What is EMV? What is different?

Transcription

1 U.S. consumers are receiving new debit and credit cards with embedded chip technology that better stores and protects cardholder information. These new chip cards are part of the new card standard, Europay, MasterCard and Visa (EMV). There aren t any immediate changes required on your part chip cards will continue to also have the magnetic stripe you re used to accepting, however you need to know how EMV will affect your business in the near future and what you can do to prepare. What is EMV? EMV is a set of technical specifications jointly developed by Europay, MasterCard and Visa in the early 90 s, which describes the standards for chip cards and terminals to communicate. EMV is the global standard for credit and debit card payments. It features payment cards with embedded chips that store and protect encrypted account user data, enhance the authentication of both the card and the cardholder and effectively reduce fraudulent activity in the regions who have adopted this technology. When combined with the option of a PIN as a cardholder verification method, it can significantly reduce fraud. What is different? Essentially, the key difference is that chip cards are actually inserted into the chip reader, rather than swiped through the magnetic reader, and the card must remain inserted for the entire duration of the transaction. One significant change is that a PIN may replace traditional signature on credit transactions, if PIN is supported by the card issuer. The entry of a PIN by cardholders will allow for a more secure method to verify the cardholder's identity. U.S. issued EMV cards will continue to support both chip and magnetic stripe technology for years to come. This will allow for the processing of transactions at point of sale terminals that have yet to be upgraded for chip technology acceptance. Page 1

2 Are business owners required to adopt EMV? Not yet. Only acquirers and processors, like Chase Paymentech, are mandated by the major payment brands (VISA, MC, AMEX and Discover) to have systems capable of accepting and processing chip card technology. However payment brands have announced an upcoming liability shift for business owners, starting in October (More information about the liability shift is below). What are the benefits of EMV? EMV offers enhanced security and fraud protection and reduces the cost of chargebacks. Chip card technology is virtually impossible to copy. Combining its use with a PIN helps to mitigate lost and stolen and counterfeit transactions hence reducing the number of chargebacks. Is my processor ready? If you process credit and debit transactions with Chase, then yes. Chase Paymentech has been processing EMV transactions in Canada for over 7 years. We were in fact, the first acquirer to implement chip acceptance of Visa and MasterCard transactions in the Canadian market. Our network has been processing these transactions long before the U.S. move to EMV. In addition to our host processing capabilities, our certification teams are fully trained and are prepared to accept requests for EMV certifications in the U.S. We have available a comprehensive EMV supplemental guide to assist our clients and integrators with their EMV development. We currently have an EMV terminal for U.S. chip acceptance, the Ingenico ict250, and we will have additional terminals available over the next few months. Our ability to accept EMV chip card technology in both Canada and the U.S. provides our clients, who have businesses on both sides of the border, with a single processing solution. What is the Liability Shift? The major payment brands are large advocates of EMV technology and have released incentives and mandates to help drive adoption within the U.S. region. One of the motivating EMV migration factors, for both U.S. merchants and issuers, is the payment brand announced liability shifts for this region. Liability Shift is a change in who is responsible for the chargeback costs associated with certain fraudulent transactions. Specifically, the EMV Liability Shift is where the liability for fraudulent card transactions, in situations where the card is counterfeit or in some cases has been lost or stolen, will pass to the party that supports the least secure technology. This shift in liability is expected to commence October 1, 2015 (non-petroleum) and October 1, 2017 (petroleum) in the U.S. region. When a fraudulent transaction occurs in a region that has migrated to the EMV chip technology, and one of the involved parties are not chip compliant, then the liability for counterfeit fraud loss shifts to the party using less secure (non-chip) technology. The EMV liability shift is designed to protect the investment of the entity that has invested in chip technology. Today with magnetic stripe card technology, a business may not be liable for the cost of disputed card present transactions if a card is swiped through a terminal, the cardholder's signature is captured and an Page 2

3 issuer authorization is obtained. Subsequent to the introduction of the U.S. EMV liability shift, if a merchant doesn t have a chip card acceptance device, and the use of such a device could have prevented the fraud from occurring, they may bear the cost of that fraudulent transaction. This will be regardless if the card is swiped, a signature is captured and an issuer authorization is obtained. Note that EMV is a card-present technology, as the card must be present to authenticate the technology on the card. As such, the Liability Shift only applies to card-present counterfeit and potentially lost and stolen fraud. What type of fraud is expected to shift? The Payment Brands vary with their stance on EMV liability shift. Below is an outline of how each payment brand expects to implement EMV liability shift, commencing October 1, Visa will be shifting the cost of counterfeit fraud, conducted using non-emv certified technology, to the party who has yet to upgrade to support EMV starting October 1, 2015 (non-petroleum merchants) and October 1, 2017 (petroleum merchants). MasterCard, Discover and American Express will be also be shifting the cost of counterfeit fraud; however, they have also announced that they will also be shifting the cost of lost and stolen fraud, when PIN could have been entered for the chip transaction instance. MasterCard, Discover and American Express all plan on following the same timelines as noted by Visa with liability shift being introduced starting October 1, If a business doesn t accept EMV after October 2015, what will their fraud costs look like? As fraud impacts each merchant differently and issuers will issue chip cards at different paces, it would be extremely difficult to quantify what a merchant s fraud costs would look like subsequent to October There are a number of variables that need to be accounted for, which would include: How many EMV chip cards have been issued to date? How many of those issued EMV chip cards have had their magnetic stripe counterfeited, or how many of those issued EMV chip cards have been lost or stolen? How many of those counterfeit or lost/stolen EMV chip cards will make it into the merchant s place of business and facilitate a successful transaction? What we do know: Issuers are responsible for both counterfeit and lost and stolen chargeback fraud. That will change subsequent to October 1, 2015 if the merchant doesn t support a chip certified device that is capable of prompting for PIN. EMV will mitigate counterfeit fraud; PIN in general is capable of mitigating lost and stolen fraud. MC, Discover and Amex are shifting Counterfeit and Lost & Stolen Fraud starting Oct. 1, Visa is only shifting Counterfeit fraud subsequent to October 1, If the merchant has an EMV device, they won t bear the cost of ANY counterfeit chargebacks. Page 3

4 If the merchant continues to support a magnetic stripe only POS solution, they will begin bearing the cost of counterfeit chargebacks if the magnetic stripe on a chip card is counterfeit; if a counterfeit magnetic stripe only card is presented, existing chargeback rules apply. If the merchant is capable of prompting for PIN during an EMV transaction (where the issuer has programmed their cards for PIN support), then the merchant will be protected from the cost of lost and stolen chargeback fraud in those situations only. If the merchant is not able to prompt for PIN when PIN was the preferred method of cardholder verification, and the chip card turns out to be lost or stolen, the merchant will begin bearing the cost of those lost and stolen chargebacks for MasterCard, Discover and Amex lost/stolen cards. Who is liable for counterfeit fraud if the fraudulent transaction was processed using technical fallback to magnetic stripe? The issuer is liable for any counterfeit fraud if the transaction: (1) is authorized by the Issuer; (2) all of the appropriate values identifying the Transaction as a Fallback Transaction are included within the related Authorization Message; and (3) correct acceptance procedures are followed. Will EMV be introduced for U.S. PIN Debit? There has been much controversy surrounding the development of a technical solution to implement EMV for U.S. PIN debit in a manner that is compliant with Regulation II of the Durbin Amendment to the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 ( Reg II ). An EMV Migration Forum (EMF) debit working group, in which Chase Paymentech participated, worked to gather facts and consensus-based preferences from participating industry stakeholder groups and subsequently published a U.S. regional recommendation at the end of April As part of the EMF recommended technical solution, the concept of a U.S. common debit AID was established for U.S. domestic PIN debit use. The geographical scope of the common debit AID would apply to all U.S. states, territories and protectorates as recognized by Reg II. The solution requires all of the participating U.S. debit networks to outline updates to their network in support of EMV extended data. The U.S. debit networks are now tasked with enhancing their networks to be in line with the recommendation. Chase Paymentech has an active project to develop the necessary infrastructure to support U.S. domestic PIN debit EMV. Will the U.S. PIN Debit Networks be enforcing an EMV chargeback liability shift? Yes, the supported U.S. PIN Debit networks plan on enforcing a counterfeit fraud chargeback liability shift commencing October 1, What do business owners need to consider to support EMV? In addition to the many benefits that EMV and other emerging technologies introduced, there are many factors that business owners need to first consider. This may include supporting new POS solution hardware. For EMV support, that hardware needs to be EMV chip technology certified. EMV Level 1 and EMV Level 2 means that the hardware and core software within the device are EMVCo certified for chip card acceptance usage. A list of those EMV Page 4

5 certified devices can be found on the EMVCo.com website. EMVCo is the governing body for the global EMV chip technology standards. Business owners who may not use a PIN pad today will need to consider purchasing hardware with an integrated PIN Pad or a solution that allows for a PIN Pad to be attached externally. With EMV, at the card issuer s discretion, cardholder s may be required to enter a PIN not only for debit, but for credit transactions as well. Business owners will also need to consider software application upgrades. Speaking specifically to EMV, any new payment application will need to be certified by both the acquirer and the payment brands for chip card acceptance. These certifications for software solutions are a lot more involved than your typical magnetic stripe technology certifications and do require involvement and review with all of the relevant payment brands. As EMV changes the interaction with the consumer at the POS, it is very important that merchants and businesses accepting EMV chip card technology consider the necessary implementation and training process as well. Not only will employees have questions about these changes, but so will the cardholders at the point of sale until everyone becomes more comfortable with the change that EMV technology introduces. What terminals support EMV? In terms of Class B support, any POS hardware that is EMVCo level 1 / level 2 type approved for EMV chip card acceptance can be leveraged to accept EMV chip card transactions. Merchants and Integrators can use any device they choose as long as the device has the proper EMVCo type approval, PCI PTS and MasterCard TQM certifications in place. In terms of Class A support, Chase Paymentech currently offers one EMV certified device, which is the Ingenico ict250 (TCS) terminal. We do have an Ingenico ict250 HCS application and a VeriFone EMV application planned for release over the next couple of months, which can be supported on the Vx520 and Vx680. These solutions are predominately standalone countertop POS devices. We do also offer low end PIN Pads that support EMV; these devices are the Ingenico ipp320, VeriFone Vx820 and Vx805 PIN Pads. They can be purchased through Chase, and we would support them from a Class A perspective, in that we would handle the warranty and replacements. How are EMV solutions certified? If you are using a Class B terminal to support EMV, your solution will need to be certified by Chase to ensure it fully supports EMV. Whoever has coded the solution, you or your integrator, is responsible for the certification with both Chase Paymentech and the payment brands (EMV interoperability testing). Vendors must first be vetted by the Integrator support / Research and Discovery team before they can be added to the VAR EMV certification list. They will be supported based on their certification readiness. Page 5

6 You or your integrator will need to show proof of PCI compliance and that you will be leveraging EMVCo Level 1 and Level 2 certified POS hardware for chip card acceptance. Note that you or your integrator can identify if the hardware is EMVCo Level 1 / Level 2 certified by reviewing the list of certified devices on the EMVCo website ( Or, you can obtain this information from where you purchased your hardware. Page 6