Examination of Strategies to Implementing Chip and Personal Identification Number Credit Card Authentication Infrastructures

Section 1: Foundation of the Study

The purpose of this qualitative study was to explore strategies used by

information technology (IT) managers to transition their e-commerce organizations to

chip-and-personal identification number (PIN) credit card authentication infrastructures.

Background of the Problem

IT managers are challenged to provide the most secure computing environments

for their users, both internal and external. Protecting their organization’s customers from

credit card fraud and stolen personal identifiable information (PII) are mandated

compliancy requirements. With limited implementation of chip-and-PIN credit card

authentication systems within the United States, the findings from this study can be used

to inform all stakeholders on the benefits and capabilities of implementing chip-and-PIN

credit card authentication infrastructures.

Problem Statement

According to the 2013 Federal Reserved Payments Study, the estimated number

of unauthorized card payment transactions in 2012 was 29.5 million, with a total loss

estimated at $3.9 billion (Gerdes et al., 2013). The U.S. Department of Justice, Bureau of

Justice Statistics, National Criminal Justice found approximately 66% of credit card fraud

victims experienced a financial loss (Harrell, 2015). The general IT problem was the lack

of chip-and-PIN credit cards and point-of-sales (POS) enabled terminals in the United

States. The specific IT problem was that some IT managers lack strategies to transition

their e-commerce organizations to chip-and-PIN credit card authentication

infrastructures.

Purpose Statement

The purpose of this qualitative pragmatic study was to explore strategies used by

IT managers to transition their e-commerce organizations to chip-and-PIN credit card

authentication infrastructures. The targeted population was IT managers in e-commerce

organizations, located in the United States, who had strategies to transition their

organizations to a chip-and-PIN credit card authentication infrastructure. In the findings

of the study, I identified strategies that other IT managers can apply to efficiently

transition their e-commerce organizations to a chip-and-PIN credit card authentication

platform. The implications for positive social change include increased security of credit

card transactions and protection of consumer’s PII, reducing fraud in the global e-

commerce market and financial crimes committed within society.

Nature of the Study

I selected a qualitative approach as the most appropriate means to explore

strategies used by IT managers to transition their organizations to chip-and-PIN credit

card authentication infrastructures. A qualitative methodology allows the researcher to

gain information on the participant’s experience and interpretations of the phenomenon,

using techniques like field notes, participant observation, and open-ended questions

(Leppaaho et al., 2016). A quantitative methodology can reveal statistical information

and test hypotheses of the past and current phenomenon (Frels & Onwuegbuzie, 2013).

The goal of this study was not to measure variables, prove a hypothesis, or compare the

statistical outcomes of each organization’s strategy. A mixed-methods approach is a

methodology with which a researcher uses the data sets and statistical results from a

quantitative method combined with aspects of the qualitative method to further interpret

the reason of a phenomenon (Mauceri, 2014). I did not have a hypothesis in this study;

therefore, neither the quantitative method nor the mixed-methods approach was

appropriate for this study.

I used a pragmatic inquiry design to explore the strategies used by organizations’

IT managers to transition their organizations to chip-and-PIN credit card authentication

infrastructures. Conducting a pragmatic study is an effective design to investigate a

contemporary phenomenon using participants in real-world environments (Patton, 2015;

Salkind, 2010). Using a pragmatic inquiry design allowed me to develop in-depth insight

into each organization’s experience, transition strategy, and strategic perspective from

their IT managers.

When selecting the most suitable study design for this study, I considered

ethnographic and phenomenological designs as possible alternatives to a pragmatic study.

An ethnographic design is used to capture and compare organizational cultural

influences, behaviors, and experiences of participants within a group during their lived

experience of the phenomenon (Jarzabkowski et al., 2014). In a phenomenological study,

the researcher collects data from multiple, in-depth interviews with participants who have

already experienced the phenomenon (Gill, 2014). Based on the need to research multiple

organizations and their strategies during their transition, I determined that the

phenomenological and ethnographic designs would not be as effective in exploring in-

depth the strategies and transition events as shared by the IT managers who experienced

their organizations’ transition to chip-and-PIN credit card authentication infrastructures.

Therefore, the ethnographic and phenomenological designs were not selected.

Research Question

This study was guided by the following research question: What strategies are

used by IT managers to transition their organizations to chip-and-PIN credit card

authentication infrastructures? Appendix B contains a list of interview questions, which I

asked to explore more detailed elements of the main research question.

Theoretical or Conceptual Framework

In 1962, Rogers first framed the innovation diffusion theory (IDT), which is a

model used to define how new ideas are disseminated among people in society (Shaw et

al., 2022). Innovation defines the new ideas, and diffusion is a method of communicating

new ideas to people in a social system (Scott & McGuire, 2017).

Decades later, Rogers (2003) refined, popularized, and documented the diffusion

of innovation (DOI) theory, explaining how innovation is communicated in a social

system. I used the DOI theory as the theoretical framework for this qualitative pragmatic

study. Innovation diffusion is an effective research concept used in the decision-making

process for emerging information technology (EIT; Cegielski et al., 2013). The

innovation-decision process consists of five main levels: knowledge, persuasion,

decision, implementation, and confirmation. Cegielski et al. (2013) stated that EITs

represent an avenue for enhancing the effective and efficient flow and utilization of

information within the organization to support business objectives and, ultimately, firm

performance. Drnevich and Croson (2013) found that without an alignment of business

and IT strategies, a business will not be effective. Green (2014) found that performing

and evaluating qualitative information systems (ISs) research is best conducted using a

methodological framework.

In this research study, I applied the constructs of the innovation-decision process

to gather real-world input and open feedback from IT managers. The persuasion and

implementation phases of the innovation-decision process were the main themes within

the study. Given the vast list of organizations required to do a full phenomenological

study on authentication technologies affecting the global market, census sampling was

the best alternative to conducting the inquiry of stakeholders necessary to answer the

research question in this study. Based on the limited international knowledge of the

organizations taking part in the research study, Ahmad (2014) gathered and triangulated

information from both interviewing sessions and experiential knowledge. Census

sampling enables researchers to gather adequate experiential knowledge and information

to complete their study without conducting an exhaustive and prolong inquiry process of

all organizations. Focusing the questions on the main phases of the DOI theoretical

framework ensured sampling data saturation on the main themes of the research study

(see Baldwin & Fellingham, 2013).

Definition of Terms

Chief information security officer (CISO): The corporate-level person responsible

for the security of their organization’s computing environment (Souppaya & Scarfone,

2013).

Chip-and-PIN: Smart card technology with an embedded chip on the credit card

read by a card reader and requires the input of a PIN to complete a transaction (Figliola,

2015).

EIT: Emergent IT that organizations may or may not adopt (Cegielski et al.,

2013).

EuroPay, Mastercard, and Visa (EMV): The original instance and standard of

chip-and-PIN technology for electronic transaction payments. Chip cards are formally

known as EMV cards, named for the coalition of three companies: Europay, MasterCard,

and Visa (Figliola, 2015).

IDT: A model used to define how new ideas are disseminated among people in

society (Cadarette et al., 2016).

Interview protocol refinement (IPR) process: The process used to efficiently

collect, record, and document information from participant interviews (Castillo-Montoya,

2016).

POS terminal: The equipment used to execute the exchange of funds during a sale

of goods and services (Abubakar & Ahmad, 2013).

Technology acceptance model (TAM): A method to measure user’s acceptance of

technology. TAM is often used to analyze data and information collected for quantitative

and mixed method studies (Tan et al., 2014).

Thematic analysis (TA) process: A method for identifying and analyzing patterns

in qualitative data (Clarke & Braun, 2013).

Unified theory of acceptance and use of technology (UTAUT): A widely used

theory to evaluate end-user ’s adaption to innovation and information system changes

(Chang et al., 2016).

Assumptions, Limitations, and Delimitations

Assumptions

To establish the baseline and communicate essential ideas of the study, past and

current factors pertinent to the topic are defined as assumptions within the study

(Kirkwood & Price, 2013). My first assumption was that a current review of available

literature indicated a need for further exploration in the body of knowledge and strategies

for implementing chip-and-PIN authentication technology within the United States.

Another assumption was that the organization’s IT manager plays a key role in bringing

resources, stakeholders, and technologies together to deliver the appropriate security

measures and authentication infrastructure. My last assumption was that successful

implementation of chip-and-PIN POS terminal authentication technology within the

United States will reduce the security risks associated with conducting e-commerce

payment transactions with credit cards.

Limitations

Limitations are the expect shortcomings of capabilities within a study to provide

a total solution to the entirety of the problem or phenomenon (Brutus et al., 2013). The

first limitation was based on the variety of organizational structures and e-commerce

hardware infrastructure utilized in the United States. Therefore, the study could not fully

inform, cover, and provide a strategic solution for every type of credit card POS terminal

infrastructure. The next limitation was the fact that online e-commerce purchases do not

require the credit card to be present, limiting the effectiveness of studying the use of chip-

and-PIN authentication technologies as it relates to an online website and online e-

commerce purchases. The final limitation was that the findings of the study may not

include strategies that are suitable and applicable to all organizations.

Delimitations

Delimitations define the parameters and scope of a study (Podsakoff et al., 2016).

To present an effective, comprehensive, and informative qualitative pragmatic study, I

applied three main delimitations. The first delimitation was the established size of the

population of the participants in the study. To focus on specific planning and

implementation strategies, the interview participants were IT managers in the retail

industry. The second delimitation was that the interviews were conducted using

participants located in the United States. The final delimitation was the fact that large,

internet-only, web stores were not evaluated in this study.

Significance of the Study

Contribution to IT Practice

IT managers are challenged to provide the most secure computing environments

for their users, both internal and external. Protecting their business’ customers from credit

card fraud and stolen PII are mandated compliancy requirements. With limited

implementation of chip-and-PIN credit card authentication systems within the United

States, the findings from this study may inform all stakeholders on the benefits and

capabilities of chip-and-PIN credit card transactions. The results of this study may also

provide an informative set of findings to fill the IT knowledge gap for consumers,

managers, and security professionals required to implement and maintain chip-and-PIN

credit card authentication infrastructures in the banking and consumer-facing economic

industries. The findings of this study may provide strategies used to improve the

efficiency of the processes currently in place to implement credit card chip-and-PIN

authentication technology. In addition, the study results can be used as an IT strategic

template to efficiently transition other nations to the same credit card authentication

platform, securing both consumers utilizing credit cards and vendors providing services

within the global e-commerce market.

Implications for Social Change

The results of this study may contribute to positive social change through

potentially being used to help protect businesses and consumers from credit card fraud.

Consumers using chipped credit cards may reduce the risks of credit card fraud and

financial liability to merchants, resulting in lower administrative costs and fees levied

against all stakeholders in the e-commerce process (Robertson, 2014). The findings of

this study might help to inform individuals about the current status of the IT innovation

processes of chip-and-PIN credit card authentication. These individuals might use their

increased IT knowledge to communicate, demand, and insist that businesses and their

business partners increase credit card security with chip-and-PIN authentication

infrastructures. Paying for services with the more secured chip-and-PIN credit cards may

be safer when conducting business with local and international service providers. Once

the chip-and-PIN credit cards authentication infrastructures are implemented throughout

all financial and business institution globally, individuals traveling worldwide would

have easier and safer access to their buying power, reducing their risks of potential credit

card fraud. Informed credit card users, their vendors, and banking institutions may be on

a more secured e-commerce security platform, reducing the number of identity theft

crimes committed. Additionally, the study results can be used as a strategic template to

help efficiently transition other nations to the same credit card authentication platform,

securing both consumers utilizing credit cards and vendors providing services within the

global e-commerce market. Securing the electronic exchange of funds by using chip-and-

PIN authentication technology can reduce the amount of credit card fraud and number of

crimes committed.

A Review of the Professional and Academic Literature

In this literature review subsection, I present and review historical information

and empirical data related to the topic of the study. Additional research and the collection

of literature was conducted to support the methodology and conceptual framework used

to guide this study. I conclude this section with a final summary of literature research and

findings.

The literature review is organized in three main categories: scholarly, peer-

reviewed; non-peer-reviewed; and scholarly seminal literature. I present the literature in

the following order: a review of the current IT status, IT problem, methods to design and

develop the study, and methods to collect and validate the data from participants of the

study. The majority of literature was selected from academic and professional

organization databases, including ProQuest, Sage, Thoreau, and Science Direct. The first

phase of the review was to collect the appropriate data to confirm the need of the study

topic and the specific IT problem. A thorough search in online library databases and

government-sponsored statistical sites provided exemplary supporting information to

support the study. I conducted further review of the literature to establish the conceptual

frameworks and models that were used to support the foundation of the study. Extensive

research was conducted on how innovation diffusion is an effective research concept used

in the decision-making process for EIT. It was important to ensure 85% of the total

supporting literature sources address current IT technology issues and have a publication

date of less than 5 years ago. The selected peer-reviewed studies, papers, and journal

articles support established facts, proven theories, and known limitations to the topic

under study. The percentages and statuses related to the literature reviewed are listed in

Table 1.

Table 1 S of Literature Review

Summary of Literature Review

Reference type

Total

Published less

than 5 years ago

Published more

than 5 years ago

Peer reviewed

Non-peer reviewed

Seminal source

Application to the Applied IT Problem

The purpose of this qualitative pragmatic study was to explore strategies used by

IT managers to transition their e-commerce organizations to chip-and-PIN credit card

authentication infrastructures. In the literature review, I addressed the specific IT problem

and strategies applied to implement chip-and-PIN credit card and POS authentication

infrastructures. The first portion of the literature review includes a description of the

impact of the IT problem and importance of having a concerted strategy to address the

problem. In the second area of the subsection, I discuss the IDT conceptual framework

and the application of IDT constructs to the IT problem. In addition, literature outlining

previous IDT research and findings are presented. In the closing subsection, I summarize

the literature review, emphasizing the application to the IT problem and need for further

research study.

According to the 2013 Federal Reserved Payments Study, the estimated number

of unauthorized card payment transactions in 2012 was 29.5 million, with a total loss

estimated at $3.9 billion (Gerdes et al., 2013). The U.S. Department of Justice, Bureau of

Justice Statistics, National Criminal Justice found approximately 66% of credit card fraud

victims experienced a financial loss (Harrell, 2015). The main theme and phenomena

under study was the lack of chip-and-PIN credit cards and POS-enabled terminals in the

United States. A federal and financial institution compliance mandate required

organizations to implement the more secure chip-and-PIN capability by fall of 2015;

however, some retailers have not fully converted to the full implementation, forcing

customers to use the older magnetic strip methods to authenticate their purchases (Bush,

2016). The two-factor authentication process, using chip-enabled terminals with a secret

PIN, provides a more secure electronic payment transaction.

Despite the increase in issuing of chip-and-PIN credit cards by the banking

institution, some merchants are still not capable of providing chip-enabled authentication

infrastructures (Bush, 2016). Some merchants have upgraded POS terminals; however,

their networks are not enabled or certified to accept chipped cards. Recent banking

statistics indicate an increase in U.S, EMV payment transactions, but minimal in

comparison to other continents and nations, such as Europe, Africa, Asia, Canada, Latin

America, and Caribbean (EMVCO.com, 2016; Milker, 2007; Shepard, 2016; Wakamori

& Welte, 2017). Figures 1 and 2 show the comparison with other continents.

Figure 1

Statistics of EMV Transactions

Note. Adapted from “MasterCard Reports Strong US EMV Uptake. 2016. EMV CHIP

Deployment statistics,” by R. Boden, 2016 (http://www.NFCworld.com). Copyright

2016 by Taylor & Francis LLC. Reprint with permission.

Figure 2

Statistics of EMV Chip Card Deployment and Adoption

Note. Adapted from “MasterCard Reports Strong US EMV Uptake. 2016. EMV CHIP

Deployment Statistics,” by R. Boden, 2016 (http://www.NFCworld.com). Copyright

2016 by Taylor & Francis LLC. Reprint with permission.

Data collected by MasterCard indicated a 105% increase in chip-and-PIN card

usage since the October 1, 2015 transition of liability to merchant’s deadline (Shepard,

2016). Even with the risks of liability for fraud and abuse of noncompliance credit cards,

the 2 million merchants using chip-and-PIN enabled networks account for only 33% of

U.S. merchants using chip-and-PIN card technology (Boden, 2016). According to Peter

Larkin, President and CEO of the National Grocers Association,

None of these delays are the fault of merchants, yet it’s the merchant who is

facing an onslaught in new chargebacks as well as confusion among consumers

who don’t understand why they can’t use their chip cards at their local

supermarket. (Karolefsk, 2016, p. 1).

Implementation of chip-and-PIN card technology in U.S. e-commerce markets is lagging

behind the expectations of the payment card industry standards.

The comparisons between the U.S. credit card industry and other nations shows a

great deficit and limited progress in improvements in U.S. credit card authentication

technology infrastructure and protection of customer privacy (Boden, 2016; Wakamori &

Welte, 2017). Credit card transactions using chip-and-PIN reduces security risks because

EMV transactions at chip POS terminals provide more security of consumers’ personal

data than magnetic strip POS transactions (Foxworth, 2015). Rockwell (2013) argued that

payment cards are often targets of fraud schemes that victimize the issuing financial

institution and individual cardholders. The physical characteristics of payment credit

cards can determine the ease at which they can be compromised, and typical

counterfeiting methods were linked to counterfeit payment cards (Rockwell, 2013).

Credit card fraud is mostly associated with credit cards equipped with only magnetic strip

authentication features that are not capable of the chip-and PIN process at POS terminals

(Cepeda et al., 2015). The findings from these studies show and support the need to

implement the transition from magnetic strip authentication to the chip-and-PIN process.

With the growth in debit and credit cards as the main method of paying for

services and products, there is a need for improved security of the card-based

authentication system. Organizations must implement their IT solutions and innovation in

an ethical manner (Kernaghan, 2014). Vendors are obligated to protect the customer’s

privacy rights under the Fair and Accurate Credit Transactions Act (Cepeda et al., 2015).

User’s acceptance of the new technology is critical for the successful implementation of

the chip-and-PIN authentication systems. The usage of credit cards is aligned with

consumer confidences in the protection of their data and privacy (Arief & Adzmi, 2015).

Customers will discontinue the use of credit cards at POS terminals if they believe the

systems are unsecure. Implementing and educating customers on the increased security of

the chip-and-PIN authentication systems will provide them with the confidence needed to

continue using the convenience of credit cards.

Current trends for protecting access to computing environments include

multifactor authentication. Two-factor authentication is a proven method used to ensure

the right individuals and only that user can access data, providing confidentially (Choi &

Park, 2015). Secure authentication is accomplished when a user must use two different

identity factors to complete the authentication process (Kaur & Pathak, 2015).

Combining biometrics technology as one element in the two-factor authentication process

increases the security capability and complexity; biometric authentication includes the

use of fingerprints, iris scans, face, and voice recognition (Martinovic et al., 2017).

Multiple researchers have validated the advancement in the use of biometrics as a means

for user authentication, with the possibility to use data representation modules within

multimodal biometric systems to take advantage of facial recognition (Choi & Park,

2015; Martinovic et al., 2017; Moon et al., 2015). Payment card industry (PCI) systems

can benefit from the dual usage of biometric systems for both data collection and user

authentication (Choi & Park, 2015). The implementation of two-factor authentication

methods demonstrates the potential effectiveness of using biometrics as a method of

increasing security beyond smart card authentication.

Chip-and-PIN Smart Card Technology

Chip-and-PIN enabled credit card technology is an effective method of

implementing two-factor authentication (Smith et al., 2018). The leading system for

smart card-based payments worldwide, EMV, is widely deployed in Europe and is

starting to be introduced in the United States as well (Bond et al., 2015). Chip-and-PIN

enabled credit card technology is the foundational method used in e-commerce, two-

factor authentication. The chip-and-PIN authentication process requires certified

hardware and software systems to take full advantage of the more secure electronic fund

transfer authentication method (Fourar-Laidi, 2013; PCI DSS, 2018).

Organizations are implementing various infrastructures that allow them to have

secure e-business transactions. Bond et al. (2015) found that despite this wide

deployment, a series of significant vulnerabilities make EMV vulnerable to the replay

attack. Implementing changes to security specific protocols within the security

authentication process and introducing a new authentication scheme will increase the

strength of smart card authentication (Jiang et al., 2015). A framework-based solution can

use smart cards to store keys and perform cryptographic algorithms, allowing e-

commerce partners to realize secure transactions (Fourar-Laidi, 2013). Shin et al. (2013)

expanded on the ideas of emerging capabilities in the dual-chip contactless card. There is

the ability to overcome the insecure credit card transaction by using biometrics to activate

the smart card technology. Elements and principles used in the listed technology can

provide benefits for all stakeholders and support strategies in gaining IT investment

funding support from C-level officers (Shin et al., 2013). Fully communicating the risk of

conducting insecure electronic fund transfers to both customers and vendors will support

the organization’s business needs statement and potential benefits to their profits.

The use of business intelligence is improving the effectiveness of companies in

understanding their customers’ requirements and increases the return on investment of

their business initiatives (Ogiela & Ogiela, 2014). Converting the raw data collected from

customers into business intelligence requires organizations to collect sensitive and

confidential information from their customers (Soilen, 2016). Banks use their customer

databases and analytics tools to craft highly sophisticated pictures of their customers’ and

prospects’ values, profitability, and credit risks and then bombard them with 2 billion

credit card solicitations every year (Peppers & Rogers, 2013). Credit card information

and consumer usage habits are maintained in databases, presenting increased risks to

customer privacy (West & Bhattacharya, 2016). Organizations must have a

comprehensive strategy for implementing secure credit card transaction authentication

and protection solutions.

IT managers are responsible for providing the most secure computing

environments for their organization’s users, both internal and external. With limited

implementation of chip-and-PIN credit card authentication systems within the United

States, protecting customers from credit card fraud, privacy, and stolen PII requires a

viable IT strategy that compliments the organization’s business strategy. Drnevich and

Croson (2013) found that without an alignment between business and IT strategies, a

business will not be effective. The relationships and confidence between the CEO, CIO,

and IT managers are essential elements to ensure IT solutions contribute to the overall

strategy of the organization. Supporting the CEO’s strategies with IS contributions is a

key factor in successful organizations (Johnson & Lederer, 2013). Well-developed IT

strategies and investments increase the performance of an organization (Mithas & Rust,

2016). The IT manager plays a key role in developing and executing the IT investments

to secure their IT infrastructures and gain stakeholder buy-in for new systems.

Data and financial data security are a significant concern in business and in IS

education from both a technological and a strategic standpoint. The establishment and

requirements of the Payment Card Industry Data Security Standard (PCI DSS), and the

associated consequences for noncompliance, represents a business-like approach to the

organizational protection of data (Willey & White, 2013). PII, electronic health records,

and financial data are prime targets for hackers seeking means to compromise the privacy

of individuals. Performing and evaluating qualitative IS research is best conducted using

a proven methodological framework (Antonenko, 2015; Green, 2014). Advancing an

organization’s business model to e-commerce requires a well-developed strategic plan

and framework (Kaptein & Parvinen, 2015). The environmental concern must be

considered to develop the appropriate framework and explore the factors needed to

successfully evaluate the phenomenon. In some instances, a combination of multiple

frameworks may be required to accurately measure the acceptance of innovation and the

concerns of the environmental culture (Ho et al., 2015). Organizations must identify and

use a comprehensive framework to accomplish their chip and PIN credit card

authentication implementation strategy.

Diffusion of Innovation Theory, Core Elements

In 1962, Rogers framed the IDT. The IDT is a model used to define how

innovative ideas are disseminated among people in society. The core elements of the IDT

are awareness, persuasion, decision, implementation, and confirmation. The innovation

diffusion theory model is depicted in Figure 3. Innovation defines the introduction of a

new idea. Diffusion is an effective method to introduce new ideas to people in a social

network (Dutta & Omolayole, 2016). The IDT provides tools to determine the factors,

uncertainty, resistance, and rate of diffusion of a technology (Zsifkovits & Gunther,

2015). For a better understanding of the phenomena and ability to confer the themes to

the reader, creating visual models and mapping is very effective means to demonstrate

the point (Antonenko, 2015). The innovation diffusion framework will be an excellent

means to evaluate, study, report findings, and make recommendations for future research.

In 2003, Rogers refined, popularized, and documented the DOI, explaining how

innovation is communicated in a social system. The diffusion of innovation theoretical

framework will be used to conduct this qualitative pragmatic study. The IDT model is

depicted in Figure 3.

Figure 3

Graphic Illustration of Innovation Diffusion Theory Model

Note. Adapted from Diffusion of Innovations (5th ed.) by E. Rogers, 2003, Free Press.

Innovation diffusion is an effective research concept, used in the decision-making

process for EIT (Cegielski et al., 2013). The innovation-decision process consists of five

main levels: knowledge, persuasion, decision, implementation, and confirmation.

1. Knowledge: The process of learning about the innovation or the phenomenon.

2. Persuasion: The time in the process where personal feelings and value

judgements are made to form a final perception on the innovation.

3. Decision: The actual process of communicating a final stand on which to act

on the innovation.

4. Implementation: The process of using the innovation.

5. Confirmation: The process is used to evaluate the decision and results of the

implementation, for the validity of the innovation.

The innovation-decision process model is depicted in Figure 4.

Figure 4

Graphic Illustration of Innovation-Decision Process Model

Note. Adapted from “Evaluating Adoption of Emerging IT for Corporate IT Strategy:

Developing a Model Using a Qualitative Method,” by C. G. Cegielski, D. M. Bourrie, &

Taylor & Francis LLC. Reprint with permission.

Without an established framework, it is difficult to adequately define the concepts

and themes of the study (Antonenko, 2015). Cegielski et al. (2013) EITs represent an

avenue for enhancing the effective and efficient flow and utilization of information

within the organization to support business objectives and, ultimately, firm performance.

This research study applied the constructs of the innovation-decision process, to gather

and analyze input and open feedback from IT managers. Innovation stems from

knowledge recombination of prior discoveries and applications, the individual capacity to

search for knowledge over both familiar and unfamiliar technological domains is also

likely shaping fundamental processes in creativity, problem-solving, and innovation

within organizations (Van Knippenberg et al., 2015). Caiazza and Volpe (2017) used the

innovation diffusion process to study the adaptation of precision farming technologies.

Zhang et al., (2017) emphasize the importance each stakeholder and their efforts to bring

about IT innovation acceptance within their organization. Successful IT solutions depend

on the effective implementation of a strategic framework such as the innovation diffusion

processes, between stakeholders and their customers. The phases of the innovation

diffusion process assist in identifying roles; innovator, adopters and, intermediaries

essential to applying the technology (Caiazza & Volpe, 2017). Using the innovation

diffusion process, I was able to identify the key implementation players and stakeholders

in a successful implementation of chip and PIN technology.

The decision, implementation, and confirmation phases of the innovation-decision

process were the three main themes within my doctoral study. These three phases were

selected based on their alignment with the strategic critically of getting stakeholders buy-

in and witnessing the success of end-user usage of the strategy. The decision phase

addresses the need to convince the organization leadership to adapt the technology and

communicate the security advantages to consumers. Leaders, within an organization, are

critical to creating the culture for change and be enablers for innovation (Camps &

Molina, 2014). The implementation and confirmation phases covered the banking

industry issuing of chipped credit cards, POS hardware installation, software

certification, and customers successfully completing PIN and chip transactions. Denning

and Dew (2015) found that 90% of innovation is in fostering adoption. Organizations are

often slow to adapt new innovations, based on perceived risks and cultural attitude

towards change (Martins et al., 2014). Adopting change requires the ability to listen for

concerns, histories, movements of social power, barriers, moods, reactions to offers, and

followers in networks (Denning & Dew, 2015). In the decision phase, the IT manager

must have a strategy which can convince stakeholders within his organization to adapt

the new IT innovation.

Cost savings is one of the most popular factor in the means of persuading

organizations to adapting new information technology. Franceschinis et al. (2017)

evaluated the coherence of the underlying preference structure using as criteria

psychological constructs from the theory of diffusion of innovation. Using the theory of

diffusion of innovation was a means to validate the theory by providing evidence of

segmentation of the population consistent with the individuals’ propensity to adopt

innovations (Franceschinis et al., 2017). Franceschinis et al. findings indicated that

preferences for heating systems and respondents’ willingness to pay for their key features

vary across segments. “These results enabled us to generate maps that show how

willingness to pay estimates vary across the region and can guide local policy design

aimed at stimulating adoption of sustainable solutions” (Franceschinis et al., 2017, p.

314). Potential cost savings are very effective incentives to gain support and funding for

new technology.

The medical industry benefits from the uses diffusion of innovation conceptual

theory in research and implementation of new medical procedures and equipment. “Our

aim was to examine the speed (number of publications over time) and spread (across

institutions) of each innovation and interpret uptake relative to innovation attributes, the

social system, and communication channels” (Cadarette et al., 2016, p. 151). The Islamic

community, often seen as a group which is slower to fully adopt technological

innovations, provided a great opportunity to validate the effectiveness of the diffusion of

innovation conceptual theory. Jamshidi and Hussin (2016) applied the innovation

diffusion theory in their review of the adoption and understanding of credit card usage in

the Islamic community. In the medical service industry and Islamic community, Jamshidi

and Hussin’s finding showed the alignment of customer satisfaction with services has a

noticeable final impact on social influence.

Valente et al. (2015) incorporated the diffusion of innovation theory in their study

to understand the level of efforts for diffusion of future information. Stages in the

diffusion of innovation theory were effective in measuring the status of organizations and

adopters within the innovation network. Valente et al. findings showed that online

communication networks accelerated the ratification process. By using the data and

analysis produced from the stages in the theory, the World Health Assembly can develop

specific communication plans to spread the Framework Convention on Tobacco Control

(FCTC) information about tobacco use and health safety.

The diffusion of innovation theory can be used to compliment other theories and

framework within a study. In a study conducted by Nehme et al. (2016) the research

measurement properties were designed to align the transtheoretical model (TTM) stages

of changes with the diffusion of innovation theory stages. In comparison, the DOI staging

approach was more effective than the TTM at classifying the readiness for adopting

change (Nehme et al., 2016). One of the main findings was the advantage of using a

theory-based construct from outside the normal methods to evaluate health behavior

research (Nehme et al., 2016). The combined research analysis theories were successful

in identifying the value which transportation bicycling provided towards preventing the

risk of chronic diseases.

Given the popularity of the internet, networks, and infrastructures used to connect

the global exchange of information on the internet is affected by the innovations of

diffusion in technology as well. Chen and Li (2014) conducted a study to analyze the

complex dynamics of technical upgrades in the innovation of diffusion process. Chen and

Li introduced the concept of Diffusing Mode of Innovation in the study. The mode

included several types of innovation: institutional innovation, innovation of management,

and technical innovation. Technical innovation occurs quickly and is usually forced on to

other industrial networks to keep up with the standard. According to Chen and Li

industrial network is a scale-free network, it makes the diffusion of innovation on

industrial network very easily, and each enterprise has different affection on the whole

industry. Technical innovation diffusion is an enabler for other forms of innovation, as

supporting innovation infrastructure and knowledge management innovation multiplier.

Another perspective of adoption of innovative technology is the difference

between men and women, in regard to accepting new technology. Dutta and Omolayole

(2016) conducted a study of the influence of gender on the accepting technology and

innovation diffusion. Internet usage was technology measured in the study. The study’s

initial indications were that women prefer using information technology largely to satisfy

their bonding and sharing nature whereas men prefer using information technology

essentially as an enabling tool that enhances their abilities (Dutta & Omolayole, 2016).

Despite minor differences between genders, the results indicate that acceptability to new

information technologies are gender neutral (Dutta & Omolayole, 2016). The diffusion of

innovation conceptual theory proved once again to provide valuable insight in quality

research studies.

The diffusion of innovation conceptual theory has historically been applied to

many different industries to understand their best strategies to implement new

technology. Harvey (2016) used the innovation diffusion concepts in his research on the

adaptation of the new 45 RPM single and 33 RPM album technology in the recording

industry. The standardization of the 45 RPM single and 33 RPM albums in 1951 forced

the recording industry to rethink their marketing strategies (Harvey, 2016). Findings from

the study conclude that the industry tended toward sub optimal, risk-averse strategies, and

that the LP likely succeeded despite record companies’ efforts to control their products

and messaging (Harvey, 2016). The diffusion of innovation conceptual theory was

successfully used to gauge a major change in not just the recording industry, but to how it

affected society as a whole.

Similar to the changes in the music recording industry, the travel industry

transitioned from store front services agencies to more services being provide online. The

travel communities and travel service agencies experienced a major change in the way

consumers acquire travel process and arrangement. With more consumers making their

own travel arrangements with online booking sites, Agag and El-Masry (2016) conducted

a study using the IDT and TAM models to explore the behavior and intentions of

customers to conduct their travel process online. Customers were more positive towards

using online travel services than visiting a travel agency office. The findings indicated

that users of the online travel community services were more likely to recommend the

services to others (Agag & El-Masry, 2016).

Eastwood et al. (2017) used the diffusion of innovation conceptual theory process

to study the adaptation of precision farming technologies. The primary purpose of the

study was to examine the interaction and distribution of research and extension roles of

public, private, and agricultural industry organizations in precision farming innovation

systems. A timeline analysis method, underpinned by a function of innovation systems

framework, was used to examine activities of actors and organizations in the case studies

(Eastwood et al., 2017). One of the major findings from Eastwood et al. study was that

complex agricultural innovations require a collaborative approach for successful

innovation and diffusion. As earlier mentioned, the innovation diffusion process was used

to identify key roles and the impact they had on the adoption of new innovations.

In Nieuwenhuijsen et al. (2018) quantitative study, a diffusion of innovation

theory was used to determine the acceptability of automated vehicle technology. Despite

the multitude of advantages offered by automated and self-driving vehicles, there was no

major increase in the purchase of those vehicles. One of the main themes identified from

using the DOI theory was that the maturity of technology in automated vehicles were in

direct relations with market size. DOI analysis provided valuable and iterative feedback

about the rate of acceptance of vehicles and sales of automated vehicles. Nieuwenhuijsen

et al. findings were able to show the gradual acceptability of new automation features in

vehicles over a longer period of time.

Research using a DOI theory methodology is prevalent in many technology

disciplines. Hosseini et al. (2015) study involved the aspects of diffusion of innovation in

the architecture, engineering, and construction industry. To ensure safety to populations,

architecture, engineering, and construction methods are being standardize globally. It was

important to study the global understanding and usage of the innovation of diffusion

methodology within these industry communities of practice. Global virtual engineering

team’s efficiency and effectiveness are affected by the level of acceptance of the

innovative technology. According to Ozorhon et al. (2014) findings, innovation barriers

are responsible for the limitations experienced in construction organizations.

Implementation of innovation diffusion within construction is highly depending on

government enforcement (Na Lim, 2014).

Simpson and Clifton (2017) used diffusion of innovation in their study of early

adopters of solar energy in Australia. The goal was to demonstrate that Rogers’ theory

would benefit the adoption of emerging solar technology, based on incentives.

Government policies promoting the new technology through diffusion of innovation was

evaluated, especially providing financial incentives. Simpson and Clifton findings attest

to the effective use of incentive to drive the adoption of innovation. No matter what

industry diffusion of innovation is a critical element to move technology forward.

Zhou and Li (2014) employed the diffusion of innovation theory in their analysis

of the carbon emission reductions in China. The intent was to analysis how

improvements, acceptability, and use of new technology could decrease the carbon

emission affecting the population. According to Zhou and Li findings indicate economic

growth is driving up carbon emission. However, industrial enterprises implementing

technology innovation diffusion techniques could increase technology measures to reduce

carbon emission. Zhou and Li study is another example of the wide-reaching effect and

values the diffusion of innovation conceptual theory has in the analysis of accepting

technology innovation.

When considering the possible conceptual frameworks and theories, the public-

sector innovation (PSI) theory was reviewed as a possible framework. Gow (2014)

presents a variety of samples in innovation theories to examine possible changes within

the PSI theory. The outcome seems to be two themes in innovation theory changes.

Innovation is seen either through a structured process or a continuous series of events in

trial and errors. It seems that there is still important disagreement about what constitutes a

true innovation, with the debate centering on the merits of a multitude of lesser

improvements versus a smaller number of major, disruptive, changes (Gow, 2014). Glor

‘s (2015) grounded theory approach to examining the innovation of change within

organizations argues that researcher cannot apply preset categories immediately, but must

develop substantive theory first, then see if others’ categories are linked to the emergent

substantive theory. The PSI theory would limit the potential applicability of this research

study, excluding the value to private sector organizations.

In addition to the innovation diffusion theory conceptual framework, literature

exploring the UTAUT and TAM theories for IT services were widely reviewed, as

possible conceptual frameworks to conduct this study. The constructs: performance

expectancy, effort expectancy, social influence and facilitating conditions, of the UTAUT

theory is widely used to evaluate end-user ’s adaption to innovation and information

system changes (Chang et al., 2016). UTAUT is a mature conceptual framework,

developed on the improvement from other proven theories of technology adoption (Rahi

et al., 2018). UTAUT was used to provide a comprehensive model of user’s motivation to

use mobile payment card systems (Morosan & DeFranco, 2016). Maillet et al. (2015)

study findings were very comprehensive; however, demonstrated some limitation in the

use of UTAUT to gain a totally non-refutable study result. Khalilzadeh et al. (2017) used

the hybrid of the UTAU and TAM theories to incorporate the user’s attitude in an effort

to increase the efficacy of their study. The TAM theory is often used to analyze data and

information collected for quantitative and mixed method studies. Tan et al. (2014)

findings confirm that convenience is a key factor in mobile payment adoption. If

consumers find the innovation useful, they are more likely to adopt the services offered

(Rahi et al., 2017). Seetharaman et al. (2017) study using the TAM model validated an

85% supportability of acceptance of mobile wallet in Singapore. This is particularly in

view of the advantages brought about by mobile credit card over cash or credit card

payment in terms of quicker and more convenient transactions. In the Tan et al. study, the

model only takes into consideration two constructs, resulting in the overall prediction as

not considered to be complete. Under that circumstance, the PSI, UTAUT, and TAM

conceptual theories were not sufficient to be the independent conceptual framework,

requiring additional constructs to defend the findings of the study.

IT is constantly changing. The methods and conceptual models used to measure

changes and innovation must be adaptable to changes in technology. Overemphasis on

construct measurement can lead to operationalism: a naive empiricism that reduces a

concept to its measures. Substituting operationalization for conceptualization means that

the original assumptions and meanings underlying the concept are left unexamined

(Welch et al., 2015). One model can totally represent all factors affecting the adoption of

innovation by customers (Park & Lee, 2014). Caiazza (2016) study provided insight into

the importance policy maker exert on the overall success of innovation diffusion. Legal,

economic, technical, and cultural barriers degrade the process of diffusion (Caiazza,

2016). Without the support of policy-maker to adapt appropriate policy and governance,

consumers and providers of technology innovations suffer from innovation barriers.

Focusing the questions in the study on those three main phases of the innovation

theoretical framework ensured sampling data saturation on the main themes of the

research study. Given the main objective of the study, the diffusion of innovation theory

was used to evaluate, study, report findings, and make recommendations for future

research.

Previous Research and Findings

Previous research conducted on smart card technology, like chip-and-PIN

technology, show the favored potential for security. However, research indicates that

organizations are not taking full advantage of the value. Conroy’s (2014) article is a

summary of the state of chip-and-PIN credit card usage in the United States. “Despite the

liability deadline, by the end of 2015 only 70% of credit cards in the U.S.A. are expected

to be EMV-ready, and only 41% of debit cards. This is according to a report released by

the Aite Group in October 2014” (Conroy, 2014, p. 1). Banks and vendors will be held

responsible for protecting the integrity and privacy of the credit card. “According to the

Aite report, credit card fraud has doubled from 2007 to 2014, reaching 10 cents out of

every $100 in transactions. Most financial institutions are preparing to use Chip-and-

Signature to secure credit cards, and Chip-and-PIN to secure debit cards” (Conroy, 2014,

p. 1). After the banking industry issues all credit cards with chip technology, the security

risks and financial liability transfers to vendors and their point of sales systems. In

addition, Conroy (2014) illustrated the financial costs to credit cards holder and banking

industry. The data supports the negative impacts of vendor’s credit card authentication

systems not moving to the new chip technology.

Users must trust in the security of the emerging technology before they will use it.

Jones and Leonard, (2014) study tested a model of buyer's trust in customer to customer

e-commerce. By examining previous trust models, perceived web site quality, third-party

recognition, fear of seller opportunism, information asymmetry, and Internet safety

training were found to influence buyer's trust in conducting e-commerce transactions

(Jones & Leonard, 2014). Tsohou et al. (2015) argued that security awareness processes

are associated with interrelated changes that occur at the organizational, the technological

and the individual level. Organizations which can provide consumer confidence in their

products and security of their organization business systems are more likely to keep their

customers and strive financially.

Vuori and Huy (2016) conducted a qualitative study of Nokia to understand its

rapid downfall over the 2005–2010 periods from its position as a world-dominant and

innovative technology organization. The authors found that top and middle managers’

shared emotions during the smartphone innovation process caused cycles of behaviors

that harmed both the process and its outcome. Vuori and Huy study showed managers

were afraid of external competitors and shareholders, while middle managers were

mainly afraid of internal groups, including superiors and peers. The authors findings

indicate that shared emotions can hinder the subsequent integration of attention,

influencing innovation processes and outcomes and resulting in temporal myopia—a

focus on short-term product innovation at the expense of long-term innovation

development.

There were previous research and study findings from multiple functional areas

supporting the effectiveness of using biometrics as a method of increasing security

beyond smart card authentication. Moon et al. (2015) study improve on the theories and

scheme findings presented by Lu et al. study on advanced scheme authentications. The

recommendation is to use the findings and collection of empirical data to support the

need for further study in the application of credit card smart card technology. Jiang et al.

(2015) study supports the premises that smartcard authentication is more secure than

simple login ID and password authentication. Jiang et al. findings support the capability

for enhanced technical controls of the authentication process, leaving opportunities to

further inquire about the human behavior aspect and reasons for the slow implementation

of smartcard usage in the United States.

There are statistics demonstrating the abuse and misuse of card credits in

electronic payment transactions. According to the 2013 Federal Reserved Payments

Study, the estimated number of unauthorized card payment transactions in 2012 was 29.5

million, with a total loss estimated at $3.9 billion (Gerdes et al., 2013). Gerdes et al.

(2013) covered a variety of payment statistics including the charts and graphs, giving an

unexpected visual effect and interpretation of the data. The data presented in the study

provides enough data saturation to confidently substantiate the premises of abuse in

unauthorized credit card transactions. However, it is limited to data, that was collected 7

years ago, leaving opportunity for further research efforts.

The U.S. Department of Justice Bureau of Justice Statistics National Criminal

Justice finds approximately 66% of credit card fraud victims experienced a financial loss

(Harrell, 2015). Collins (2015) presented up to date information on the use and

circulation of EMV cards.. The fact that the credit card company expects 60% of all large

U.S. retailers to have implemented EMV by the end of the year. EMV transactions

specific algorithms are not publicly known, criminals cannot (easily) replicate the

algorithm to produce counterfeit credit cards (Collins, 2015; Martinovic, et al., 2017).

The findings indicate the value of using a chip and PIN technology to conduct e-

commerce transactions.

Those Federal Bureau of Investigation (FBI) statistics were used in my research

study to emphasize the additional network security benefits of using two-factor

authentication. In addition, EMV card transactions transmit data between the merchant

and the issuing bank with a special code that is unique to each individual transaction. The

unique transaction code provides the cardholder greater security and makes the EMV

card less vulnerable to criminal activity while the data is transmitted from the chip-

enabled PoS to the issuing bank (Foxworth, 2015; Shu et al., 2016). Kamel and Lanet

(2013) described and defined the most common and dangerous attack named cross site

scripting and propose solutions to prevent and check if the Web application is well

developed, by applying secured development methodology. Kamel and Lanet study

demonstrates the lack of knowledge of technical solution providers in the methodologies

available for securing e-commerce smart card transactions. Hendi (2011) study

demonstrates the effective uses of chip-and-PIN authentication to deter credit card fraud.

Reduction in credit card fraud was successfully tracked over a period of years to

substantiate the technology as the leading cause for the reduction. There was quantifiable

evidence that the majority of credit card crimes against the United Kingdom credit card

owners were committed from overseas, by using stolen credit card information in

countries without upgraded chip-and-PIN authentication technology (Hendi, 2011).

Lewis et al. (2014) findings indicate that a lack of security in e-commerce infrastructures

are technology-related obstacles and barriers to international e-commerce. Research

shows credit card transactions without chip and PIN technology introduces vulnerabilities

to the global payment card industry.

There has been progress made in the uses of empirical studies, to further the

transfer of knowledge to the information security industry. Hemphill and Longstreet

(2016) acknowledged the constant changes to security evaluation measures, challenges to

restore confidence in technology security standard. It is important to understanding the

cybercrime impact to stakeholders and providing them adequate information with

methods for practical applications to protect credit card users (Arief & Adzmi, 2015).

Choi and Park (2015) found the need for further research on multimodal biometric

systems and supports my premise for a further doctoral level research study. Shin and

Lee (2014) expanded on the ideas of emerging capabilities in the dual-chip contactless

card, using a user’s fingerprint to active electronic payment transactions without the

requirement to interact physically with a POS terminal. There are future challenges to

improve credit card fraud detection frameworks and continue the studies required to

attracting more industrial contributions to body of knowledge (Fiore et al., 2017). The

security of electronic fund transfers using credit cards requires continuous review,

application of emerging technologies, and innovative methods for improvement.

Implementing chip and PIN technology is essential; however, validation and

continuous improvement to the system is required. In a study by Ouerdi et al. (2013), the

authors address the need to conduct vulnerability testing as a prerequisite to building

security into trusted credit card security systems. The scope of the study was to develop

robust test cases and run exploiting attacks against the vulnerability within the payment

systems. Ouerdi et al. generated vulnerability test cases based on models of EMV

specifications. The findings from this study provided supporting data for establishing

relevant content to my research study and need for additional rigorous testing of

authentication processes.

After a major comprise and data breach is conducted successfully, organizations

must be able to react to the effects. Organizations must acknowledge, repair, and provide

protection from future threaten events. Bahnsen et al. (2015) using a real credit card fraud

dataset provided by a large European card processing company, compared state-of-the-art

credit card fraud detection models, and evaluated how the different sets of features have

an impact on the results. The authors present statics, conceptual theories, and frameworks

about security breaches and trust repair strategies in their study. Wan and Zhang (2014)

argued managerial step can lessen concerns about “cheap talk” and the limitations of

mere words to repair trust after a violation. Wan and Zhang study proposes possible

research suggestions about repair after privacy breach incidents. An important part of the

implementation of a new authentication system is to gain back the confidence of the

customers affected by the previous security breach. This information supported the

quality of the data collected for the doctoral study.

In their efforts to reduce security risks and limit financial liability caused by

security breaches, organizations are seeking other secure methods process credit card

transactions. Lundberg et al. (2014) shed light on how retailers view alternative payment

forms and to what extent they are willing to risk offending their customers by imposing

payment restrictions. The focused was solely on the retailers’ point of view on the

payment stage, implying a need for additional research on customers’ and bank

representatives’ views on the same matter. Citizens and stakeholders buy in is critical in

successfully implementing smart technology (Yeh, 2017). A study by Lundberg et al.

focuses on how the banking industry has and can lead in providing a more secure e-

commerce. Lundberg et al. provides a comparison between European and United States

banking industries. The United States has the largest number of financial loss due to

credit card fraud. “In the United States, although fraud constituted less than 1% of total

expenditures, credit card losses totaled $5.33 billion, an increase of 14.5% from 2011”

(Figliola, 2015, p. 2). Growth in e-commerce, international trade, reduction of trade

restrictions, market capitalization of new nations, and globalization increases the uses of

credit card transactions. Increase access to automated teller machine and vendors

accepting credit cards has increased the use of credits cards for travelers. Figliola findings

show globally, card fraud totaled $11.3 billion in 2012, an increase of 15% from 2011.

With statistical data validating the increase in credit card fraud, the implementation of

chip-and PIN technology is an essential authentication technology, to reduce the growing

problem.

The internet of things (IOT) has increased the capability of using near-field

communication (NFC); virtual credit cards, credit cards payment services loaded on

phones, iPad, token devices, and other Bluetooth credit card payment options. Shin and

Lee (2014) described how mobile payment is the integration of near-field communication

(NFC) enabled smartphones and credit/debit/prepaid cards. Using the TAM and

Technology Readiness and Acceptance Model, Shin and Lee (2014) demonstrate how

those conceptual frameworks can be effectively implemented in a doctoral study. The

banking industry in South Korea provides a digital certificate for the online banking users

at no cost. The personal digital certificate must be saved on a personal smartphone.

Without buying hardware authentication token, online banking users in South Korea can

use their own smartphone for their authentication in South Korea. Shin and Lee study

suggest that to be a successful payment service, the NFC mobile payment service must be

much more focused on the usefulness against other alternative payment methods. This

was a reliable source for presenting an alternate perspective other than chip-and-PIN.

One of the growing security problems with credit card transactions is the Card-

not-present (CNP) vulnerability. Without the actual credit card being present during the

transaction, other non-tangible factors must be validated, requiring the vendor to depend

on the verbal confirmation of the person making the CNP transaction. Pouwelse and

Bruggink’s (2016) address the growing complications of securing credit card transactions

by CNP transaction fraud, within a study. Pouwelse and Bruggink study indicate that card

fraud is a key cybercrime activity, with a full-scale underground economy. Conducting

the study in Europe allowed the authors to draw from the ample amount of data collected

on their credit card systems. Pouwelse and Bruggink present an effective depiction of the

contrast of card fraud in the USA compared to the rest of the world. Biza-Khupe’s (2014)

study examined consumer information acquisition activities for banking services by

proposing a model postulating search as influenced by perceived benefits, perceived risk,

perceived search cost and prior knowledge. The tests measured a comprehensive model

of consumer credit search behavior using structural equation modeling. The implications

of these findings to theory and policy, particularly as concerning rethinking financial

information regulation in consumer financial markets (Biza-Khupe, 2014). CNP is the

weakest area and highest risk facing the credit card payment transaction process. The

findings from all recent studies indicate the importance of using the more secure chip-

and-PIN method of authentication. The value of chip-and-PIN is lost in a CNP

transaction.

Security breaches, computer viruses, malicious codes, and new hacking methods

are being developed every day. These security threats are having a macroeconomic

impact on the global payment card industry (Banka, 2017). Preventing or reducing the

damage of these security threats require continuous innovation of technology and how

humans use technology. There is a crucial need to continue analyzing human aspects in

information security, because technology alone cannot deliver complete security

solutions (Ashish et al., 2017). A common theme expressed throughout the literature

reviewed was the need to continue further research on the improvement of user

authentication technology, human side of information security, and integrating it into all

phases of the information systems development life cycle. Until a higher percentage of

merchants implement chip and PIN capable infrastructure, there is ample reasons and

justification to conduct studies to explore the IT problem. In addition, there are limited

peer-reviewed documents and resources published addressing chip and PIN technology

implementations in the United States. Most documentation references the

implementations and statistics in Europe, Asia, and Africa.

Transition and Summary

The purpose of this qualitative pragmatic study was to explore strategies used by

IT managers to transition their e-commerce organizations to point-of-sales smart card

authentication infrastructures. In this section, I conducted an extensive literature review,

revealing some example of the success of chip-and-PIN technology in other countries.

The review provided insight into the gaps in the body of knowledge addressing the

insecurities of credit card purchase in the United States, without using chip and PIN

technology.

The following two sections of this study presents a comprehensive synthesis of

the selected theories and concepts, as they applied to the problem statement and purpose

of the study. In section 2, I provided detail explanations of the researcher’s role, data

collection process, and methodology used to validate the quality of the data. For the third

and final section, I included a summary of the data, findings, and application to IT

discipline. Also, I summarized additional recommendations made for further study and

benefits to social change.

Section 2: The Project

In Section 2, I present a comprehensive synthesis of the selected theories and

concepts as they apply to the problem statement and purpose of the study. Detailed

explanations of the researcher’s role, data collection process, and validation of the quality

of the data are also provided in this section.

Purpose Statement

The purpose of this qualitative pragmatic study was to explore strategies used by

IT managers to transition their e-commerce organizations to chip-and-PIN credit card

authentication infrastructures. The targeted population was IT managers in e-commerce

organizations located in the United States who had strategies to transition their

organizations to a chip-and- PIN credit card authentication infrastructures. In the findings

of the study, I identified strategies that other IT managers can apply to efficiently

transition their e-commerce organizations to a chip-and- PIN credit card authentication

platform. The implications for positive social change include the increased security of

credit card transactions and protection of consumer’s PII as well as the reduction of fraud

in the global e-commerce market and number of financial crimes committed.

Role of the Researcher

To examine each organization’s chip-and-PIN implementation strategies, I was

the primary interviewer and data collection manager. In a qualitative study, the researcher

is heavily involved in the interview, data collection, and assessment processes of the

phenomena (McClusker & Gunaydin, 2015). In their study, McClusker and Gunaydin

compared the research method and design choices and indicated the role the researcher

plays in each design. From this comparison, they reported that the qualitative researcher

was more immersed in the data collection activities of the phenomena than a quantitative

researcher. I initiated all correspondence with the participants, conducted all interviewing

sessions, and collected and maintained all the data (in the form of participant interview

audio recordings, field notes, other empirical data, and data files) in the current study.

Although I have knowledge on the use of chip-and-PIN technology, no personal

or professional relationships existed between me and selected participants. I used chip-

and-PIN smart card technology on a daily basis to access my desktop computer at my

workplace. Without a successful chip-and-PIN smart card authentication login process, I

cannot access my computer or network resources in my organization, so I am very

familiar with the topic. Until the participants were selected, I only knew them as

members of organizations with a POS technology presence. Several of the potential

participating organizations have their headquarters in the United States. I did not have

any relationship to the geographic locations of the participating organizations. The

organizations and geographic locations selected for this study were chosen based on their

ability to broaden the reach of retail organizations with substantial amounts of POS

technology presence.

To ensure I conducted the research study in an ethical manner, I followed all

elements within the Walden University institution’s ethical guidelines. I requested

approval from the Walden University Institutional Review Board (IRB) to conduct my

study. IRBs provide oversight on studies involving human subjects, protecting

participants from unethical research practices (Cross et al., 2014). In my request for

approval, I provided my National Institutes of Health (NIH) Protecting Human Research

Participants Certification Number 1794335 (see Appendix B) to the IRB. I protected the

privacy and information of all participants by following the guidelines laid out in The

Belmont Report (see U.S. Department of Health & Human Services, 1979). Under the

rules established in The Belmont Report, interviewers are required to ensure all

participants and protected sensitive groups are not harmed by the research and

interviewing processes (Barker, 2013). I had a complete understanding of and then

adhered to the guidelines of the Walden University IRB and The Belmont Report to

ensure all participants were protected and the study was fully aligned with expected

ethical requirements.

As a certified system engineer and IS security professional, I have vast experience

and technical skills acquired throughout my 35 years in the IT security field. A

researcher’s experiences have influence on their interviewing methods and interpretation

of the collected data (Anyan, 2013). Despite having experience in the field of study, it

was important that I adhered to the interviewing strategies and protocol for best accuracy.

In West and Kreuter’s (2013) study on the behavior of interviewers, experienced

interviewers were just as likely to make mistakes as non-experienced interviewers,

whenever they did not stick to the observation strategies. Having vast experience and

familiarity with the topic can present potential issues to the study concerning the

researcher’s influence and personal bias. Conversely, as an experienced professional and

subject matter expert in the field under study, my experience may provide valuable

insight on the best means to interpret the data collected. I mitigated bias by accurately

documenting the statements and contents provided by each participant. Immediately

annotating and recording the answers of the interviewees reduced the risks of bias (see

Chenail, 2011). I used a proven interview protocol and data collection technique, coding

the data collected and removing the names and specifics of the participants. Aligning the

coded data to the established themes removes potential risks to researcher bias (Pierre &

Jackson, 2014). Instituting an effective interview protocol and data collection and coding

processes and then following those standards rigorously reduced the possibility of bias in

the study.

Conducting an effective research study relies on the ability to bring credibility to

the data collected in the study. In a qualitative study, the interview process is a

fundamental method used to collect most of the data to be analyzed. A qualitative study

can be conducted using public available records, organization data, and interviews

consisting of semi structured and open-ended questions (Zohrabi, 2013). Based on my

pragmatic inquiry design, this study required me to be consistent in the way I conducted

the interviews across all organizations. I used a general interviewing protocol method to

gather multiple perspectives of an organization’s experiences with implementing chip-

and-PIN authentication technology (see Appendix C). An interview protocol is used by

researchers to ensure the structure, elements, and questions are conducted the same across

all interview sessions (Patton, 2015). Interview protocols keep both the interviewer and

interviewee focused on the main research question and topics. Interviewing IT managers

in different organizations provided the appropriate data sets to validate the research

findings. I designed and presented the interview questions in a manner to ascertain

specific information from IT managers based on a comparison between the old methods

of magnetic strip authentication and the new chip-and-PIN system. Maintaining

consistency and integrity of the data collected is most efficient when an interview

protocol is established, implemented, and followed (Castillo-Montoya, 2016). Using a

general interviewing protocol method ensured the interview sessions were organized and

credible in this study.

Participants

To gain the most accurate data about chip-and-PIN implementation strategies, e-

commerce organizations were the targeted population in this pragmatic inquiry. The

participants were IT managers within the organizations selected. IT managers within the

organizations were interviewed because interviewing a group of subject matter experts is

the best way to gather information to support a research topic (see Sutton & Arnold,

2013). Managers at the executive level make the decisions on how organizations will

implement their security posture (Flowerday & Tuyikeze, 2016). IT managers are

expected to guide the implementation of IT security measures within their organizations

(Ashenden, & Sasse, 2013). Organizations experience high turnovers of their IT security

managers due to the increased cybersecurity complexity and stress of the position (Clay,

2015). The inclusion criteria for the participants were 2 years of experience as an IT

manager and 1 year of experience with their current organization. Senior managers and

their understanding of the value of IT security in their organization is a critical factor in

understanding and reducing security risks (Barton et al., 2016). The organizations’ IT

managers were subject matter experts who implemented security solutions within their

organizations and was able to authoritatively speak to the strategies used in their

implementation of solutions.

My strategy to gain access to participants for this study included written

correspondence, telecommunications systems, mail messaging systems, and online

collaboration applications. I searched for participants in organizations that have an e-

commerce presence. I received permission to interview IT managers, who were the

selected participants within organizations. I initiated contact with interview candidates by

web interface, email, or phone, if email was not possible. Phone communication with

perspective participants is an effective means to ensure maximum participation in the

study (Flood-Grady et al., 2017). I sent a formal invitation to participants through online

collaboration software or written email along with a consent form included as an

attachment. Two weeks was sufficient time to gain a response from the potential

participants. Participants agreed to the interview session either by making a website

acknowledgement, email confirmation, or official mail correspondence. The researcher’s

views and methods used in communicating with participants can affect the quality of the

study (Berger, 2015). Phone calls, emails, and online collaboration events were used to

schedule the culminating interviewing session for each IT manager. Online and other

technological methods are available to conduct interviewing sessions; however, face-to-

face interviews provide the strongest validity in gaining the most convincing study

findings from participants (Bowden & Galindo-Gonzalez, 2015). Using the web

collaboration tools, internet, “contact us” mailboxes, phone calls, and follow-up

scheduling calls gave me full access to participating organizations and their

representatives.

To establish a working relationship with the participants, I scheduled a

preliminary interview kick-off meeting. To build trust and gain the participant’s

confidence, I discussed the purpose of the study, explained the interview protocol,

established the interview session framework, and confirmed the time schedule.

Interviewers should have an interviewing concept and be familiar with the questions they

will pose to participants (Mittereder et al., 2017). I explained the data collection methods,

IS measures, and record storage procedures to the participants. Protection of participant

information is required by law and enforced by the IRB process. Participants will be

more willing to share information knowing that their information will be protected

against unauthorized disclosure (Beskow et al., 2014). I used final follow-up and open-

ended questions to get the interviewees to share their implementation strategies,

experiences, and recommendations on how to best implement chip-and-PIN systems.

Open-ended questions provide participants with the opportunity to explain their reasoning

behind their initial answer to a question. (Yii et al., 2014). Member checking can be used

iteratively to validate information provided to the researcher for clarity and alignment

with the research question (Harvey, 2015). I used member checking to validate the

accuracy of the data collected.

The researcher can establish a positive working relationship with each participant

by providing an effective open channel of two-way communication, communicating

expectations, synchronizing schedules, and following the interviewing protocol. To

ensure the main research question is answered by the appropriate participants, IT

managers within organizations were the key person to interview. I abstracted study data

from IT managers using an interview protocol, consisting of eight sub questions

supporting the main research question. The IT manager had the opportunity to bring all

available resources with them to the interview and were provided with enough time to

answer each question in detail.

Research Method and Design

In this study, I employed a qualitative methodology with a pragmatic inquiry

design as the most appropriate means to explore the themes of the phenomenon. In this

subsection, I identify, discuss, and review other potential methodologies and designs that

were considered. In addition, I explain and justify my research methodology and design

decisions.

Method

I selected a qualitative methodology as the most suitable means to explore

strategies used by IT managers to transition their organizations to chip-and-PIN credit

card authentication infrastructures. I selected the qualitative method to engage in a more

in-depth, exploratory dialog with participants interviewed in the study. A qualitative

methodology allows the researcher to gain information on the participants’ experiences

and interpretations of the phenomenon (Sutton & Austin, 2015). Incorporating open-

ended questions and taking detailed field notes allowed me to better understand the

participants’ responses to the interview questions and the themes they expressed. I used

the open-ended questioning technique because it was effective in extracting a clearer

understanding from the subject matter experts’ perspectives. My field notes helped me

explain some of the nonverbal expressions made by participants.

The qualitative research method empowers participants to be more open and

express themselves, resulting in a more comprehensive research study (Edwards &

Brannelly, 2017). A more comprehensive study provides data saturation and more

evidence towards establishing dependability in the findings of the research study. The

qualitative research method gave participants the freedom to expound on their ideas,

experiences, and application of their strategies. By empowering the participants to speak

openly and unfettered, an interview question could initiate a richer discussion about a

specific theme the participant may feel is more important to explain their experience of

the phenomenon. A qualitative interview session also provides flexibility that allows the

researcher to ask about and understand the whole experience of the respondent (Makrakis

& Kostoulas-Makrakis, 2016). As a means to gain the full picture, I asked each

participant to explain any other critical relationships and partnerships affecting the

success of their strategies. Using a qualitative research method provided me with more

agile and spontaneous interactions with my participants, allowing me to adjust the

questions and model the study according to the emerging themes.

In the initial search for the best research method, quantitative and mixed-method

approaches were two other methodologies considered. A quantitative methodology can

reveal statistical information and test hypotheses of the past and current phenomenon

(Frels & Onwuegbuzie, 2013). My assessment, of understanding the problem within the

study, did not reveal a need to test a hypothesis or compare statistical analysis of the

organizations participating in the study. I did not think numerically grading each

organization against each other organization would provide the insight and interpretation

of feelings of individuals who experienced the phenomenon. Quantitative research

findings are commonly used to conduct numerical analysis of a hypothesis, rather than

non-numerical data assessments (Landrum & Garza, 2016). The approach of this study

was not to measure variables, prove a hypothesis, or compare the statistical outcomes of

each organization’s strategy. The most important aspect of the study was to explore and

understand the strategies that were used by each organization. Using a quantitative

method would have limited the interpretation of the participant’s experience in the

phenomenon. A quantitative method provides more detailed information base on

measuring specific variables but limits the interpretation of the phenomena experienced

by participants (McCusker & Gunaydin, 2015). Given those factors, a quantitative study

approach did not align with exploring the IT problem within the study.

Another methodology considered was a mixed-methods approach. A mixed

methods approach is a methodology which uses the data sets and statistical results from a

quantitative method combined with qualitative methods to further interpret the reason of

a phenomenon (Mauceri, 2014). With the main intent of the study was to determine the

strategies to answer the “how” and “why” questions, conducting an initial quantitative

study would not align with the IT problem and research questions, within this study.

Without a need to test a hypothesis or compare numerical statistical analysis of each

organization, I believe there was no reasonable cause to conduct a mixed method

approach. Tsushima (2015) findings indicated mixed-method research needs to be

constructed based on measurable variables and present information which cannot be

accomplished by conducting either a single quantitative or single qualitative method.

Based on Tsushima definition of a mixed methods approach, I did not believe the

research questions in my study required conducting both a single quantitative and a single

qualitative method to explore strategies used in a chip-and-PIN smart card authentication

process. Conducting a mixed-methods approach can a create conflict of the established

norms of both qualitative and quantitative approaches (Archibald et al., 2015). I think a

mixed methods approach would confuse the themes, audience, and focus of the main

research question. My decision was further supported by the fact that this study did not

have a hypothesis. Therefore, a quantitative method or a mixed methods approach was

not appropriate for this study. The qualitative method was used to explore the strategies

used by some IT managers to transition their e-commerce organizations to chip-and-PIN

credit card authentication infrastructures.

Research Design

A pragmatic inquiry design was used in this study. A pragmatic study is an

exploratory research design of a phenomenon, to gain in depth insight from multiple

groups of individuals experiencing the phenomenon (Lohre, 2020; Nipp et al., 2016). A

pragmatic inquiry design was used to explore strategies by organization’s IT managers. A

pragmatic study is an effective design to investigate a contemporary phenomenon,

utilizing participants and analysis of publicly available data in real-world environment

(Agrawal, 2021). IT managers participating in the study were the perfect candidates to

explain their experiences and strategies. Using a pragmatic inquiry design provided in-

depth insight into each organization’s experience, transition strategy, and strategic

perspective from their IT managers. Interviewing and collecting their verbal and written

statements gave the opportunity to document the phenomena. Pragmatic studies provide

the means to use multiple methods to gather and document the participant’s experience of

the phenomena (Pagnini et al., 2021). Documenting the information from the participants

provided the factors to define, establish, and refine the themes needed to report the results

of the study. The results of the pragmatic study can be used to inform the other

ecommerce organizations facing the same IT problem and determine future requirements

for further studies. Pragmatic study research allows for an exploratory and conceptual

understanding of the emotional and cultural behaviors of the studies participants (Mao et

al., 2021; Stewart, 2016). Conducting a pragmatic study allows the research study to be

shown as transferable, based on validating the study across multiple organizations. To

ensure the appropriate level of scrutiny of the IT problem across the ecommerce industry,

a pragmatic inquiry was the best suited design approach.

When selecting the best study designs, ethnographic and phenomenological

designs were considered as possible alternatives to a pragmatic inquiry. An ethnographic

design is used to capture and compare organizational cultural influences, behaviors, and

experiences of participants within a group, during their live experience of the

phenomenon (Jarzabkowski et al., 2014). In the ethnographic research study design, the

researcher participates heavily in the group experiencing the phenomenon (Berthod et al.,

2017). Ethnographic studies require the researcher to involve themselves in the physical

events and actions of the group within the study of the phenomenon (Mears, 2013). The

intent of the study was to learn from successful strategies which have already been

executed, by the participants, not to go through the transition with them. The recruited

organization’s information security measures, confidentiality requirements, and need-to-

know policies would limit the researcher’s ability to successfully conduct an

ethnographic study design.

A phenomenological design study collects data from in-depth and multiple

interviews with each participant, who have already experienced the phenomenon (Gill,

2014). A phenomenological approach can lead to different interpretations and acceptance

of the facts, due to the individual perspective of everyone (Whittemore, 2014). Everyone

within each organization was interviewed, only the appropriate IT managers.

Phenomenological studies place more focus on individual experiences (Tomkins &

Eatough, 2013). The primary goal is to gain a comprehensive and consolidated strategic

insight from each organization, not multiple strategies from every employee. Based on

the need to research multiple organizations and their strategies used during their

transition, a phenomenological and ethnographic design approach would not be as

effective in exploring in-depth the strategies and transition events from IT managers, who

experienced their organization’s transition to chip-and-PIN credit card authentication

infrastructures. Therefore, ethnographic and phenomenological designs were not selected.

O’Reilly and Parker (2013) agreed with the concept of saturation, that qualitative

research is concerned with the richness of information and the number of participants

required. I ensured all formats of data, information, and opportunities to gather

information were exhausted. Appropriate saturation depends on the nature of the topic

and the resources available. It is acceptable, therefore, that any limitations of sampling

adequacy are transparently reported. Researchers thus need to be clear in dissemination if

they reached saturation, how they reached it and what issues they faced during

recruitment (O’Reilly & Parker, 2013). To ensure data saturation, a larger amount of

invitation should be extended to potential population audience than is required for the

maximum participation of interviewees (Fusch & Ness, 2015). I sent multiple invitations

out to potential participants, ensuring full participation for the pragmatic inquiry.

Applying a rigor inquiry concept ensured saturation, as well as the reliability, validity,

and dependability of the population and sample. J. M. Morse (2015) insisted data

saturation is essential to establishing rigor, which is the concern of external evaluators

who ultimately determine the worth of qualitative research. External evaluators of the

data collection and analysis techniques provides creditability to qualitative research study

(Cope, 2014). In addition, empirical data collected from other relevant studies can be

analyzed to determine the effectiveness of census sampling size within the study (Berthod

et al., 2017). To effectively explore the research topic and ensure data saturation, a

pragmatic inquiry design was the optimal design for use in this study.

Population and Sampling

The populations selected for this study was the IT managers of e-commerce

organizations. The population was located in the United States. Identifying the

appropriate population and sample size are key elements in the conducting a success

research strategy and gaining accurate findings for a study topic (Robinson, 2014). I used

census sampling of selected organizations in the retail industry. In a pragmatic study, a

census selection method involves participation from all organizations in consideration.

Census sampling allows researchers analyze members within targeted populations

(Bossuyt et al., 2020). Researchers must identify and determine the sample size, which

aligns best with their problem statement and address the desired research validity

(Bengtsson, 2016). Developing the representative sample size requires the evaluation of

potential bias (Enticott et al., 2017). To effectively represent the group affected by the

problem, a census sampling method was used to select the sample size. Census sampling

is an effective method to gain understanding of the research problem from a smaller

population most familiar with the problem (Roy et al., 2015). Lucas (2014) findings

indicated the use of census sampling must be conducted in a manner which generalization

of the overall population is consistent with acceptable social research. Using census

sampling, the populations selected for this study was IT managers in e-commerce

organization. IT managers are the executive level officer responsible for; sponsoring,

reporting, and executing the funding for the final solution. Qualitative study’s do not

have mandatory or minimum sample sizes. Sample size is based on element of the

research strategy and expected quality of data (Elo et al., 2014). The sampling method

used resulted in a sample size of five, which was determined based on the population size

of e-commerce organizations. In a one-phase approach candidate screening effort, Yin

(2014) recommended avoiding prolong screening of each individual candidate, which

slows down the process and may become individual case studies themselves.

Consideration of the potential harm to interviewee’s leadership position, valuable time,

confidentially, and privacy within their organization must be respected. A qualitative

pragmatic inquiry research by Johnson (2014) exploring ethical issue associated with

researchers shadowing healthcare CEOs demonstrated the need to consider the potential

harm and unwarranted exposure of the participant. Johnson’s research of top managers

included a small sample size to satisfy ethical review requirements, but not overload busy

managers. Johnson considered the rich data collected from the CEOs would be better

than from a larger group, as long as the CEOs were given the confidentially and privacy

they needed to participate in the research but not impact their workload. I took into

consideration the mission impact to the IT manager within each of the organizations in

the pragmatic inquiry. The sample size was determined based on the ability to have

enough data saturation to compare strategies between organizations who have already

implemented chip-and-PIN authentication technology. The IT managers were

interviewed through an online collaboration tools or at a location within their

organization, providing a setting where they can discuss matters confidentially and free

from bias. The interview questions were provided to the interviewees prior to the session,

allowing them time to gather their thoughts and reflex on their implemented solution

strategies. Interviewing the IT managers enabled access to them and to other supporting

resources they may provide, during the interview. The researcher asked open-ended

questions and provided the interviewee the opportunity to elaborate on each question and

follow-up questions. There was the potential to collect briefing material, design notes,

and other artifacts used in their implementation strategy.

Collecting information from interview sessions, briefing materials, design notes,

and other data artifacts, provided sufficient information to support my study. I gathered

enough information, conduct triangulation, and member checking to fulfill data

saturation. Data saturation goals is the driving factor used in establishing the participant

population size for theoretical saturation (Hennink et al., 2016). Drew (2014) conducted a

study to determine the best means to overcoming barriers in qualitative interviews.

Interviewing organizations elites can be challenging; however, results in rich data

collected. Drew findings indicated the method and means the researcher engages the

interviewees will determine the success of data saturation from interview sessions. Data

and results from secondary data analysis can be helpful in validity and data saturation for

studies (Moy & Murphy, 2016). Moy and Murphy (2016) studied the differences in

survey data collected from primary verses from secondary collection methods. The

secondary data provided additional critical information, discussion of collection

methodology, and data comparison values. I sought out secondary and empirical data to

augment the interview sessions, incorporated in my study. The answers from the

interview sessions, additional empirical data, and artifacts assisted in accomplishing data

saturation. An explorative investigation of organizations, using member checking,

secondary data, and triangulation, provided ample amount of data saturation to compare

the different strategic implementations of their organization’s chip-and-PIN

authentication solutions.

Ethical Research

I ensured that all participants agree to the studies agenda and conditions. I had

each participant sign a consent form. The consent document is depicted in Appendix D.

IRB are boards established by research organizations to ensure each research study is

conducted in compliance U.S. federal regulations, international guidelines, and ethic

research standards. There was strict adherence to the ethical research standards, including

proof of IRB approval. IRB approval is required to conduct studies involving collection

of data from Human participants (Lunnay et al., 2015). Participants were informed of

their rights and expected roles in the study. Beskow et al. (2014) demonstrated in their

study the success achieved when informing participants of the efforts the researcher will

take in protecting their rights and privacy. Describing the terms and possible risks, the

consent form helped potential participants of the research to be aware of potential risk

and helped them make a more informed decision on their willingness to participating in

the study. The research strategy should provide protection of the participant’s privacy and

sensitive information (Mealer & Jones, 2014). The participants were briefed as to the

nature of the study and their rights to change their mind later and withdraw if necessary.

Participants could withdraw at any time, during the study. In accordance with the

consent form, participants were instructed on their right to withdrawal from the study. As

a means to ensure the integrity of the findings, the withdrawal process and effect on data

analysis should be addressed and documented in the study (Thrope, 2014). Participants

could verbally or in written format notify the researcher that they no longer want to be

involved with the study. Interviewees could verbally inform of their intent to withdraw

from the study to me by phone or face to face conversations. Interviewees could write an

email or a letter to indicate their intentions to end their participation. I would have

acknowledged receipt of the withdrawal notification and confirm the nature of any future

communications with the participant.

There was personal incentive or compensation for the participants of the study.

Paying incentives to participants to participate in a research study is not unethical.

Establishing the adequate amount to pay participants for an interview session was

considered appropriate for this doctoral study. If financially well off, participants can feel

insulted to be offered compensation for their efforts in a study (Killawi et al., 2014). For

example in Killawi et al. (2014) study of compensating research participants in Qatar,

offering a $30 dollar pre-paid mobile phone card could offend financially well off

participants. The researchers decided to offer the compensation after the end of the study,

to those who were interested in the $30 dollars pre-paid cards. Paying research participant

may coerce their participation and influence their response to study questions. Polacsek et

al. (2017) defined key terms, definitions, and assessments of what is acceptable when

paying research participants. Other than the logistical cost for hosting the research

interview session, paying an incentive could influence the participant’s sincerity to be

involved in the study (Polacsek et al., 2017). Participants were informed that their

involvement is volunteer and provides financial incentive for their time. The consent

form specifically stated that there is financial incentive for participating in the study.

Using a coding system, I separated the individual identifiable information from

the research data, ensuring the integrity of the study data. Data and personal information

should be instantly recoded with a random generated code (Turner et al., 2014). All

electronic data was processed on my laptop. All transmission and storage of data was

encrypted and remain encrypted while at rest. All data is stored on an external hard drive

and secured in a safe, whenever study data is not being used. Orrell et al. (2013)

conducted a qualitative study, examining continence services for older people, from a

service providers’ perspective. Due to the private and sensitive nature of the Orrell et al.

study topic, protecting participants and their client’s information was of utmost priority to

the researchers. Orrell et al. study emphasized the sensitivity of conducting a study and

need to protect participants information at all stages of the research process. In

comparison, an organization’s IT security data is sensitive and requires protection. I

explained the protection of private and sensitive data in the consent form, available in

Appendix D. I demonstrated my commitment, intention, and ethical requirement to

protect data, by providing my NIH Protecting Human Research Participants Certification

Number 1794335 to the IRB. My NIH certificate is presented in Appendix C. I will

maintain the data in a safe place for 5 years to protect the confidentiality of participants.

Data and paper files should be stored in a locked filing cabinet, which can only be

accessed by the researcher (Johnson, 2014). I secured the research notes, files, and

external hard drive in a lockable fire safe cabinet.

Data Collection

Instruments

I was the primary data collector. I conducted all the interviews and gathering of

study data artifacts. The effective collection of data is key to conducting a reliable

research study. The beginning phase of the research process is collecting data (Rimando

et al., 2015). In this qualitative pragmatic inquiry, a semi structured in-depth interview

was used as the primary data collection instrument. I conducted the interviews using

online collaboration tools and face to face methods, presenting open-ended research

questions to the IT managers within each organization. The findings of Wolgemuth et al.

(2015) studies indicate that semistructured interviews encourage free and open

discussions. Conversational interviews techniques between interviewer and interviewees

provide more clarity and accuracy of response (Mittereder et al., 2017). Conducting face

to face interviews results in more reliable and uncontested research data sources (Bowden

& Galindo-Gonzalez, 2015). A well-established interviewing protocol framework can

reinforce the reliability of the research (Patton, 2015). The research must ensure the

questions are appropriate for the audiences and aligned with the theme of the study

(Rimando et al., 2015). Prior to the interview session, the protocol process and questions

were rehearsed, using the four-phase process to IPR process. The IPR process consists of;

ensuring interview questions align with research questions, constructing an inquiry-based

conversation, receiving feedback on interview protocols, and piloting the interview

protocol (Castillo-Montoya, 2016). The protocol steps and interview protocol refinement

processes are presented in Appendix C. The goal of the data collection instruments in a

qualitative research study is to get a detail and in-depth understanding from the people

experiencing the phenomenon (Neuman, 2014). To gather more in-depth personal

knowledge and build a more conducive interviewing atmosphere, the majority of

subquestions asked to interviewees was open-ended questions. Qualitative research

methods making use of interviews with open-ended questionnaires is an effective means

to obtain, analyze, and interpret the research data (Yii et al., 2014).

In addition to interviewing sessions, I collected documents, available secondary

data, and existing organizational empirical data to support the data collected from

interview sessions, incorporated in my study. Secondary data sources strengthen the

reliability of qualitative studies (Reddy, 2015). In Reddys’ study he demonstrated and

emphasized the uses triangulation of interview sessions, empirical, and archival data to

strengthen the rigor of a pragmatic inquiry. The examination of secondary documents and

artifacts helps to explore the experiences of the phenomenon (Colorafi & Evans, 2016).

Colorafi and Evans used documentation and artifacts to support their data collection

process in a qualitative descriptive approach. I believe secondary documents and artifacts

helped to support data saturation. I used Microsoft Excel and Nvivo as document archival

and electronic data management applications to store and harvest data during the

collection process. Defelice and Janesick (2015) study of the use of technology in

phenomenological research indicated that using tools like spreadsheets and word

documents increased the efficiency of managing data within the studies. Microsoft Excel

is a very effective tool to collect, create, and analysis qualitative research data (Defelice

& Janesick, 2015). I used standard records and document management procedures to

properly label, store, and archive documents.

Based on the study’s semi structured data collection format, member checking

was conducted to facilitate data saturation from the interviewees. Member checking is a

method to ensure information was correctly recorded and interpreted, as stated by the

interviewees during the session (Shipherd et al., 2014). Member checking techniques

ensure the researcher doesn’t impose their own interpretation of the interviewee’s

reflextions (Harvey, 2015). Conducting member checking empowers the interviewees,

ensuring their interpretation of the questions and their answers are correct (Holmberg et

al., 2014). Member checking is a technique used to improve data collection, which was

used to enhance the credibility and internal validity of the study. The six main IT

managers focused questions and demographical background questions are listed in

Appendix A.

Data Collection Technique

Data collected from the interview sessions was used to set the baseline and

establish the supporting elements for the main themes. Additional data artifacts were

collected by email messages, electronic file exchanges, person to person, or by registered

mail. Primary data collection was be accomplished by recording each face-to-face

interview sessions, either by voice or video recording. Recording detailed data helps to

keep the researcher focused on the main themes of the study (Pinsky, 2015). Conducting

a face-to-face interview allowed me to observe the non-verbal and facial expression from

the interviewees. In a Mindfulness Meditation Training for Sports study conducted by

Baltzell et al. (2015), it was crucial for the researchers to monitor the verbal and non-

verbal expressions from the coaches, being interviewed. Baltzell et al. used audiotaping

and transcribing techniques, ensuring interviewer reliability when conducting their study.

I believe video or audio taping my interviewees provided the most reliable data. I

scheduled the interview session to last at least 1 hour. A 1 hour initial interview session

provided ample enough data to represent an organization’s experience of the

phenomenon. I was the primary transcriber of the interview recordings. A 45-minute

interview recording session could yield up to 30 pages of transcribed information (Sutton

& Austin, 2015). Using the time and page count estimate from Sutton and Austin study,

my interviews should yield approximately 40 to 45 pages transcribed information.

At the beginning of the data collection process, each organization’s IT manager

was sent an invitation letter requesting their participation in the study. After acceptance

of the offer, interviewees were sent consent forms and copies of the interview questions.

The interview session took place online. An interview session was scheduled for

appropriately 1 hour. At a minimum, interviewees were presented with a copy of the

interview questions, for submitting their written answers and additional comments as

necessary. The interview began with an introduction of the intent of the study, protocol

administrative announcements, review of the consent form, and the opportunity to decline

continuation of the interview. The researcher recorded the session with an online

recording system, based on organization’s policies, permission, and availability. At the

end of the interviewing session, the interviewee had the opportunity to provide immediate

feedback. The recording was made available for review at the end of the session.

Conducting in-depth face to face interviews provides the advantage of making a

more personal connection with the interviewee. The interviewer can better determine if

the questions were understood or fully answered, by observing both verbal inflections

and non-verbal gestures by the interviewee. Researchers can use face to face interview

sessions to generate casual conversations, building trust in the interviewee (Pinsky,

2015). Holmberg et al. (2014) research findings indicated that interviewees appreciated

the opportunity to interact with the interviewer, rather than answering the questions

without the ability to verbally express themselves. Comi et al. (2014) study shows the

possibility of including visual technique into qualitative interviews, to gain a better

insight into feelings about organizational change.

The most obvious disadvantage to doing an in-depth face to face interview is the

fact that interviewees may not feel comfortable being interviewed. Bourne and Robson

(2015) study inquiring on interviewing techniques for studies addressing sexual behavior

demonstrated that participants feared judgment by the interviewer, even though their

session data would be kept under strict confidence. Recording the interview session could

discourage potential participants (Killawi et al., 2014). Online surveys and other

anonymous methods of feedback allows interviewees to answer questions more freely,

without being judged by the interviewer and observing their nonverbal gestures (Bowden

& Galindo-Gonzalez, 2015). Another potential disadvantage of face-to-face

semistructured interviews, is the possibility of the researcher imposing their ideas and

limiting the personal insight or initiative of the interviewee (Rimando et al., 2015). As

stated above, conducting a pilot study would reduce time spent on the actual study and

reduce the available population for the final study interviews. Therefore, a pilot study

was not requested or conducted.

I used member checking to enhance the richness of data collected and gain data

saturation. Member checking of the notes and recording allows for confirmation of

translated information (Harvey, 2015). Caretta (2016) used a pamphlet in her study to

conduct member checking, which is one example of checking preliminary findings with

informants. After initial and final drafts of the transcript were completed, I scheduled

another interview session to conduct member checking with each interviewee. Each

interviewee was provided the opportunity to review and comment on the validity of the

interpretation of their statements, which they made during their initial interview session.

Member checking of the initial and consequential interview sessions provides the

opportunity for immediate verification of the content (Birt et al., 2016). Once all the

updates are verified and the interviewees were satisfied with their transcribed statement,

data saturation was meet from that interviewees.

As a part of the data collection process, I collected any available documents,

secondary data, and existing organizational empirical data, for the organization. To

harvest the additional documents, secondary data, and empirical data, I requested access

to documentations used in their implementation of their chip-and-PIN solution.

Documents and data which I requested were; strategic plans, project charters, project

management plans, technical working group meeting minutes, change advisory board

formal decisions, decision briefing, test and evaluation results, and administrative data

associated with their chip-and-PIN implementation. Email messages request and file

transfer exchanges were the primary techniques used to get the additional documents and

secondary data. I established an electronic journal to record documents, data files, and

any other media provided as artifacts for the study. One possible disadvantage, to using

this method to obtain paper-only document, was in the event that the organization does

not want to send the documents by mail. In such a case, an on premises face-to-face

interviewing session would have been necessary.

Data Organization Techniques

The data organization process was completed using both paper, and electronic

data formats, supporting a logical thematic data analysis process. The initial process

started with the storing of electronic logs and matrices, consisting of literature review,

research questions, and drafts sections of research study. All paper documentation, notes,

and other non computerized information media were converted into a data format

accessible by computers and capable for coding. After conversion to an electronic format

those documents were archived in a lockable fire safe cabinet. Electronic filing and data

storage provide convenient means to quickly develop, record, index, and manipulate

research data (Khan, 2014). Digital data was easy to copy and manipulate, allowing more

innovative method to analyze research studies (Childs et al., 2014). DeFelice and

Janesick (2015) used Call Graph and Audacity applications to record and quickly edit the

recording of their interview sessions, demonstrating the value of using electronic

applications and tools to organize their study data. I used Nvivo software. The next data

organization steps were recording and saving the interview sessions, using a voice

recorder and taking notes. I used a journal to documents any extraneous or miscellaneous

field notes. I used an online collaboration recording tools and Nvivo software programs

to record, extract, and transcribed participant’s answers. The recordings were saved to an

external hard drive for storage and review. Appropriate folders were created on the hard

drive to protect against data spillage or compromise of coded information. I used

computerized software programs, Nvivo and Microsoft Excel, to code the transcribed

data of each interviewee’s response to questions. I established a coding system to protect

the privacy of the participating organizations. Protecting participants, by masking their

identity is an essential requirement in qualitative analysis (Fielding et al., 2013). Coded

research information can be indexed and classified, to support the research’s main themes

(Pierre & Jackson, 2014). Coded information presented in Microsoft Excel spreadsheets

can be put through a rigorous and accelerated data reduction technique, increasing the

efficiency of the data analysis (Watkins, 2017). During the evaluation of the appropriate

software to conduct coding and analysis, NVivo software was taken into consideration.

Consider easy to use, researchers can collect, organize, and analyze various types of

research data with NVivo software (Castleberry, 2014). In comparison to other software

analyzing tools, NVivo requires more interactions from the researcher in the analysis

process (Sotiriadou et a., 2014). Zamawe (2015) used NVivo software in his study to edit

the recording of both video and audio files. NVivo software is considered reliable and

often used for thematic analysis (Derobertmasure & Robertson, 2014). Given the ease of

use with Microsoft Excel spreadsheets in comparison with the required addition

interactions from the researcher in the NVivo software analysis process, Microsoft Excel

spreadsheets was initially used for this study. However, Nvivo was used to refine the

coding and selection of emerging themes.

The coding of information was an iterative process, requiring the continuous

organization of coded revisions of interview transcripts. To preserve the integrity of the

research study and the ability to defend the research’s findings, information, and data

pertinent to the study must be protected. In addition to the coding process, I implemented

physical security of paper documents and data files, created during the study processes.

These security measures are mandatory ethical compliance requirements under IRB

approval (Wolf et al., 2015). Research institutions have formalized protocols for the

ethical treatment of research participants (Greenwood, 2016). Interviews, notes, and

recordings produce detailed data on participants that may present risks to them (Jordan &

Gray, 2014). Documents were maintained in a folder labeled with the appropriate

confidential and privacy designations. In addition, paper documents were scanned into

electronic format and afterward destroyed, as a precautionary measure. Electronic data

was stored on an external hard drive. All documents and data collected during the

research study will be stored in a locked container for 5 years.

Data Analysis Technique

I used a thematic data analysis process to explore the themes found within the

datasets created from the interviewing sessions with participants. A TA method is an

effective qualitative research data analysis design, used to focus on gathering the

experience of the participant of the study, subjectively (Firmin et al., 2016). Fugard-Pratt

and Potts (2015) findings indicated that the thematic analysis is appropriate for research

studies conducted with multiple participants. My research study involves multiple

participants and aligned with the methods used in Fugard-Pratt and Potts study.

Conducting several iterations of the thematic analysis process perfected the quality of

data analysis within my study. In Kissil and Nino (2017) study, several reiterations of the

thematic analysis process were needed to gain the final results. The thematic analysis

process allowed me to efficiently code, categories, assess, and compare the data patterns

and themes within the study.

Using TA, I reviewed the recorded semi structured interview sessions consisting

of 11 open-ended questions. Semistructured interviews allowed the interviewee the

ability to request further clarification and reflect on any additional ideas they may have

brought up themselves during the interview (Drew, 2014). I used online collaboration

tools and Nvivo software programs to download and transcribed the participant’s

answers. Post-coding analysis is the process of linking themes within the data to theories

(Pierre & Jackson, 2014). I analyzed the transcribed and coded data, produced by NVivo

and Microsoft Excel software programs. By applying the six phase thematic analysis

method Caton and Chapman (2016) were able to overcome the complexity and

challenges to determining their emerging themes. In their study, Caton and Chapman

were able to establish major themes from their research data, using the thematic analysis

method. I analyzed patterns and developed themes found within the coded data. I applied

the six phases of the thematic analysis process: becoming familiar with the data,

generating initial codes, searching for themes, reviewing themes, defining and naming

themes, and producing the report. These steps and expected results are listed in Table 2.

Table 2 T analysis process

Thematic analysis process

Phase

Description

Result

Becoming familiar with the data

Preliminary understanding of

answers/data and patterns

Generating initial codes

Create, define, and defend coding

methodology

Searching for themes

Develop list of possible themes from

coded data patterns

Reviewing themes

Validate accurate themes from specific

data patterns

Defining and naming themes

Finalize themes and explain correlation

to research problem

Producing the report

Final report and interpretation of results

of data analysis

I used the results from the thematic analysis process to define and align the final

data themes with the three main elements of the research’s conceptual framework. A

thematic approach produces a leaner set of measurable facts, by reducing the excessive

context collected during the interview (Kerwin-Boudreau & Butler-Kisber, 2016).

I used a methodological triangulation process, to ensure rigor within the study.

Three different data collection processes provided the expected rigor. Ponterotto (2014)

insisted that triangulation of both data sources and research methods are principal

elements to the iterative research process. Brown et al. (2015) used triangulation to bring

rigor into their mixed method study of nine dimensions, with 107 participants.

Triangulation is an effective method to validate the most convincing research findings,

for multiple types of research designs (Modell, 2015).

After using triangulation to compare the datasets collection analysis, I aligned the

major emerging themes with the elements in the conceptual framework. Using a

framework assist the researchers with organizing data analysis in a format to intelligently

present the findings (Green, 2014). I compared and contrasted the data analysis result

with the three applicable diffusion of innovation theory levels: decision, implementation,

and confirmation. The innovation diffusion theory is an optimal framework to address

emerging technology (Cegielski et al., 2013). Using the TA method, I analyzed patterns

within each theme. I contrasted and compared the elements supporting each theme

against the three major themes: decision, implementation, and confirmation. I categorized

the multiple themes into one of the three major themes. The final comparison of themes

provided insight on the strategies used in each organization, to implementation chip-and-

PIN technology. In the final analysis stage, the ability to effectively classify and interpret

the emerging patterns enhanced the ability to compare the resulting themes with the

phenomenon related to the purpose of the research study.

Reliability and Validity

Reliability and validity are essential criteria to establish trustworthiness in

academic research (Olson et al., 2016). Reliability relates to the consistency of a measure.

Reliability is achieved when the same responses occur each time the test is completed

(Faris, 2017). Validity is the methodologies and processes used to determine the final

conclusion of a study’s measurement are aligned with its inference. Validity in qualitative

studies is measured using four criteria: dependability, credibility, transferability, and

confirmability. Validity ensures that the findings are applicable to other similar case

studies (Baskarada, 2014). In my qualitative pragmatic inquiry, I employed the four

validity criteria to perfect the rigor and trustworthiness of my study.

Dependability

The trustworthiness of the content within a research study is critical to the

acceptance of the findings and potential implications for affecting change. Dependability

is an important aspect to supporting validity, ensuring confidence about the findings of

the research (Flower et al., 2016). I documented my research processes, maintain field

notes, and audit logs to provide dependability to this research study. Member checking is

an enabling approach to establishing triangulations of data and dependability of findings

(Birt et al., 2016). Participants, of the study, were given the opportunity to validate their

input, by reviewing their transcripts for errors or misunderstanding. Researchers and

participants must come to a consensus on the interpretation of the data to validate the

integrity of the outcome (Noble & Smith, 2015). Member checking establishes

dependability by showing an external validity of the researcher’s interpretation of the

participant’s experience. I used member checking to ensure participants interview

information is accurately transcribed. Morse (2015) insisted that using iterative

credibility practices; peer debriefings, member checking, and triangulation, support the

overall dependability of the study. Readers must feel the information in the research is

dependable and peer reviewed, by subject matters experts in the field.

Creditability

Validation of information in a research study will be established using credible

data collection and data analysis techniques. Credibility is shown when the methods used

to gain and verify the research information is trustworthy (Boesch et al., 2013). I

followed the participant recruiting and interviewing protocol, ensuring each participant is

a qualified subject matter expert and given the full opportunity to answer each question to

the fullest extent. Interviewing a group of subject matter experts is the best way to gather

information and build credibility, to support a research topic (Sutton, & Arnold, 2013). In

addition, having extensive experience in a particular field will make it more difficult for

researchers to not engage in biases. I used coding as a method to reduces my potential

bias and influence on the analysis of the data collected. Member checking and conducting

an audit trail are essential elements to reduce bias and distortion of the study findings

(Lub, 2015). Developing an effective coding system and using it when interpreting the

collected data will assist in limiting the personal bias from the researcher (Sutton &

Austin, 2015). I used member checking to assist with achieving creditability.

Transferability

The validity of a research study includes the ability to use the methods of the

study to benefit further studies. I included the extensive information, background, data

collection methods, and analysis technique to facilitate transferability of the study’s

findings. Transferability provides readers with descriptions of context and background of

the research study data (Hoyland et al., 2017). Transparency of the content, participants,

and data analysis rigor equates to transferability (Connelly, 2016). I defined and

described the methods and design used for conducting the research; conceptual

frameworks, protocols, and data analysis techniques. Aligning the theory and conceptual

framework of the study with the findings makes the study more transferable to other

studies (Colorafi & Evans, 2016; Reilly, 2013). To ensure transferability of the themes,

concepts, processes, and finding within this study, the interview techniques, questions,

data coding, and analysis will be designed in formats and a framework applicable for use

in other research topics. In this study, I used proven processes, methodologies, theoretical

and conceptual frameworks such as; DOI theory, protocol and IPR process, and thematic

analysis method.

Confirmability

A quality research study is developed from factual data and free from bias.

Research findings which contradict the values of the researcher might suffer from

personal and selective citation bias. Confirmability methods are used to ensure the

research study and findings are not affected by potential bias by the researcher

(Kornbluh, 2015). Triangulation of multiple data sources can provide other perspectives

and remove bias from the researcher (Olson et al., 2016). In contrast to the standard

validity framework used in a quantitative study, qualitative research is not based on

traditional criteria for judging validity using variables and independent variables.

Therefore, confirmability in a qualitative study requires the study to be confirmable by

and external party. When conducting qualitative research external validity is of utmost

importance (Safarnejad et al., 2018). Confirmability of a research study is established

when credibility, transferability, and dependability are all achieved (Mavhandu-Mudzusi,

2018). Conducting processes; member checking of interview transcriptions, transcript

reviews, documenting the check and rechecking process, keeping audit logs, obtaining

peer review, and triangulation will satisfy confirmability in the research study (Lub,

2015).

An effective research study must convince the reader that a sufficient amount of

data was gathered and analyzed to produce reliable findings. To ensure data saturation, a

larger number of invitations were extended to potential population audience, than is

required for the maximum participation of interviewees. Fusch and Ness (2015)

recommends researchers consider more people than normally expected to reach data

saturation. I made sure all research questions were completely answered during the

interviewing sessions. Data saturation can be considered met when further data collection

and analysis yield little or no change to possible outcome (Constantinou et al., 2017).

Ferreira et al. (2015) study on ethical consideration for conducting research emphasizes

the point of data saturation, where the value of the data collected does not out weight the

possible harm to participants. Saturation is a tool used to complete the data collected to

support the study (Reilly, 2013). I refined the data collected from interviewing sessions

with additional member checking interview sessions, ensuring data saturation. I

exhausted all data collection efforts, until there is no longer any new information to

benefit the study.

Transition and Summary

In section 2, I presented detail descriptions of the purpose, design, literature

review, and information processing techniques contained within the project of the

doctoral research study. The roles of the researcher, study’s participants, and ethical

parameters were defined in this section. The conceptual framework, data collection, and

data management techniques methods were outlined in detail, to establish reliability and

validity in the research study. In the next section, I discussed the final analysis and

summary of the findings of the research. The discussions will include: a documented

comprehensive review of the data findings, a final comparison of the content against the

applicable conceptual framework, and a summary of the findings as they relate to the

application in professional practice, potential for improvement in social change, and

suggestion for implementing the recommended actions. Then, I made final closing

comments on; recommendations for further research, the impact the study has on the

researchers, social change, and concluding message.

Section 3: Application to Professional Practice and Implications for Change

Overview of Study

The purpose of this qualitative pragmatic study was to explore strategies used by

IT managers to transition their e-commerce organizations to chip-and-PIN credit card

authentication infrastructures. Data were collected from semi structured interviews with

IT managers with 16 to 35 years of IT experience in e-commerce organizations located

within the United States who shared their experience in developing and implementing

strategies in chip-and-PIN credit card authentication infrastructure technology. My goal

was to explore in-depth the strategies and transition events of IT managers. To protect

their privacy, each participant was coded as a number preceded by the letter P. To

achieve data saturation and data integrity, I used the triangulation methodology with

publicly available data, journal notes, and existing organization documentation in

addition to the participants’ interview responses. Using the TA process, I analyzed

patterns and discovered the major emerging themes: that a successful implementation

strategy is required; the development and buy-in of critical elements defining the business

needs and scope within the organization, attaining PCI DSS regulatory compliance; and

confirming the value to the business and customer experience. The findings were in

alignment with the DOI conceptual framework used in the study. The summary of the

emergent themes and findings in the study supported by current, peer-reviewed literature

resulted in the following presentation of findings.

Presentation of Findings

The research question guiding this study was: What strategies are used by IT

managers to transition their organizations to chip-and-PIN credit card authentication

infrastructures? My goal with this research question was to identify strategies that IT

managers use to efficiently transition their e-commerce organizations to a chip-and-PIN

credit card authentication platforms. In this subsection, I discuss the emerging themes,

their alignment with the conceptual framework, and the current literature supporting the

findings. From analyzing the data collected for the study, the following three major

themes emerged from all participants that were further supported by the associated minor

themes: (a) elements influencing the appropriate selection of strategy, (b) implementation

of PCI DSS regulatory compliance, and (c) value to business and customer experience.

Theme 1: Elements Influencing the Appropriate Selection of Strategy

Elements influencing the appropriate selection of strategy was the foremost theme

indicated in the data. Five of the six participants stated that the key to having a successful

strategy was to determine the scope of the problem: business need, security risk,

technology gap, current resources, available funding, and completion timeline. P6’s

views were in agreement with the other five participant statement but communicated that

his organization was more of an earlier adopter of technology despite other influencing

elements. Given that most projects would have the same generic elements in developing a

strategy, I decided to do a more granular analysis of the unique elements particular to

their chip-and-PIN credit card authentication infrastructures strategy. From further

analysis, I was able to identify four minor themes more applicable to the research

question. The minor themes were fraud and liability cost, increased credit card security,

regulatory compliance, and modernization of POS systems.

Fraud and the cost to recover from incidents was one of the most important

elements considered in determining the right strategy. Four of the five participants stated

that informing and providing statistics about fraud and its cost was effective to get

stakeholder buy-in from the C-suite decision makers. P4 stated that “it is unfortunate but,

communicating fear of fraud and liability cost was a very effective way to persuade

stakeholder buy-in within my organization.”

Improving credit card security was a consistent and required element addressed in

the data and was requested as a requirement by the IT security departments in most

organizations. Any efforts to reduce vulnerabilities to the security posture of the

organization were a critical element of the strategy.

Regulatory compliance was another important element for organizations to

include in their strategy. Implementing a chip-and-PIN credit card authentication

infrastructure would improve security; however, it was mandatory for organizations to

meet the PCI DSS regulatory compliance. In addition, meeting the compliance would

reduce the liability to the organization should credit card fraud occur during their sale

transactions. Explaining the benefits of being in PCI compliance was an effective

communication strategy and a critical strategy element when persuading stakeholders on

the benefits of chip-and-PIN credit card authentication infrastructures.

The modernization of POS systems was another element critical to the strategy. In

the larger organization, this element was important; however, it was not seen as such a

big challenge and was expected as part of their strategy. For the smaller organizations,

modernization of their POS systems was an element that could determine the

survivability of their company. Their noncompliance could result in fees and potential

liability costs of fraud incidents.

All participants made multiple references to the individual elements these minor

themes because they affected their organization and strategy (see Table 3 for frequency

of themes). Overall, all six participants indicated the importance of validating,

communicating, and getting buy-in on all the minor elements, resulting in a

comprehensive and inclusive strategy.

Table 3

Frequency of First Major Themes: Elements Influencing the Appropriate Selection of

Strategy

Thematic category: persuasion &

decision

References

Documents

Fraud & liability cost

Increased credit card security

Regulatory compliance

Modernization of point-of-sales

system

There is current literature supporting the major theme elements influencing the

appropriate selection of strategy. Understanding the scope and risk of the requirement is a

step organization must use to start the strategy development process. Managers in the

current study employed various strategies to communicate the security and liability cost

risks to their organizations. It is important to understand the impact of cybercrime to

stakeholders and provide them with adequate information on the methods for practical

applications to protect credit card users (Arief & Adzmi, 2015). Understanding the

security requirements of the new product helps with the development of a process and

search for business dependencies in the collaborative innovation strategy (Chung, 2020).

Fraud and the cost to recover from incidents were two of the most important

elements that were used in the strategy to gain stakeholder buy-in. Some businesses do

not understand IT security and do not adhere to good security practices (Clapper, &

Richmond 2016). Some retailers have not fully converted to the full implementation,

forcing customers to use the older magnetic strip methods to authenticate their purchases

(Bush, 2016). Organizations implementing chip-and-PIN solutions must meet the PCI

DSS (2018) regulatory compliance mandates that apply to all system components

included in or connected to the cardholder data environment.

The modernization of POS systems was critical to advance the strategy. In some

instances, the modernization strategy and costs, include platform systems and hardware

that is not only dedicated to the POS systems. Network components, including, but not

limited to, firewalls, switches, routers, wireless access points, network appliances, and

other security appliances (PCI DSS, 2018). Small businesses with limited funds,

datacenter infrastructures, and network bandwidth connections may not be able to gain

PCI compliance. Small-scale organizations often lack adequate capacity and resources to

evaluate, learn, establish, and set aside finances to cater for uncertainty of the technology

in future (Taha et al., 2018). The recent literature aligns with the findings of this study

and confirms the need to establish elements influencing the appropriate selection of

strategy.

The process of validating, communicating, and getting stakeholder buy-in on all

critical elements in the selected strategy also aligns with the conceptual framework of this

study. The IDT provides tools to determine the factors, uncertainty, resistance, and rate of

diffusion of a technology (Zsifkovits & Gunther, 2015). The DOI theory provides a

framework representative of the types of users commonly found throughout the world

regardless of economic status and allows for a structured analysis of constructs affecting

the decision to adopt an innovation or technology (Shaw et al., 2022). In the first three

phases of the DOI theory, Rogers (2003) prescribed the need to make known the

conditions, needs, characteristics, and desired outcome when studying the effect of an

innovation and its acceptability by society. Leite (2022) confirmed that innovation is

driven by the activities of searching, acting, and convincing actors of an opportunity to

develop innovative solutions. My analysis and identification of the elements influencing

the appropriate selection of a strategy are aligned with the first three phases (i.e.,

awareness, persuasion, and decision) in the innovation-decision process. Leite found

convincing was present in every phase of the innovation. However, the findings in the

current study indicate that persuasion was mostly used in the activities to gain a decision

on the final selected strategy. Leite found it necessary to convince others about the idea

and, therefore, encourage them to collaborate, convincing others to talk positively about

the project after the implementation phase, such as the public officials and the local and

international media. Zhang et al. (2017) emphasized the importance of each stakeholder

and their efforts to bring about IT innovation acceptance within their organization.

Participants in the current study used the individual elements to inform stakeholders of

the potential fraud, liability cost, regulatory noncompliance fees, credit card security

risks, and technology gaps in their POS system to gain a viable implementation strategy.

The appropriate understanding of the threats and an organizational commitment to

security have a significant and positive influence on users’ intention to comply with

corporate security policies (Forsyth, 2020). In the literature, Coodarzi et al. (2021)

confirmed that providing information on environmental technologies help potential

adopters overcome some of the barriers against eco-friendly options, such as their higher

cost or inferior aesthetics.

The trustworthiness of information sources plays a significant in developing the

best strategy. Innovation stems from a knowledge recombination of prior discoveries and

applications, and the individual capacity to search for knowledge over both familiar and

unfamiliar technological domains is also likely shaping fundamental processes in

creativity, problem solving, and innovation within organizations (Van Knippenberg et al.,

2015). These elements supported the data analysis showing the emerging minor and

major themes. The minor themes from the data analysis show how participants informed

and persuaded their e-commerce organization to make a decision favorable to implement

chip-and-PIN credit card authentication infrastructures.

Diffusion is a method of communicating new ideas to people in a social system

(Scott & McGuire, 2017). Therefore, the DOI theory aligns with and confirms why the

identification of elements influencing the appropriate selection of a strategy is

fundamental to a successful implementation strategy.

Theme 2: Implement PCI DSS Regulatory Compliance

Implementing PCI DSS regulatory compliance was the most prominent major

theme. All six participants summarized the main reason for their strategy was to meet

PCI DSS regulatory compliance. PCI standards are mandated by the card brands, and the

administration and development of standards are managed by the Payment Card Industry

Security Standards Council (PCI DSS, 2018). The standards were created to protect

cardholder data and to reduce credit card fraud. The PCI DSS’s goal is to protect

cardholder data wherever it is processed, stored, or transmitted (Nagar et al., 2021). P5

indicated PCI DSS regulatory compliance as the number one reason for his organization

to support the strategy and expedient implementation of chip-and-PIN credit card

solutions. Despite the high number of references to fraud by P1, P2, P3, P4 and P5, the

most important factor was to be in compliance with PCI DSS standards. When an

ecommerce organization is PCI DSS compliant, the liability for the fraud incident is

placed on the card issuer (Clapper & Richmond, 2016). The e-commerce organization

must ensure their POS systems is capable of accepting and conducting the chip-an-PIN

transaction. Once the e-commerce organization has passed the PCI DSS attestation, they

are relieved of the liability from fraudulent activities committed with a chip-enabled

transaction. The bank that issued the credit card is responsible for ensuring the user of the

card is validated by the chip-and-PIN POS transaction. The reduction in liability cost is a

major motivator for organizations to implement the more secure transaction.

The implementation of PCI DSS regulatory compliance theme was further

supported with four minor themes emerging from the data analysis: investment cost,

internal implementation, external outsource implementation, and modernization of POS

system (see Table 4 for frequency of themes). Three of the six participants stated that

investment cost was not much of a factor after getting stakeholder buy-in. P5 indicated

that a thorough research of the equipment and technical support provider is critical to the

success and maintenance of the final solution. P5 stated that he has witnessed other

agencies trying to implement cheap and minimum standard solutions that failed and

ended up costing more at the end. P3 stated that “sometimes it is frustrating because you

show them the security risks and cost to other organizations to recover from their

incident/breach and they still don’t do it because they think it cost too much.” Once

again, investment cost was an issue for some of the smaller organizations with limited

capital spending.

When analyzing the data in reference to internal or external outsourcing

implementation strategies, two of the six participants insisted that their strategy would be

implemented internally. The other four participants recommended that the

implementation be outsourced to consultants and subject matter experts certified to in the

PCI DSS skillsets. P4 recommended that organizations who plan on using internal staff to

do the implementation should bring in consultants and POS system vendors to train their

internal staff first. Dobrosielski (2019) insisted that focusing on people, calling them a

human firewall and the most valuable asset in protecting against fraud, should be the

main priority in implementations of security solutions.

Another important benefit from achieving PCI DSS regulatory compliance is the

requirement to upgrade from outdated POS equipment and systems that do not meet the

minimum data security standards. Modernization of POS systems was another minor

theme the emerged from the analysis of the data. As organizations started to understand

the requirements outlined in the PCI DSS regulatory compliance, it became apparent that

their current POS systems needed to be upgraded or updated, depending on the age of

their systems. Some organizations were fortunate and only required software updates,

while other organizations’ hardware and software both required total replacement.

As significant as implementing PCI DSS regulatory compliance is to a successful

strategy, four of the six participants did not initially come to that conclusion until they

reflected on and summarized their interview sessions. The analysis of the data and minor

themes indicated PCI DSS regulatory compliance was a major theme, if not the most

important theme.

Table 4

Frequency of Second Major Themes: Implement PCI DSS Regulatory Compliance

Thematic Category: Implementation

References

Documents

Investment cost

Internal implementation strategy

Outsourced implementation strategy

Modernization of point-of-sales system

Meeting regulatory compliance

The literature supports the theme that ecommerce organization should implement

PCI DSS regulatory compliance. In 2018, the number of such chip-authenticated card

payments reached 48.8 billion, a substantial increase from the 1.4 billion in-person chip-

authenticated card payments in 2015 and larger than the 37.3 billion in-person card

payments without chip authentication in 2018 (Gerdes et al., 2019). Organizations

without a successful chip-and PIN POS system is at a higher risk to be liable for

fraudulent credit card activities. The primary benefit of complying with PCI DSS is the

reduction in risk associated with a data breach (Clapper & Richmond, 2016).

Implementing the PCI DSS required organizations to invest into new authentications

capabilities to enable chip-and-PIN multifactor authentication. Standardization bodies

like the National Institute of Standards and Technology and payment card industry have

proposed a set of guidelines concerning the digital identity management through

(Sinigaglia et al., 2020). Organization seeking PCI DSS regulatory compliance must be

assessed by a third party evaluator certified to conduct PCI assessment. Security

compliance practices ensures organizations are adhering to established security controls

(Choi et al., 2018). At least annually and prior to the annual assessment, the assessed

entity should confirm the accuracy of their PCI DSS scope by identifying all locations

and flows of cardholder data, and identify all systems that are connected to or, if

compromised, could impact the data loss (Payment Card Industry Security Standard

Council, 2018). Organization should upgrade their outdated POS equipment and systems,

which no longer meet the minimum data security standards. Websites are one of the

avenues hackers use to harvest and extract customer’s PII and financial data. E-

commerce merchants who must be compliant with the PCI DSS can use an approved

scanning vendors to automatically certify that their websites meet some parts of the PCI

DSS (Kellogg et al., 2020). Increased use of either chips or PINs separately can increase

the security of card payments, while the use of a chip and PIN together can further reduce

the risk of third-party payments fraud (Gerdes et al., 2019).

The implement PCI DSS regulatory compliance theme aligns well with the DOI

theory conceptual framework. The phases of the innovation diffusion process assist in

identifying roles; innovator, adopters and, intermediaries essential to applying the

technology (Caiazza & Volpe, 2017). The fourth phase in the DOI theory is the

implementation phase, which directly coincides with the second emerging major theme

from the data collected within my study. Utilizing the innovation-decision process, the

next logical step is to implement the strategy for the expected outcome. Regulatory

collaborations are valuable, in that they aid organizational compliance with regulatory

enforcement actions (Desai, 2016). To document the goals of the research questions,

participants were asked to provided data describing the implementation of their strategies.

Six out of six participants summarized the main reason for their implementation strategy

was to meet the PCI DSS regulatory compliance. The current literature and conceptual

framework confirm that implementing PCI DSS regulatory compliance is an integral part

to implementing a successful chip-and-PIN credit card authentication infrastructure.

Theme 3: Value to the Business and Customer Experience

The third major theme that emerged from the data analysis was the value to the

business and customer experience. This major theme was derived from the data analysis

of four minor emerging themes. The minor themes were customer usage and satisfaction,

improved credit card payment process, meet regulatory compliance, and modernized POS

system (see Table 5). Five out of six participants indicted that the value to the business

was more associated with the fiduciary return on investment, either short or long term.

Their C-suite leader’s biggest concern was how soon would the cost of the chip-and-PIN

implementation be recuperated and how to measure the expected return on investment.

P2, P3, P4, and P5 indicated the internal IT staff had a different view of valuing return on

investment. The IT staff understood the hours and tasks involved in remediating

fraudulent incidents and preventing breaches without the increased security option of

chip-and-PIN infrastructure. The IT staff were also concerned about the addition efforts

and cost to maintain the older and failing systems. For them, a modernized POS system

was the confirmation they expected, considering that as a true and tangible business

value. All six participant did acknowledge that a major fraud incident or breach would be

detrimental for their organization’s brand and name, causing potential business

devaluation. When addressing business value, P6 provided a totally different aspect and

view. P6 stated that customer loyalty and brand name recognition was how they

measured value. Giving customers the best experience was most important to their

company. Value to the customer experience was another part of the third major theme. It

is important to point out that the participants had a variety of views on this data point.

The first observation was the definition of customer. Some participants only consider the

external customer requesting services or goods from their organization. Concern from a

customer service perspective was whether, the customer will use the new chip-and-PIN

POS systems, the authentication process would increase the time customers needed at the

POS systems for checking out, and the remedy if the customer doesn’t remember their

PIN. Based on the data analysis, those concerns were easily confirmed. P5 was the only

responded that stated that the customer’s increase transaction wait times for completing

transactions were slightly noticeable, if at all, were in very larger retail stores or small

businesses with limited network bandwidth connections. P5 and P4 expressed a different

view of customers. They considered internal stakeholders as customers. For example,

they consider the cashiers at the POS to be important internal customer. Cashier were the

organizations representative to the external customer. The cashier would need to assist

the customer with any problem associated with the sales transaction, including potential

chip-and-PIN errors. They need to be trained on customer the support aspect of the chip-

and-PIN POS systems. Another internal customer was the IT security staff. The

implementation of the new system should increase the security posture within the

organization and reduce the workload of the IT security staff.

Table 5

Frequency of Third Major Themes: Value to the Business and Customer Experience

Thematic category: confirmation

References

Documents

Modernized point-of-sales system

Customer usage and satisfaction

Meet regulatory compliance

Improved IT security posture

The recent literature supports the emerging value to the business and customer

experience theme. IT enables an easy and extensive matching that facilitates the creation

of value and the rapid development of the phenomenon or innovation (Frey et al., 2019).

A firm’s IT use for knowledge search strengthens internal innovation benefits, which, in

turn, lead to an improvement of innovation performance (Hensen & Dong, 2020). Well-

developed IT strategies and IT investments increased the performance of an organization

(Mithas & Rust, 2016). Based on the ability to expose innovation and critical

characteristic, Shree et al. (2021) used DOI and Technology-Organization-Environment

framework to identify and measure the contributing factors for adoption of digital

platforms in business to business organizations. Value to the business is often focus on

what is the immediate return on investment, instead of the long-term value the innovation

can bring to society. Legal, economic, technical, and cultural barriers degrade the process

of diffusion (Caiazza, 2016). Too often, IT innovation incentives are not sufficiently

strong because organizations see limited benefits in the adoption of new IT relative to its

cost (Zweifel, 2021). C-suite leaders can hinder the implementation of required security

innovation because of not understanding or relating it to the long-term business value.

Vuori and Huy (2016) study showed managers were afraid of external competitors and

shareholders, while middle managers were mainly afraid of internal groups, including

superiors and peers. Although there may be a high initial investment cost to

implementing a chip-and-PIN POS systems, managers must communicate the benefits

and long-term business value to financier and executive board members. Firms that want

to achieve a competitive advantage based on their IT resources have also learned to

effectively combine their IT resources in order to create overarching goals (Wiesbock et

al., 2020). Although there may be a high initial investment cost to implementing a chip-

and-PIN point-of-sales systems, managers must communicate the benefits and long-term

business value to financier and executive board members. When implementing

innovation, managers are key decision makers and should champion innovation to drive

positive business value. Vuori and Huy indicated that shared emotions can hinder the

subsequent integration of attention, influencing innovation processes and outcomes and

resulting in temporal myopia—a focus on short-term product innovation at the expense of

long-term innovation development. Wan and Zhang (2014) argued managerial steps can

lessen concerns about “cheap talk” and the limitations of mere words to repair trust after

a violation or incident. Value to the customer experience is an important factor in the

implementation of new technology innovation. Jamshidi and Hussin’s (2016) finding

showed the alignment of customer satisfaction with services has a noticeable final impact

on social influence. The potential adopters are inclined to gather information before

purchasing, which corresponds to the knowledge and persuasion stages in the innovation

diffusion model (Zhang et al, 2022). Credit card information and habits of consumer’s

usage are maintained in databases, presenting increased risk to customer privacy (West &

Bhattacharya, 2016). Customer must feel comfortable using payment card systems and

trust that the ecommerce organization is protecting consumer data privacy. Customer will

share their experience with others, impacting on overall social influence. Information

sources have several effects on sustainable behavior and the adoption of environmental

technologies by users (Goodarzi et al., 2021). Improved security in credit card payment

processes is a value to the customer experience. EMV transactions at chip POS terminals

provide more security of consumers’ personal data than magnetic strip POS transactions.

In addition, EMV card transactions transmit data between the merchant and the issuing

bank with a special code that is unique to each individual transaction (Federal Bureau of

Investigation, 2015). Value to the business and customer experience requires all members

of the organization to be engaged with the innovation. In some cases, it requires a major

organizational culture change. There is a crucial need to continue analyzing human

aspects in information security, because technology alone cannot deliver complete

security solutions (Ashish et al., 2017). A successful of PCI DSS implementation

depends on the capability of the organization’s information security in providing the

effective safeguard of their information asset, while cardholder data security is the main

concern (Yulianto et al., 2016). As P4 stated in the interview sessions, “you should

always look at it from the customers point of view.” The recent literature aligns with the

findings of the data analysis and confirms the value to the business and customer

experience theme.

The theme value to business and customer experience aligns with the conceptual

framework. Evaluating the value to these two main constructs is a method to confirm that

the implemented innovation is being used and customers are satisfied with the solution.

The fifth phase of Roger’s (2003) DOI theory is confirmation. The phase in the diffusion

of innovation process where expected outcome of the innovation is validated and

confirmed, either as accepted or rejected. Stages in the theory were effective in

measuring the status of organizations and adopters within the innovation network

(Valente et al., 2015). The measure of an adequate level of protection is an indicator of

the cybersecurity awareness aspects of an organization's business processes in the short,

medium, and long term (Sulistyowati et al., 2020). In their study of collaboration

networks, team communication dynamics, and diffusion of education in the process,

Woodland et al. (2021) found the diffusion of innovation theory was effective in

measuring team’s innovation adaptation and educational diffusion within the social

network analysis. When asked to of the status of their chip-and- PIN implementation, all

six participants in the study stated they were able to successfully implement chip-and-

PIN credit card authentication infrastructures within their ecommerce organizations. In

2018, the number of such chip-authenticated card payments reached 48.8 billion, a

substantial increase from the 1.4 billion in-person chip-authenticated card payments in

2015 and larger than the 37.3 billion in-person card payments without chip authentication

in 2018 (Gerdes et al., 2019). The overall indication in the United States is trending

favorable to the successful implementation of chip-and-PIN credit card authentication

infrastructures within ecommerce organizations. Smith et al. (2018) implied that

observability characteristic implies the perceived visibility of innovations to others.

Successful innovation networks emerge not solely from a business goal, but also from a

social goal and can still generate business opportunities for companies (Zhang et al.,

2022). The measurement and confirmation of improvements in chip-and-PIN credit card

implementation globally, within the United States and within the population of my study

shows that the findings align well with the conceptual framework for this study. These

findings confirm and provide evidence to the application of concepts found in existing

literature and executed as best business IT practices, within ecommerce environments.

Application of Professional Practice

This study helps IT managers to better understand the complexity of innovation

and the process connected to developing an effective chip-and-PIN credit card

implementation strategy. The findings of the study inform IT managers on the ways

which they can garner leadership support and resources to implement successful credit

card security measures. To prevent costly liabilities charges and harm to their brand

names, organizations must improve their ecommerce infrastructure security posture,

reduce credit card fraud, and protect consumer’s PII. Consumers depend on organization

to ensure their transactions and payments are conducted using the most secure

technology. Implementation of PCI DSS regulatory compliance is a proven technology

standard, which give all stakeholders trust in the payment process. The research study

provided an informative set of findings to fill the IT knowledge gap for consumers,

managers, and security professional required to implement and maintain chip-and-PIN

credit card authentication infrastructures in their ecommerce organizations. IT managers

have a baseline strategic roadmap they can build on, adjust to their unique requirement,

and follow. The study provide strategies IT managers can use to improve the efficiency

of their current payment system security processes and help to upgrade implemented

legacy credit authentication technology. Organization leaders can use the study findings

to establish key indicators for measuring the value to their business, workforce, and

customer experience. Organization can use this study to communicate their efforts to

secure consumers from fraud and efforts to implement a more secure cybersecurity

postures for all stakeholders. Using the findings from this study, credit card users can be

informed and make better credit card selections. Credit card issuing providers can use this

study to advertise the benefits of their chip enabled credit cards, contrasting added

security value against their competitors. In addition, the study’s results can be used as an

IT strategic template to efficiently transition other nations to the same credit card

authentication platform, securing both consumers utilizing credit cards and vendors

providing services within the global e-commerce market.

Implication for Social Change

The outcome of the study will contribute to positive social change through the

potential of protecting businesses and consumers from credit card fraud. Consumers

using chipped credit cards will reduce the risks of credit card fraud and financial liability

to merchants, resulting in lower administrative cost and fees levied against all

stakeholders in the e-commerce process (Robertson, 2014). The study will help to inform

individuals about the current status of the IT innovation processes of chip-and-PIN credit

card authentication. Members in our society can use their increased IT knowledge to

communicate, demand, and insist that businesses which they patronize, and their business

partners increase credit card security with chip-and-PIN authentication infrastructures.

Paying for services with the more secured chip-and-PIN credit cards will be safer when

conducting business with local and international service providers. Once the chip-and-

PIN credit cards authentication infrastructures are fielded throughout all financial and

business institution globally, individuals traveling worldwide would have easier and safer

access to their buying power, reducing their risks of potential credit card fraud. Informed

credit card users, their vendors, and banking institutions will be on a more secured e-

commerce security platform, reducing identity theft crimes committed within our society.

Additionally, the study’s results can be used as a strategic template to efficiently

transition other nations to the same credit card authentication platform, securing both

consumers utilizing credit cards and vendors providing services within the global e-

100

commerce market. Securing the electronic exchange of funds conducted using chip-and-

PIN authentication technology will reduce credit card fraud and crimes conducted within

society.

Recommendations For Action

With the regulatory mandate to implement secure ecommerce credit card

transaction authentication platforms, IT manager must develop and implement strategies

to provide those secure and safe POS computing environments. As credit card fraud

increases, consumers are losing confidence in the protection of their credit, PII and

banking systems. They suffer financial loss and possible bankruptcy, as a victim of a

credit card fraud/data breach. Organizations and their POS service providers are obligated

to paid for the liability cost associated with credit repair and PII protection for those fraud

victims, impacting the overall ecommerce system. These security threats are having a

macroeconomic impact on the global payment card industry (Banka, 2017). The purpose

of my study was to explore strategies used by IT managers to transition their e-commerce

organizations to chip-and-PIN credit card authentication infrastructures. Findings from

my study can provide IT managers with the strategies they lack to move forward with

their implementation. I recommend the following actions on the part of IT managers:

1. IT managers should take inventory of their current credit card

authentication infrastructures, systems, and platforms.

2. Identify the risks and gaps within their environments.

3. Compare their organization with elements required in the regulator

compliance policies/guidelines.

101

4. Develop a scope, project charter, and strategy (use element or themes from

the study findings).

5. Develop and present course of actions (COA) and cost estimates to

decision maker within the organization, communicating the risk, cost, and

strategy to get executive level sponsorship and business units stakeholder buy-in.

6. Seek internal of external resources to plan and conduct the implementation

7. Execute the implementation plan and confirm operational capabilities

8. Document execution, review, and conduct continuous improvement

Although not an all-inclusive list, the action listed above address some of the major

findings provided by the data collected and viewpoints of participants within the study.

Upon approval, I will provide a one to two page summary of my study and

recommendations to the participants and their organizations. I plan to publish the findings

of this research in academic and professional journals. I will present briefing and lectures

on the findings of this study to ecommerce businesses, IT security forums, IT

associations and technical symposiums. I will disseminate summaries of the findings to

financial and cybersecurity professional groups on LinkedIn and similar networking

platforms. I intend to share this study and findings with the cybersecurity, crime, fraud

prevention, law enforcement community, and professional practice writ large.

Recommendation for Further Research

The literary review and findings from the study revealed several security and

information body of knowledge gaps within the protection of e-commerce authentication

platforms. There is a need for further research in the biometrics application to two factor

102

authentication of credit card POS transactions. Two-factor authentication is a proven

technology for securing IS. Combining biometrics technology as one element in the two-

factor authentication process increases the security capability and complexity. Biometric

authentication includes the use of; fingerprints, iris scans, face, and voice recognition

(Martinovic, et al., 2017). PCI systems can benefit from the dual usage of biometric

system for both data collection and user authentication (Choi & Park, 2015).

In addition to the study of biometrics authentication, there is a need for further

research on the security methods for protection of contactless payments and CNP credit

card transactions. One of the growing security problems with credit card transactions is

the CNP vulnerability. Without the actual credit card being present during the transaction,

other nontangible factors must be validated, requiring the vendor to depend on the verbal

confirmation of the person making the CNP transaction. Pouwelse and Bruggink’s (2016)

address the growing complications of securing credit card transactions by CNP

transaction fraud, within a study. Pouwelse and Bruggink study indicate that card fraud is

a key cybercrime activity, with a full-scale underground economy. Biometric

authentication and CNP was identified as above scope and outside the limits of this study.

However, these two topics are rife for a doctoral level study.

Reflections

During my Walden University doctoral study evolution, I had the opportunity to;

discover my weaknesses, find my inner strengths, develop humility, patient, and

endurance. Conducting this study gave me the opportunity to meet and work with a

diversity of students and instructors, allowing me to see subjects and ideas from different

103

points of views. I felt the most overwhelming and challenging aspect of doing the study

was the recruitment of participants. The COVID 19 Pandemic effected my access to

potential participants and created the need for me to use online and virtual

communication collaboration tools, for both recruiting and interviewing participants. In

addition, multiple nationwide cybersecurity threats and attacks, during my study, created

barriers to IT managers and their willingness to discuss their organization’s IT security

postures and strategies to protect their computing environments. Another element which

surprised me was the clarity of the data to confirm the increased practice of organizations

outsourcing/utilizing external service providers for their POS strategies and solutions,

limiting their liabilities and efforts to provide internal services.

Given my many years of experience in the IT security field and currently working

in an organization with POS systems and infrastructure, I was initially concerned that my

potential bias would challenge the objectivity of my study. However, using the semi

structure interview sessions with open-ended questions gave me the opportunity to be

more of a listener than a talker, limiting the chance for me to influence the participants of

the study. Despite some of challenges I faced both personal and academic in the pursuit

of this doctoral study, I will use those enlighten learning experience in future analysis,

development, and implementation of emerging IT solutions, throughout my career.

Conclusion

IT managers are responsible for providing the most secure e-commerce

computing environments for their organization’s users, both internal stakeholders and

external consumers. Some IT managers lack strategies to transition their e-commerce

104

organizations to chip-and-PIN credit card authentication infrastructures. A federal and

financial institution compliance mandate required organization to implement, the more

secure, chip and PIN capability by fall of 2015. However, some retailers have not fully

converted to the full implementation, forcing customers to use the older magnetic strip

methods to authenticate their purchases (Bush, 2016). The two-factor authentication

process, using chip-enabled terminals with a secret PIN, provides a more secure

electronic payment transaction. Secure authentication is accomplished when a user must

use two different identity factors to complete the authentication process (Kaur & Pathak,

2015). With the appropriate strategy, IT managers can efficiently transition their e-

commerce organizations to a chip-and-PIN credit card authentication platforms,

increasing the security of the consumer’s credit card payment experience. The study’s

findings can be used as an IT strategic template to efficiently transition other nations to

the same credit card authentication platform, securing both consumers utilizing credit

cards and vendors providing services within the global e-commerce market.

Examination of Strategies to Implementing Chip and Personal Identification Number Credit Card Authentication Infrastructures

Students also viewed