Visa (EMV) compliant cards, more commonly known as Chip and PIN cards, as per State Bank of Pakistan (SBP) regulations.
The regulations meant that starting in 2020, customers would only use chip-enabled credit, debit and ATM cards to make payments. Yet despite the passing of the SBP deadline, magnetic strip cards across Pakistan are still working as of January 1, 2020.
However, what has happened is that the planned switch from magnetic strip cards to EMV cards has reportedly created a backlog of new EMV cards that need to be activated at several banks.
Anecdotal evidence suggests that customers trying to activate their new EMV compliant cards are instead faced with busy customer service lines. In some cases, customers are redirected and put on hold for up to 20 minutes at a time.
For example, Sadia Babar, a customer of Bank Alfalah, found that her magnetic strip card was expiring, and tried twice to activate her new EMV card. However, she was redirected to customer service, who told her that her new card had still not been entered in the system, since there is a backlog of new cards that still have to be entered.
Regardless of the bank provider, incidents of long delays in customer service, and a general inability to activate cards promptly, have been widespread in the last few weeks.
Sources within the industry say it is difficult to put a number on the delays, and that statistics will vary from one bank to another.
This backlog is expected to only increase in the start of the new year, as more cards are activated. Bank’s physical branches are expected to have longer queues, as people try to withdraw money from their accounts, and bank helplines are expected to receive more phone calls.
It is unclear why banks did not hire temporary resources for an expected surge in customer calls. The banking industry’s low capacity to switch cards effectively, or to manage call centres better, is a surprise, since banks had more than a year to plan in advance for the card switch.
On 28 November 2018, the SBP issued Payment System Department (PSD) Circular No. 9, addressed to all banks presidents and CEOs, regarding the security of digital payments. Among the many recommendations outlined in the circular, the SBP also highlighted the card switch.
“All card-issuing banks/MFBs shall replace all existing payment cards (except social transfer cards) with EMV chip-and-PIN payment cards latest by June 30, 2019,” according to the circular.
A few months later, on 7 February 2019, the SBP issued PSD Circular No. 1, and extended the deadline to 31 December 2019. The deadline was reportedly extended as several banks still had not significant headway in the process to replace old cards.
This is not the first time the SBP has issued a circular regarding the adoption of EMV compliant cards. In 2016, the SBP issued ‘Regulations for Payment Card Security’, which outlined a card security framework for Pakistan for the first time.
“In electronic banking, the share of Payment Card based transactions has grown significantly in overall banking transactions. With the increased growth in Payment Card transactions, its security has gained importance due to rising threats and vulnerabilities associated with it. State Bank of Pakistan’s oversight role of Payments Systems is aimed principally at ensuring that existing systems are safe, resilient, and maintain the confidence of consumers”, reads the report.
The report recommended that all ATMs and POS be compliant with EMV standards by December 31, 2017; that all card service providers issue EMV cards from June 30, 2018; and that all card processing infrastructure accept Chip and PIN by December 31, 2018.
However, these guidelines were not met on time.
The SBP reiterated its commitment to EMV compliant cards, after a hacking incident on Habib Bank Ltd. (HBL) debit cards in 2017, that caused damages of Rs 10.2 million.
In a statement released shortly after the incident, the SBP noted: “ATM skimming — an illegal activity in which account details are stolen from the magnetic strip contained on the back of the debit card has been around for a while and such incidents have happened, sporadically, in Pakistan as well.”
“It would be pertinent to mention here that debit cards with a magnetic strip on its back – that stores customer’s account details are particularly vulnerable to skimming and cloning. Debit cards, complying with EMV (Europay Mastercard Visa) standards, featuring a chip and offering two factor authentication are now considered most effective countermeasures for card cloning through skimming globally.”
Europay Mastercard Visa, or EMV, is a global standard for smart payment cards. Customers account details are stored on integrated circuit chips, along with magnetic strips.
EMV cards include both contactless cards, and cards that must be physically dipped into a card reader. The cards are considered safer to use, and less vulnerable to hacking attacks and counterfeit card fraud.
In Pakistan, debit cards account for 96.3% of total payment card transaction value in 2019.
