So when we ask why payment systems are insecure, it’s bigger — much bigger — than a lack of security at Home Depot, or Target, or name-that-brand. It’s really about an entire system that needs to play catch-up. Because we shop across many stores, and not just one, banks and card companies have to take the lead. So far, they’ve pledged to move to chip-and-PIN cards starting next year, but Litan says that could take seven to 10 years.