Privacy and Security

Walmart v. Visa, Is the Retailer’s Suit about Protecting Customers or Money?

Is Walmart’s most recent lawsuit against Visa all about “protecting customers’ bank accounts,” or is Walmart using customer security as a trump card to hide the lawsuit’s financial motivations? According to the lawsuit, Visa charges Walmart five cents more per signature-based debit card transaction compared to PIN transactions.

Obviously, this is not Walmart’s first litigation foray against Visa. In 2004, Walmart led a group of retailers that successfully sued Visa and Mastercard on antitrust grounds, winning $3 billion. Then, in 2013 Walmart opted out of a massive lawsuit filed by a group of retailers, which tried to reduce the Visa’s and Mastercard’s transaction fees. Rather than accepting a share of the $7.25 billion settlement, Walmart opted out of the litigation and filed its own suit against Visa, seeking $5 billion in damages.

Regardless of how a party tries to posture itself in a case like this, most lawsuits filed by a retailer against a financial institution, such as Visa, are all about the money. The point is best illustrated using Walmart customer and transaction statistics. According to Statistic Brain, customers spend over $36 million per hour at Walmart. Of that $36 million, Walmart profits about $2 million, which equals a 5.55 percent profit margin. Because a number of Walmart stores are open 24 hours, this means that Walmart may make around $48 million in profit per day.

Walmart also has about 100,000,000 customers walk through its stores on a weekly basis. This means that over 14 million people, on average, shop at Walmart stores every day.

Walmart states in its lawsuit that debit card transactions account for 70 percent of the dollar value of card payments. Assume half of its daily customers – say 7 million, again for illustrative purposes – pay using debit cards. Based on the allegations in the complaint, 10 percent of these debit card users, or 700,000 sign rather than enter a PIN. At five cents per transaction, Walmart has to pay Visa an extra $35,000 per day, $245,000 per week, and over $12.7 million per year, or about 25 percent of a single day’s profits.

This very small number raises a particular question – is Walmart’s lawsuit really about “protecting customers,” or removing another choice for customers? The practical impact of the suit, if successful, would not only be an altered deal with Visa, but customers would be denied the ability choose to sign chip-based debit card transactions.

So, is the case about protecting customers, or the money? To answer the question, it is necessary to examine the card technology Walmart is trying to employ across its network.

The card technology is called Europay, Mastercard and Visa, or EMV for short. As one may be able to tell from the name, the technology started in Europe. EMV compliant cards have small chips embedded in the plastic. When the cards are used, the system generates a unique transaction verification code, which is very hard to duplicate. To complete a transaction, consumers must enter a Personal Identification Number. The PIN operates as a second layer of authentication, providing additional security in the event financial information is stolen.

In Europe, this is the only method by which customers can use credit or debit cards. However, a number of processing companies in the United States allow merchants to accept signatures in lieu of PINs. Signatures are less secure than PINs, both due to the ability to forge signatures and the unwillingness of many merchants to compare the purchaser’s signature to the signature on the back of a card.

Because of the signature requirement, merchants must have card terminals that offer both the chip and the magnetic stripe options. Retailers and other merchants were required to accept EMV technology by October of 2015. Despite this, a number of retailers and card companies were not ready for the transition. Gas stations and ATMs have until October 2017 to implement the technology. Until all merchants adopt EMV, it will be necessary for all stores to maintain card terminals with both EMV and magnetic stripe technologies.

The move to EMV technology was all about security, as there are a number of vulnerabilities associated with magnetic stripe cards. In addition to card skimmers, and other physical devices that can be used to steal information, bad actors need only access payment information to duplicate magnetic stripe cards, or cards where payment process allow for signature verification. Granted, EMV technology is not perfect, but it requires bad actors to have two pieces of information: the financial information on the card and customers’ unique PINs.

Oddly enough, in the context of Walmart’s lawsuit, Visa has long pushed for EMV adoption in the United States.

Because Visa has long pushed for the technology, it certainly is aware EMV chip and PIN protection is superior to signature based transactions. Perhaps, then, the lawsuit is not about “protecting customer’s bank accounts.” Perhaps it is Walmart trying to alter the terms of a negotiated contract with Visa. Perhaps it is about denying customers payment options. But more likely than not, it is all about the money.

In Depth: Privacy and Security

A market environment is essential for future success of the Internet. A consumer and private-sector-driven approach to privacy via self-regulation avoids undue regulatory burden that would threaten a thriving electronic marketplace. The Internet has flourished due in large part to the unregulated environment in which it has developed and grown.

+ Privacy and Security In Depth