As someone who has worked with merchants (in a cybersecurity and PCI compliance consulting role), and has often--alas, often unsuccessfully--advocated to one client or another that they move to EMV (ie. "chip"-card) compatible readers or terminals in a timely fashion I feel an irresistible impulse to offer some thoughts here. Why has EMV adoption in the U.S. has been slower to this point than one might have hoped? Well...
The most important reason--not the only reason, but the most important reason-- that the U.S. has been slow in adopting EMV is simply that regulatory authorities have taken much, much longer to require that merchants support chip-card transactions than they have in other parts of the world. In the U.S. the question of when merchants (and payment processors) must move to supporting EMV has been left to the Payment Card Industry's ("PCI') self-regulatory council. The PCI Council has been very slow in prodding U.S. retailers to buy new Point-of-Sale equipment that can handle chip-card transactions. Before that, the PCI Council was slow in compelling the payment processors who take card data from those merchants to update their equipment and software to handle the new transaction type. (Although that's now pretty much in place.) And when I say PCI has been slow, I mean slow. In fact, despite the degree of public attention that's come to the EMV adoption issue as merchants have been confronted by the deadline for liability shift that just this month passed here in the U.S., there is still no, actual firm, you-must-support--EMV--by--this-date PCI rule in place for merchants. In other words, if you're a merchant and you don't see any reason to use anything for card processing beyond a 10-year old magnetic stripe reader hooked up to your 8-year Point-of-Sale PC, as long as you're willing to bear the (hypothetical, potential) risk of liability for unauthorized charges in some circumstances there's still nothing from the PCI Council that says you aren't allowed to keep on going on like that. Will there be, someday? Yes. But not yet.
Sigh.
But now we're left with another question: why has the PCI Council been dragging its feet on requiring that merchants accept chip-card transactions? Well, we're kind of necessarily starting to go from fact territory to opinion & speculation territory here, so I won't dwell on this point. I'll just say that in my estimation the PCI decision-makers have been very, very, very sensitive to the concerns of merchants on this issue. Too sensitive. For merchants, buying and setting up new card readers or terminals that can handle chip-card transactions often looks like nothing more that a source of expense (and, potentially, some configuration pains here and there) that doesn't directly benefit them in any way. This perspective is wrong, mind you. (I won't go into the details of why here; suffice it to say PCI compliance & cybersecurity stuff). But the PCI Council, in the past, has proven very deferential to it. We will see if the numerous and awful credit/debit card info breaches that have occurred here in the U.S. the past couple years will lead to a lasting change in this attitude (ie. a shift in priorities to being more protective of the interests of consumers who have their card data stolen and of banks/card issuers who must still usually bear the financial consequences of unauthorized transactions). But for now the Payment Card Industry is still partly dragging its feet.
Oh, one final thing: you may be surprised to learn that even at U.S. retailers who have adopted chip-card compatible terminals use of the "chip-and-pin" procedure, as you folks in Europe know it, is still quite rare. Instead, "chip-and-signature" transactions are the norm. In these scenarios the chip is inserted into the reader/terminal in the way that you do it, but after the "dipping" of the chip into the reader is complete rather than enter a PIN a user merely needs to sign a paper receipt. This practice is not as secure as chip-and-pin, and everyone knows it isn't as secure as chip-and-pin. But, again, the Payment Card Industry decision-makers aren't in any urgent hurry. The speculation is that, say, 2-3 years down the road a rule requiring PINs instead of just signatures will be put into place. Maybe.
Anyway, just a perspective of someone who's worked on the ground to try to hasten EMV (and chip-and-pin) adoption where I could. YMMV.
Cheers.
PS: Typically, chip-card transactions do not take much longer than magnetic stripe transactions. By that I mean that, as things stand today, when everything's set-up correctly, on both the merchant's end and the payment processor's end, and working properly chip transactions should only take slightly longer than magnetic stripe transactions. (Meaning a few seconds, perhaps.) If a chip transaction is taking 20 seconds longer something is most definitely askew somewhere.
