The survey also found about 4% of credit unions don't plan to convert to EMV at all.

Sean Curran, a director at the technology consulting firm West Monroe Partners, said some credit unions that scrapped EMV conversion may have done so because they believe it is less expensive to incur the fraud than to reissue cards.

The size and nature of card fraud is still in flux, however. EMV has long been lauded as the answer to fraudulent credit cards at the point of sale, and experts say fraud has indeed declined there in countries that have already migrated to EMV. But much of those declines have been countered by a corresponding increase in card-not-present fraud, which typically takes place online.

“If you're a small credit union and the replacement of a card goes from $15 a card to $35 a card, there's a $20 increase per member,” Curran said. “Until they see that fraud impact, they're not going to be as quick to migrate.”

“October 1 was a milestone with respect toward increased security of card present transactions and to address counterfeit fraud, but it will be years to get enough critical mass to effectively reduce counterfeit fraud, so we still have a long way to go in the journey,” Hackney added. “And, we are now focused on tokenized transactions to address card not present fraud, which generates more fraud than counterfeit fraud.”

EMV Vendors Called Out

Only about one in six (16.4%) credit unions said they missed the Oct. 1 EMV deadline because they started late. But far more – almost half (44.5%) – blamed vendors for starting late.

“I think it's a really bad excuse,” Curran said. “You've got to remember, in the U.S. the way the banking system works, when they talk about the vendor, they're really talking about the card manufacturers and people like that.” Card manufacturers have been able to produce EMV cards for some time, for example, but they didn't buy the stock because they didn't see a huge EMV migration, he explained.

“I think this really comes down to the bigger banks took a long time themselves to start the process,” he continued. “They weren't willing to invest in chip-based cards until they were ready to receive them. Now all of a sudden, you get close to the deadline, their project finally kicks in and they start buying the cards, and now we run out of available cards.”

Credit Unions Torn Between Mass Reissue and Natural Expiration

Credit unions have a variety of strategies for getting EMV cards into members' hands, but credit unions are fairly evenly divided on two.

The survey found 39.5% planned to send members EMV cards when their existing cards expired; 36.4% said they adopted a mass reissue strategy. Another 10% said they prioritized certain cards for reissue, such as those held by frequent travelers. A similar proportion (9.5%) said they adopted an accelerated reissue plan.

State Department Federal Credit Union COO Bill Thorla said the results prove just how hard the decision is for issuers.

Thorla said his credit union, which is headquartered in Alexandria, Va., and has $1.7 billion in assets and 70,500 members, began issuing EMV credit cards in 2012 as cards expired. However, because the credit union's vendors and networks weren't prepared to convert debit cards to EMV until 2015, it did a mass reissue of debit in order to get everything converted by the fourth quarter, he explained.

“We felt a mass reissue would not only enable us to immediately receive the benefits of the liability shift, but also to wipe out whatever card data was out there in the fraudsters' hands from any previous merchant data compromises,” he explained. “It provided a fresh start with our debit card base.”

Orfanides said it's been a tricky decision for his credit union, too.

“To me it's a toss-up between meeting a perceived expectation of your members with respect to EMV cards versus the reality of the cost,” he said. “We have very few members asking for EMV so far. And locally we have very few merchants actually processing transactions as EMV.”

EMV Conversion Costs

For most credit unions, EMV conversion is a five-figure expense. Specifically, half the survey respondents (49.5%) said the cost of converting to EMV credit cards was less than $50,000. Another 28.6% said the cost was between $50,001 and $100,000, and only about one in seven credit unions (14.5%) said the cost was $100,001 to $300,000. Just 7.3% reported more than $300,000 in costs.

Orfanides said he wouldn't be surprised if the costs were based on asset size.

“This is how so many vendors price services in the credit union industry,” he explained.

Of course, the October liability shift isn't the only EMV cost hurdle for many credit unions; next up is the mass EMV migration for ATMs next year. Currently, card issuers generally bear the cost of fraud associated with counterfeit cards at ATMs. But after the ATM liability shift, the party that does not support EMV bears the loss.

One in 10 Don't Have a Communications Plan

Issuing cards isn't the only part of EMV conversion; telling employees and members how they work and why they exist are also huge components.

However, the survey found nearly one in 10 credit unions (9.1%) had no communications plan in place for employees, and 7.3% said they had no member communications plan in place.

Curran ventured a possible explanation.

“I think it's almost a recognition of they are probably the second banking account for their member, not the first or not the primary,” he said. “There can be an opportunity to rely on others to teach.”

The vast majority of credit unions have of course made some kind of communications effort, though some appear unsure about their own work. Only about one quarter of credit unions (26.4%) felt they have “very comprehensive” employee communications plans that included rolling out full campaigns across multiple channels. Half (50.9%) said they had “somewhat comprehensive” plans that communicated basic information through several channels and 13.6% said their communication to employees was “not very comprehensive,” defined as sending one letter or email at the time of conversion.

“I'm pleased to see this as high as it is,” Orfanides said. “If you are somewhat comprehensive to very comprehensive, you are probably doing just fine. EMV is not rocket science. You don't have to say too much to bring people up to speed on it.”

Credit unions gave themselves similar grades for their member communication plans – 25.9% said they had very comprehensive plans, 49.1% said their plans were somewhat comprehensive and 17.7% rated their member communications plans as “not very comprehensive.”

Thorla said he wasn't surprised that only about one quarter of the respondents rated their communications plans as very comprehensive.

“By this point, most consumers know what an EMV card is and generally how they work,” he said. “Since the interaction of using the card is at the merchant level, the merchants are in the best position to educate their customers on EMV use.”

Hackney added, “It is important to keep progress in the credit union space, as well as the U.S. in general, in context with other EMV implementations that have taken place globally, where it took several years for both issuers and merchants to reach a point where 75% of transactions were conducted by chip cards on chip-enabled terminals. And debit in the U.S. is significantly more complex than the rest of the world given Durbin compliance and the nature of having more than 15 PIN POS networks that are part of the equation.”