EMV101: smart chip technology expands in the U.S: the U.S. is finally catching up with the rest of the industrialized world and deploying more secure chip card technology.
First, some basics. EMV stands for EuroPay, MasterCard, and Visa, and is governed by a group called EMVCo consisting of major global card brands. EMV is often used interchangeably as smart card technology.
HOW DOES IT WORK?
There are national and international specifications or standards for several societal functions, ranging from doorframe sizing to electrical voltage, to airline takeoff and landing procedures. Without some baseline direction for how technology and processes work, the payments system, just like those other examples, would be fraught with chaos. The EMV smart chip is like a mini-computer imprinted onto the credit card. When the chip card is inserted into a point-of-sale machine, the chip card communicates with the card reader. The chip itself creates a unique, dynamic cryptogram for every transaction. This technology is much more advanced than the magnetic stripes in use today, which have static data fields.
The customer can dip their card into the point-of-sale machine while they are getting checked out; however, at most checkouts the authorization process doesn't begin until the sale is final and the checkout clerk enters the total sale amount. Then, the chip card interacts with the checkout equipment and a transaction message is sent to the cardholder's bank or card company to authorize or decline the transaction. It takes a bit longer to process a chip card transaction than a magnetic stripe transaction because a more complex set of information is being communicated between the card and the point-of-sale machine, and clerks and customers are still getting used to the new process.
WHAT'S THE PURPOSE?
Chip technology helps prevent against counterfeit fraud. When magnetic stripe cards are compromised, the static nature of the data on the card makes it very easy for criminals to re-create new, counterfeit cards using the stolen data, and then use these cards for fraudulent purchases or sell them on the black market. Chip technology is much more difficult to reproduce, and the dynamic cryptogram created on every transaction makes it extremely difficult for criminals to exploit any false card credentials in-store.
As explained above, chip technology only helps prevent counterfeit card fraud. International deployments of chip technology have mostly required card issuers to enable the product with Personal Identification Numbers, but most banks are not using PINs in the U.S. As a result, U.S. businesses and cardholders will remain vulnerable to lost and stolen card fraud.
Chip cards still have a magnetic stripe on them, so if a criminal can get a card reader to accept a payment without using the chip, those transactions are vulnerable. Since many cards will still contain a magnetic stripe and static data, merchants should continue to take caution to prevent unauthorized access to card data.
Additionally, if a card account number is compromised, it can still be used to perpetrate Internet or mobile e-commerce fraud because the security features of the chip are not currently available in an Internet environment.
MINIMIZING LOSSES FROM FRAUD
The amount of payment card fraud losses borne at retail varies significantly by industry. Today, merchants do not get a payment guarantee when a card is swiped in their store as they are subject to card network chargeback rules, which create a dispute process between the card issuer and the business at which the customer disputes the charge.
Merchants bear about 38 percent of total U.S. system-wide card fraud. Also, merchants bear almost all of the Internet and mobile fraud In the U.S. system, and that will not change. In fact, in other countries, more fraud has migrated online with the deployment of EMV.
LEGAL AND IMPLEMENTATION REQUIREMENTS
Businesses are not required to install EMV card reader technology and financial institutions are not required to issue EMV smart cards. However, merchant and issuer stakeholders are being incentivized to support the technology by card network rules and policies surrounding transaction liability. Visa and MasterCard are primarily responsible for creating these market incentives through their dictation and enforcement of fees and fines related to payment card fraud and security. Chargebacks will be conveyed via your merchant acquirer or processor.
Four years ago, Visa announced an EMV deployment liability shift date of Oct. 1, 2015 for general retail. The deadline is two years later (Oct. 1, 2017) for fuel pumps; although, in-store convenience store equipment is covered by the earlier liability shift date. The other global card brands all Issued similar timelines and roadmaps shortly thereafter. Generally, the way the liability shift works is that the party least EMV-capable is responsible for any fraud on the transaction. So if a retailer has Installed and activated EMV card reader equipment, but a non-chip magnetic stripe card is presented at the checkout and there turns out to be fraud on that product, the card issuer is responsible for the fraud. If a chip card is presented at a retailer where the EMV terminal is installed, but not yet activated so that the customer has to swipe the card, fraud on that transaction would be borne by the retailer.
The liability shift takes place on a transaction level, so you could potentially upgrade one POS device at any store location to accept EMV transactions. You could then use that checkout terminal to process higher-risk transactions with a higher susceptibility to fraud (e.g., bulk gift card sales). Be sure you review the materials provided by your franchisor to see if it has a specific policy regarding device upgrades.
Smart card technology will be deployed on both credit and debit cards. Debit cards are a bit slower in coming to market than credit.
WHAT IS THE CUSTOMER PROCESS AT THE POS?
The main difference is that customers will now be dipping instead of swiping their cards. Additionally, they'll have to wait until the sale and transaction are final before they can remove their card and put it back in their wallet.
One additional area of confusion for U.S. consumers will result from U.S. issuers not putting PINs on all products, which has been the standard deployment of the technology abroad. Since cards will lack this near ubiquitous international feature, there will likely be some confusion for both U.S. consumers and international tourists.
The same customer verification method rules that apply to magnetic stripe transactions will still apply in an EMV environment, at least in the short-term. For example, most card brand acceptance policies waive merchant fraud liability on transactions of $25 to $50 or less without requiring the merchant to capture a signature or PIN as a means of cardholder authentication. Accordingly, most merchants will set their POS devices to do "no CVM" for all transaction amounts at or below whatever the lowest network rule threshold is (e.g., the $25 limit in this case).
MANAGING UNATTENDED KIOSKS AND FUEL PUMPS
Unattended terminals, such as fuel pumps and kiosks, are where a fair amount of counterfeit and stolen card misuse gets attempted. Businesses will have to decide how to manage the customer who has trouble using the smart card technology without clerk assistance. One option will be for businesses to allow their point-of-sale terminal to let the cardholder swipe the card using the magnetic stripe technology that will still be available on the card. This is called a "fallback transaction." The risk the merchant faces though is the potential fraud on that transaction.
The cost of installing EMV card readers will vary depending on the complexity of your point-of-sale systems, as well as whether or not you own or lease your equipment. Industry estimates believe it will cost U.S. merchants upward of $6 billion to deploy EMV, and U.S. card issuers roughly $2 billion to deploy chip cards. In addition to the hardware costs, early merchant adopters have noted extreme complexities with the software programming, testing, and certification processes. The EMV cards are subject to the same interchange, network fees, and processing costs as magnetic stripe transactions so the per-transaction cost should be roughly the same as today.
HOW LONG DOES IT TAKE?
For many large merchants, it has taken 12 to 18 months to roll out EMV. Merchants have to certify they are equipped to accept each card network via the smart chip technology separately. This process has proven to be time and resource intensive. Many equipment providers and installers have struggled to keep up with demand over the past year, with several lagging behind six months or more. Lastly, most large acquirers have very lengthy queues to perform certifications and testing on equipment. If you are a single-unit operator, you may have an easier time, but for multi-unit operators, EMV rollout has the potential to be a cumbersome process.
The U.S. is finally catching up with the rest of the industrialized world and deploying more secure chip card technology. However, there is much more that needs to be done to enhance card security in the U.S. First, financial institutions need to be leaders in ensuring cardholder authentication mechanisms --PINs or otherwise--are enabled on financial products so that merchants have the choice to ask for PINs on high-risk transactions. Second, the U.S. needs to continue to look to deploy much broader security technologies, such as end-to-end encryption and tokenization services to better protect payment card data at rest, as well as when it moves through the transaction process.
Mark Horwedel is CEO of Merchant's Advisory Group.
|Printer friendly Cite/link Email Feedback|
|Comment:||EMV101: smart chip technology expands in the U.S: the U.S. is finally catching up with the rest of the industrialized world and deploying more secure chip card technology.(FINANCE)|
|Date:||Mar 1, 2016|
|Previous Article:||Buy-sell planning for franchisors or franchisees: a well-constructed buy-sell arrangement can provide peace of mind for you and your family that...|
|Next Article:||Go mobile: streamlining admin and consumer-facing processes: once IT and technology gets out of the way, and focuses on empowering productivity and...|