"EMV: Retail’s $38 Billion 'Money Pit,'" a new report by market research firm IHL Group, says that most retailers will never recoup the expense that EMV imposes, and that there's a much better approach to protecting retailers and consumers.

"Twelve years ago when EMV was introduced into Europe it made tremendous sense," IHL President Greg Buzek said in the release. "Today, it stands in the way of real data security by stealing critical budget away from focusing on the risks that retailers face from online hackers."

According to IHL, retailers' real concern — a customer data breach — is almost entirely mitigated with end-to-end encryption and tokenization of transactions. This allows merchants to "lock the doors to the entire house rather than just the front door," which is what EMV does, IHL said.

"Retailers who simply focus on EMV at checkout without focusing on end-to-end encryption and tokenization in all of their sales channels are actually opening up a significant security hole," Buzek said. "[S]tore fraud will simply move online (where EMV provides no protection), and they will still have hackers going after their data."

Other revelations from the study:

• PCI compliance consumes up to 55 percent of a retailer's data security budget; the retailer must bear the expense of both PCI and EMV until 75 percent of transactions are EMV compliant, at which point PCI can be discontinued;
• EMV will increase transaction times by five to eight seconds — consumers can expect longer holiday shopping lines as retailers and shoppers adjust to a process introduced just before the critical shopping season;
• Retailers will require more labor in their stores due to slower transactions and consumers leaving their cards in the payment device;
• The average ROI for EMV at a $1 billion specialty store is 77 percent over three years.