How an EMV-Ready Payment Gateway Can Support Migration to Chip EMV and the Changing US Payments Landscape

Transcription

1 EMV and the Changing US Payments Landscape April 2013

2 Contents Introduction 03 EMV Migration 04 The Migration Route 06 EMV-Ready 08 Payment Gateway Best Practice Tips 09 About Creditcall creditcall.com

3 Introduction Contents The payments industry has evolved considerably in recent years. A combination of consumer demand and technological innovation continues to impact how transactions are initiated and processed. Merchants have had to deal with the constantly changing face of point-of-sale, while banks have had to invest in the infrastructure and processes to support the increasing volume of electronic payment transactions. With contactless and mobile offering the next wave of opportunity, attention is also focused on keeping pace with innovation and achieving competitive advantage. The US market in particular has faced some tough challenges. Those across the payments ecosystem, including merchants, integrators, Value-Added Resellers (VARs) and processors, have had to contend with business downturns, the ongoing controversy over interchange fees and increased regulations. One example is the Durbin Amendment, which created waves across the market by capping interchange fees and seeking to increase competition in the processing of payments. Against this backdrop, the US payments sector now has a plan in place for the migration from magnetic stripe (mag-stripe) cards to EMV. EMV is a global standard for credit and debit payment cards based on Chip card technology, covering the processing of credit and debit card payments using a card that contains a microprocessor chip at a payment terminal. EMV has changed the payments landscape it is to mag-stripe what an ipod is to a vinyl record. Ultimately, EMV has changed the payments landscape - it is to mag-stripe what an ipod is to a vinyl record. One of the main drivers behind EMV migration is the fight against fraud. In addition, it promotes standardization, global interoperability and paves the way for new applications and possibilities. As one of the last major economies to tackle this transition, deadlines for the US are imminent and the technology shift is inevitable. However, while there is the imperative to comply, there are considerable opportunities available. This guide looks at the challenges ahead. It offers advice and best practice tips on how organizations can tap into industry expertise around EMV, overcome the technology hurdles and deploy a payments infrastructure for the future. creditcall.com 03

4 EMV Migration The Story So Far Since EMVCo published its first version of the EMV specifications in 1996, several regions have already deployed EMV Chip-enabled cards and payment systems. According to EMVCo, the organization that manages the EMV standards and associated compliance processes, there were 1.62 billion EMV-compliant payment cards in use worldwide as of Q So far, Europe (zone 1) has led the way with 81 percent of its cards and 95 percent of its terminals Chip-enabled as at Q Canada, Latin America and the Caribbean have also made good progress, with 49 percent of cards and 79 percent of terminals meeting the standard. Other regions, such as Africa and the Middle East, and APAC, have begun the transition, though are still in the early stages, with 29 percent of cards and 77 percent of terminals and 27 per cent of cards and 51 percent of terminals respec-tively. So, with its migration plan in place, what does the US stand to gain from the transition to EMV? Worldwide EMV Deployment and Adoption* Region EMV Cards Adoption Rate EMV Terminals Adoption Rate Canada, Latin America and the Carribbean 401M 49.2% 5.6M 78.5% Asia Pacific 372M 26.7% 5M 50.5% Africa & the Middle East 50M 28.6% 0.6M 76.7% Europe Zone 1 755M 80.7% 11.7M 94.5% Europe Zone 2 46M 15.5% 0.9M 73.2% United States** TOTALS 1.62B 44.9% 23.8M 75.7% Source: EMVCo, Q *Figures reported in Q and represent the latest statistics from American Express, JCB, MasterCard and Visa, as reported by their member financial institutions globally. **Figures do not include data from the United States. 04 creditcall.com

5 The US will also be able to close the loop on fraud migrating from regions that have already adopted EMV. The geographical migration of fraud Regions already utilizing EMV Chipenabled cards, combined with a PIN, have dramatically reduced fraud, simply because cards are much more difficult to copy. The US stands to benefit considerably from these anti-fraud measures. Industry-wide statistics on fraud losses in the US are scarce. Figures from The Nilson Report in 2011 estimated US payment card fraud losses at $3.56 billion almost half of the reported global fraud losses. In January 2013, American Banker reported that card issuers had seen a dramatic rise in recent years. Discover Financial Services reported losses in fiscal 2012 of $93 million, a 70 percent jump from only two years earlier. Capital One Financial (COF) also reported a 20 percent increase between 2010 and The US will also be able to close the loop on fraud migrating from regions that have already adopted EMV. In April 2013, a report from the European ATM Security Team (EAST) indicated that five European countries have seen an increase in the number of skimmers found attached to ATMs and other payment terminals. By capturing data from the mag-stripe on users cards and obtaining PIN numbers from miniature CCTV cameras, fraudsters create cloned cards. However, these cards will only work in ATMs in non-emv countries, such as the US. As a result, there is the ongoing risk of fraud migrating to parts of the world that still allow cash to be withdrawn using the mag-stripe card. The impact of this is apparent, with 20 states reporting a rise in ATM fraud through skimmed cards in 2012 (source: Plastic card fraud in the US, using UK cards alone, reached almost $25 million ( 16.3 million) in 2011, according to Financial Fraud Action UK. Moreover, history has shown that card fraud migrates cross-border to non-emv domains and with Canada and Mexico well advanced with EMV this opens up further threats to the US. Those behind card fraud are often part of large organized crime units. In February 2013, federal agents cracked down on a card fraud ring that reportedly amassed at least $200 million using 7,000 fake identities. The criminal operation spanned dozens of states and numerous countries and used stolen money to stock pile cash, purchase millions of dollars in gold, and fund a lavish lifestyle. How an EMV-Ready Time to act While the US migration is now underway, why is it taking over ten years for all the industrialized nations to adopt EMV? The answer is probably the scale and cost of implementation, requiring every single terminal to be modified or replaced, and every credit and debit card to be reissued by the banks. This is why it s easier for smaller countries such as the UK to make the change and have their fraud transferred elsewhere as a consequence. What we do know is that in the thankfully diminishing mag-stripe world, it s going to be extremely costly to be the last man standing. There are a variety of important dates and deadlines for EMV card acquisition in the US. Organizations must define their plans now if they are to have the systems and processes in place. August 2011 Visa announced its path toward EMV contact and contactless Chip technology in the US. October 1, 2011 Visa expands its Technology Innovation Program (TIP) to US merchants. April 1, 2013 The deadline for developing the processing infrastructure for acceptance of Chip. This requires merchants, integrators and processors to ensure their systems can pass contact Chip data or dynamic data from the acquirer system. October 1, 2015 The deadline to establish a fraud liability shift. This will see merchants take on responsibility for fraud from non-emv compliant cards. creditcall.com 05

6 The Migration Route With the move from mag-stripe to Chip-enabled cards, the payments industry must tackle multiple moving parts. These range from hardware and software to transaction types and host systems and can be broadly categorized into two key stages: Point-of-sale (POS) or payment device hardware and applications: These require contact and contactless devices and their applications to be implemented and behave correctly according to the specifications. This also extends to mobile POS devices. Where application developers or VARs are writing or integrating EMV Kernels, the application must be implemented according to the EMV functional specifications. The integration of the POS or terminal and acquirer host system must also be validated. Acquirer processors: Organizations must test the integration of the terminal and acquirer processor. This covers the terminal application, user interface, the connection to the acquirer host and the acquirer host system. The challenges On the frontline of payments, merchants are looking to their device manufacturers and integrators for the necessary EMV-ready technology. They face penalties from the fraud liability shift if they do not comply, so many are prioritizing rapid, low-cost solutions that they can easily implement within the timeframes available. Integrators and VARs To meet demand, integrators and VARs need to propose the necessary EMV upgrades to their merchant customers. They will also need to provide upgrades to the terminal-to-acquirer host interface, paving the way for EMV messages to get from the POS application to the processor itself. The challenge here is not just one of implementation but also of expertise. They will need ways to bridge the EMV knowledge gap and access the right expertise and skills that cover the extensive EMV requirements. n terms of the POS devices, integrators and VARs must provide or source the necessary PIN-pads incorporating EMV Level 1 and Level 2 Kernels along with the necessary PA-DSS and PCI DSS compliance. They must then tackle the testing and certification process, an important and extensive stage in EMV compliance. The testing and certification will depend on how each terminal is being used, whether for offline or online payments, and which configuration of EMV is required. It also requires the integrator or VAR to take their solution to the acquirer processor to conduct the necessary endto-end testing. Once approved, the application will need to go through an integration cycle to connect the terminal to the processors. All of this calls for a review of legacy software, which will need to be upgraded or replaced to meet the EMV requirements. Acquirer processors For processors, the main impact is from the potentially huge volume of testing and processing requests from the integrators and VARs. As such, they need efficient ways to meet this demand and also to offer solutions that will support their customers. In this competitive market, those that fail to deliver an EMV-ready solution risk losing business to processors that are faster to market. 06 creditcall.com

7 How an EMV-ready Payment Gateway can support migration to Chip The EMV certification bottleneck EMVCo not only oversees the EMV standards but also has the task of ensuring the correct implementation and interoperability between all of the EMV cards and terminals around the world. To this end, EMVCo has a set of test requirements that, once passed, allow EMV terminals to be EMV-certified. Approved EMVCo Labs Worldwide Source: EMVCo, April 2013 The role of testing falls to a fairly small number of approved laboratories. Once the units are tested and approved, they can be certified by EMVCo. However, there are two main bottlenecks in this process. The first is that the labs themselves must be approved by EMVCo. The rigorous selection criteria could result in a shortage of labs in the US to do the work. The second bottleneck is the approved labs themselves, which generally cannot turn around the testing for vendors in short order. Testing can take a few months, depending on the number of terminals the labs have to test. Processors may be able to shortcut these timeframes with in-house pretesting and investment in test automation tools. However, at the processor, a typical testing and certification cycle can extend to 16 weeks in a mature EMV market. It is the sheer number of these tests that will put a strain on resources. There are as many as 8.5 million merchants in the US, many of which will be using tier one retail payments solutions. Just a small percentage of this community multiplied by 16-week cycles represents a vast requirement for time and resources. One way to alleviate this burden is to utilize precertified solutions that do not need to be tested when deployed to the customer. These enable processors to minimize the number of certifications they need to complete by using a third party and effectively bringing merchants to the table already approved. For the integrators and VARs, the ability to create an EMV solution, without also having to tackle the testing process, can save valuable time. A typical testing and certification cycle can extend to 16 weeks in a mature EMV market. creditcall.com 07

8 EMV-Ready Payment Gateway When reviewing the integration of systems with the processors, integrators and VARs are often faced with multiple interfaces, each with different characteristics. In addition, many US processors are only recently becoming EMV complaint. Those with existing payment interfaces will need to review and update them as well as update their certification processes to facilitate EMV messages. This is a major undertaking and one that calls for significant investment. This benefits players across the EMV migration process as a whole, including integrators, VARs and processors. Specifically, it provides integrators and VARs with a comprehensive, single interface for multiple processors. As such, it requires only one phase of integration with one interface. It also enables processors to side-step long and laborintensive upgrades and certifications, offering a quick-to-market, pre-certified solution. The growing community of independent sales organizations (ISOs) also stand to benefit. These ISOs look to add value to merchants with affordable off-the-shelf solutions that simply plug into an existing gateway. One of the arguments for non-adoption of EMV in the US is a perceived lack of available solutions. This has become a particular concern as organizations consider the multitude of component parts involved. However, pre-certified solutions that bundle common components, such as PIN pads with an EMV-ready payment gateway, can deliver an approach that benefits the entire EMV process, from processor to end customer. In a competitive market, it also provides a lifeline to organizations vying to meet the deadlines and achieve an all-important first mover advantage. An alternative approach to enable an easier transition is to use an EMV-ready payment gateway. 08 creditcall.com

9 How an EMV-ready Payment Gateway can support migration to Chip The process of EMV migration is complex. With imminent deadlines, organizations across the payments ecosystem cannot afford to be complacent. While the challenges are significant, there are tried and tested best practice approaches to help organizations through the transition. 1 Work with people who have done this before Aside from the actual implementation, one of the main challenges in EMV migration is the scale of education and awareness required. There is a vast set of information and protocols that needs to be understood in the context of EMV transactions. Rather than dedicate time towards upscaling internal knowledge and resources, organizations would do well to partner with established experts and providers in the field. A benefit of the US being one of the last regions to adopt EMV is that it can capitalize on expertise gathered elsewhere. As such, organizations should make use of proven approaches that have already delivered success in the rest of the world. 2 Don t reinvent the wheel While aging legacy systems pose a problem, there are already a number of solutions on the market to facilitate EMV migration. As such, there is no need to start from scratch and, instead, integrators and VARs can deploy offthe-shelf solutions that come with the necessary precertified components. They can then focus resources on the integration of these with their own merchant solutions. 3 Deploy third party multi-platform, low footprint Kernels An EMV Level 2 Kernel is one of the most critical elements of the EMV Chip technology standard. For integrators and VARs, one of the most common decisions is whether to develop or buy-in this technology component. Those that opt for third party Kernels can benefit from a quicker route to market and avoid the need for inhouse development expertise and expense. With numerous operating systems and processors in use in terminals today, one EMV Kernel cannot fit all. Therefore, it is important to find one that works across all common platforms, including Windows, Windows CE and Java. 4 Use tools and expertise in testing and certification Integrators and VARs should look for a fast track to having a clean certified EMV solution for their applications. With a fully certified solution, including EMV Kernels and an EMVready payment gateway, these organizations can effectively outsource the entire certification piece. In the case of EMV Kernels, the supplier should use the same test tools as the EMVCo certification laboratory before submitting the Kernel for EMVCo certification. This will increase the likelihood of the Kernel passing the formal EMVCo certification first time, ensuring the project remains within budget and on time. 5 Explore EMV in the cloud One approach that is already achieving success is EMV in the Cloud. Here, the EMV Kernel resides in a Cloudbased server while other terminal features can be provided via a Web service. The advantage of this is that the terminal has less software and less complexity. It also allows instant software updates, rollbacks and EMV configuration changes and simplifies data handling and management with transaction data stored in the Cloud. While there are limitations with this approach, such as slower transaction times and limited support for contactless transactions, for many this is proving a viable and agile approach. With over 100,000 devices already deploying EMV in the Cloud, this could be the future of payment technology. creditcall.com 09

10 How an EMV-ready Payment Gateway can support migration to Chip About Creditcall Creditcall makes card acceptance simple from any device, anywhere. Whether attended, unattended, online or mobile payments, our award-winning EMV-ready payment gateway and EMV Migration solutions are at the very heart of our clients businesses, ensuring payments flow all day, every day. Founded in 1996 and with over 14 years of EMV experience, Creditcall has a proven track record in providing payment gateway services and offers EMV Migration solutions that are tried and tested. Our EMV Migration solution, ChipDNA, is a rapid EMV Migration SDK for Windows, Linux, ios and Android. It greatly helps ISVs transition from older magnetic stripe technology to EMV and Chip technology. ChipDNA is the easiest and most cost effective way of adding EMV payment functionality into an attended or unattended Point of Sale (POS) application. mpos EMV Migration We were the first EMV-ready Payment Gateway in the U.S., and completed our EMV certification in April Our Chip-based EMV Level 1 and EMV Level 2 Kernel software is used globally in contact and contactless environments such as ATMs, mpos, card readers, PINpads and other POS devices. We are the first EMV-compliant mpos solution to allow businesses accept Chip and PIN cards on the go via smartphones and tablets. Millions of users and billions of transactions depend on Creditcall EMV technology each and every day. Creditcall works collaboratively with companies across Europe, North and South America, South Africa and Asia-Pacific to deliver business-critical payment solutions. Clients include ATOS, DHL, Elavon, Hilton Hotels & Resorts, Toyota, Wayne (a GE Company) and Westfield. Creditcall The Heart of Payments. POS Transport Vending ATM Mobile & Online Parking Ticketing 10 creditcall.com

11 Regional Offices Creditcall Europe Merchants House North, Wapping Road, Bristol, BS1 4RW, United Kingdom T: +44 (0) F: +44 (0) E: W: Registered No: VAT Registered No: Creditcall North America 1133 Broadway, Suite 706, New York, NY 10010, USA T: +1 (800) F: +1 (212) E: W: