EMV for U.S. Merchants. Are there good reasons to migrate? WHITE PAPER

Transcription

1 Are there good reasons to migrate? WHITE PAPER

2 It s November 4th, 2015 and your monthly statement for merchant processing has just arrived. What you see has you dazed and confused. Instead of the usual healthy balance reflecting those terrific sales figures for October, it s a demand for money! It seems that many of those nice tourists that visited on Columbus Day had their authorized transactions rejected as fraudulent and you ve been left with the check. It s not going to close your business, but a few more months like this and you could be in real trouble. You decide to head next door to your friend s restaurant for a consoling latté. She s got a sticker on the door proudly announcing that she accepts things called EMV Chip and Apple Pay sounds like she might be getting a bill soon, too. During your coffee your neighbor heads over for a chat carrying what looks like two mobile phones you hope that she s not spent this month s take already! What she shows you next blows your mind the second mobile device is a new contactless-enabled pay-at-table payment terminal that she s received for each of her waiters! Best of all, she says it s EMV certified which means that she s no longer liable for counterfeit fraud and has actually increased customer spending and lowered card decline rates. So why haven t you heard about this chip thing? Why have criminals targeted your shop when your neighbor is safe and secure? PayPal will shortly launch a contactless EMV Chip mpos device. The truth of the matter is that EMV migration in the U.S. is not a mandate but a smart business decision to tackle the changing business and fraud landscape. No one is telling you that you are required to migrate to EMV and, in truth; the business case is unique for each and every merchant. But the logic to migrate as soon as possible is undeniable and will benefit your business for years to come. FIS confidential and proprietary information. 2

3 So what is this EMV Chip thing? EMV is a constantly evolving standard for credit and debit card transactions. It governs how the cards and terminals work, how they interact and all of the certification and security surrounding transactions and the infrastructure to support them. Essentially it s next generation cards with a small computer chip replacing the old magnetic stripe. While the magnetic stripe will still be on the card, your customer s card data is now securely stored on a chip as well as on the stripe, making the cards much more difficult to counterfeit. This also means that you need a new certified payment terminal to read them. Securing the data in this way means that the card issuer can be much more certain that the card is genuine and have greater confidence to approve transactions much more frequently. Program Type Brand Member or Issuer Since Date Expiry Date EMV Chip Primary Account Number (PAN) including Issuer BIN Cardholder Name Signature Strip Magnetic Stripe CVx2 Code Hologram Physical Issuer Alongside new features, chip cards retain the features of their predecessors to remain backwards compatible Why should you migrate to EMV? Meeting customer expectations The biggest part of the overall rationale for merchant migration is the liability shift, but we ll come to that later. The most compelling reason for every merchant is customer service meeting customers expectations that you are securely managing their data and deploying the technology that keeps them safe. Across the U.S., banks are issuing EMV chip cards to their customers. In fact, the latest estimates predict that over 70 percent of cards will be chipenabled by the end of If your customers can t use the chip on their cards to perform card transactions, they will perceive your store as less secure a message impressed upon them by their card issuer, the media 2 and even the U.S. Government 3. Think of this cost in terms of customer acquisition how much does it cost you to bring a new customer into your store, and how much does it cost you to win them back? 1 Figures from U.S. EMV Migration Forum 2 Example: New York Times, June 10, 2015 Why Americans are getting new credit cards 3 October 17, 2014 Presidential Executive Order Improving the Security of Consumer Financial Transactions FIS confidential and proprietary information. 3

4 The EMV liability shift Latest figures show that $7.1 billion worth of credit card fraud was committed in the U.S. in 2014 alone 4. That s around $20 million per day! But previously, the bulk of that was paid for by the card issuers who made the yes or no decision on whether the transaction was authorized and assumed the fraud liability. The same process occurred with debit cards. What the EMV liability shift does (which for POS in the U.S. is October 1, 2015) is shift the liability. Liability for fraud committed using counterfeit cards shifts to the transaction party that is not yet EMV compliant, and in this case you (the merchant) are left picking up the check because your payment terminal only accepts magnetic stripe transactions. This doesn t mean you re now liable for all fraud, but counterfeit and lost and stolen fraud currently accounts for 64 percent of card fraud in the U.S. 5 This is the biggest problem that the liability shift is attempting to solve. And to make matters worse, as the pool of non-compliant merchants shrinks, criminals will actively seek out vulnerable stores and target them for fraud attacks coordinating multiple locations or multiple frauds to circumnavigate your usual checks and balances. Essentially they go after the weakest link and if that s you, your fraud level will increase and your liability is guaranteed. By delaying EMV certification, you risk incurring a bigger share of the $20 million every day that you re not compliant. The most compelling reason for every merchant is customer service. 4 Figures from Business Insider and Nilson Report 5 Source: Visa Fraud Reporting System (FRS) and Enterprise Data Warehouse (EDW) 2013; U.S. domestic Visa debit and credit FIS confidential and proprietary information. 4

5 Accepting other payment methods However, it s not all about protecting yourself from liability. Another consideration for migrating to EMV is the number of additional payment methods that your business can support. You can have different acceptance options depending on the type of business that you are running. These options include pay-at-table for restaurants, pay-atpump for gas stations and contactless payments, which is most beneficial for high volume retailers. As EMV is the underpinning technology for all modern card-present transactions, you can begin to accept alternate form factors that are being delivered by issuers to your customers, including Apple Pay or any of the Android-based alternatives that allow your customers to pay with their mobile phone. By investing in a modern payment terminal, you would also have the infrastructure to work with Bluetooth Low Energy (BLE) solutions or even QR-code based systems. Updating your terminal to be EMV certified opens a range of new payment opportunities beyond cards. While few people may purchase from your store purely because you accept Apple Pay, it could be a deciding factor when they need to make a decision between you and a competitor. Do you have the payment method that is most convenient for your customers, or do you require them to schlep to the ATM before they can purchase from you? U.S. Card Fraud Losses 2012 to 2018 (in US$ billions) Source: Aite Group $2.1 $0.9 $2.6 $2.4 $0.8 $3.0 $0.8 $2.8 $2.9 $3.6 $0.8 $3.1 $3.1 $0.8 $3.8 $2.5 $0.9 $5.2 $1.8 $0.9 $ e2015 e2016 e2017 e2018 Counterfeit Lost/stolen CNP Figures indicate that EMV will tackle the largest issue with card fraud, but will likely drive it to other channels. FIS confidential and proprietary information. 5

6 The business case for merchant migration The three components that we ve just outlined make up the core of your business case: customer retention/ acquisition (churn), fraud cost potential from the liability shift, and decreased decline rate (higher acceptance). There is also anecdotal evidence that cash usage declines from the numerous markets that have previously migrated to EMV. However, as the U.S. is already a market with a high card usage rate, the impact on cash usage overall may be localized to specific retailers. Churn Churn rate is a simple calculation essentially the number of lost customers versus the number of new customers that you gain over a period of time. However, it is the impact of this churn on your business that has a cost implication. In many migrating markets, customer perceptions of the security benefits enabled by EMV technology have severely affected the churn rate of businesses, as customers that are less loyal move their purchasing behavior to retailers that are perceived to be more secure. The cost of customer churn varies depending on a company s size, average transaction value and the average number of customer visits per year. For example, if you are a local supermarket where customers visit 20 times a year and spending on average $150 per visit, then your customer is worth $3,000 per year in revenue. If your margin is around 5 percent, then you stand to lose $150 per customer per year if your churn increases. Likewise, if you are the first retailer in the area to migrate, you could gain $150 per new customer attracted. One of the worst things that can happen in your store is that the customer s card is declined. This means longer service times or even abandoned purchases. Decreased decline rate Having a customer s card transaction declined at the point of sale is one of the worst things that can happen in your store. Although this can happen for genuine reasons, such as insufficient funds or stolen cards, many declines are actually due to the fact that the card issuer doesn t trust the transaction. For you as a retailer, this means longer service times or even abandoned purchases. Installing a chip-enabled terminal allows the card issuer to make better decisions and has a significant effect on declines reducing declines on domestic cards by around 8 percent and on international cards around 14 percent 6. This can have a real impact on your revenues, reduce queuing times and greatly increase customer satisfaction. 6 Figures from Visa based on multiple migrations Payments with smartphones will become more popular in the next few years as major manufacturers launch services FIS confidential and proprietary information. 6

7 Liability for fraud If you haven t yet invested in achip-enabled POS device for your store and your customer presents a chip card for payment, you are now liable if the transaction turns out to be fraudulent regardless of authorization from the card issuer. Currently over half of the world s card payment fraud is committed in the U.S., however, it could actually be higher as the liability currently rests with the card issuers and it is likely that some fraud is simply written off and is not being reported. Criminals target the weakest link in any payments system and, as demonstrated in other markets, will begin hunting down those merchants yet to rollout the new chip-enabled terminals. This means that until you migrate, you are being hunted. Fraud with counterfeit magnetic stripe cards typically doesn t reduce significantly until market migration of cards and terminals is around 85 percent complete. But the number of merchants bearing the fraud losses declines and becomes more concentrated as the migration progresses. Thus, merchants that are late to migrate will suffer the dual impact of bearing all the fraud costs due to the liability shift and experiencing an increasing share of all card fraud activity. Imagine that you have 20 stores, each processing around 30 customers an hour at an average transaction value of $100. This means that your chain generates around $60,000 per hour. If you are the target of a coordinated fraud attack, it s possible that you could easily lose an hour s revenue, the goods that have been sold and be subject to compensation claims. It could be an expensive hour s trading. Is your business capable of sustaining that kind of hit? Criminals are well organized and communicate, so if they have success at your store once, they will keep coming back until you ve migrated. Once you have chip-enabled terminals installed and operating, then liability returns to the card issuer and this problem disappears from your perspective. 100 Domestic Approval Rate (LAC) 91.3% 94.9% Cross-border Approval Rate (CEMEA) % 94.7% Mag-Stripe EMV Chip 0 Mag-Stripe EMV Chip Past migrations show that more transactions are approved once EMV is implemented Note: VisaNet data for 12 months ending July 2014 FIS confidential and proprietary information. 7

8 Why is EMV a merchant issue? It s the last point in the business case that really makes EMV a merchant issue. The liability shift is an interbank agreement that moves liability for counterfeit fraud between the Issuer and Acquiring banks dependent on their migration status. However, because you are connected to the cards network via an Acquiring bank (or possibly via a processor or reseller); the liability that they incur is passed down the line in the same way that all other costs and fees are passed on. Being at the end of the line, and the front-end interface to the customer, means that it s invariably you as a merchant that will bear the costs of counterfeit fraud. The only way that you can avoid these pass-through costs is to migrate to chip technology and to gain the required certification in conjunction with your acquirer. The decision to change liability for counterfeit fraud didn t come from the banks. In order to reduce the overall fraud levels in their networks and to drive chip migration, the major payment brands created liability shifts. These are not mandates. There is no legal imperative for you to migrate to chip. But as you can see, the liability shift means there are compelling reasons to not be the last man standing. If I don t migrate, will I be in trouble? The payment brands have issued no mandates for merchants to migrate. Indeed, as you have no direct contractual relationship with the payment brands, they can t force you to do anything. However, your own processor or reseller may decide to mandate migration and if you wish to continue supporting only magnetic stripe card transactions then you may need to find an alternate supplier. Chip migration is a business decision. You must determine the timing based on what is right for your business. To date merchant migration in the U.S. has been comparably slow with as few as 20 percent of POS terminals likely migrated on liability shift day 7. This means that the largest payments infrastructure migration in history will happen mostly after the liability shift has occurred, putting pressure on the entire system to move quickly. But once it starts, the industry migration to EMV will be driven by finite timescales as the retail POS payment ecosystem has a number of built-in interdependencies and checks and balances to ensure the integrity of the system. Chip migration is a business decision, and your timing will be all about what is right for your business. Why don t I just go straight to mobile? EMV Chip is the underpinning technology for card payments going forward regardless of the format. One of the major considerations for merchants moving forward is how to futureproof your migration so you are not required to revisit infrastructure shortly after it s implemented. A significant innovation changing the market is the proliferation of new programs to enable payments using smartphones, but these are not yet prevalent on 7 FIS OTS informal research conducted with major U.S. processors FIS confidential and proprietary information. 8

9 any significant scale. Many of these use the EMV contactless interface (sometimes called NFC) that requires additional capabilities on your POS and in your processing system connection. You may have already been asked if you accept Apple Pay or any of the other similar NFC payment methods, all of which are based on EMV technology. Ensuring that you can support these requires only an incremental addition to the basic EMV infrastructure and can generate new customers for your store. If you want to support QR code payments, it can be useful to have a large color screen on your customer-facing device so that codes can be displayed. Likewise, many POS devices support the Bluetooth Low Energy (BLE) protocol that is the underpinning of beacon driven payments. Careful selection of your device will ensure that you re not pinned down to a single technology. However, perhaps the greatest change to card payments in the U.S. was an amendment to the Dodd-Frank Wall Street Reform and Consumer Protection Act known as the Durbin Amendment 8. This enshrined some merchant rights into legislation that allowed for choice of independent debit networks for each debit transaction. To ensure that this remains possible in EMV, a special application known as the Common Debit Application is being loaded onto most U.S.-issued debit cards. This application is a technological facilitator that ensures the existing routing options that you currently have. You can decide whether to create the choice at the POS for each transaction or whether to use existing automated routing if you have a merchant switch. Essentially migration to EMV Chip should not reduce the routing choices that you currently enjoy. So do I just buy a new POS terminal or is there more to it? As the U.S. cards market has grown organically over the past 50 years, there are considerable variances in technology deployed and many more players delivering solutions. The EMV liability shift isn t just based on chip technology, but on the implementation of a new payments ecosystem that is certified as a whole. This is a big change from today, where just the interfaces are checked. It is by doing this check on the whole system that card issuers can have the confidence to accept liability and also to increase positive authorization of transactions when EMV is in place. Level 3 certification covers all the components of the acquiring infrastructure EMV Payment Terminal EMV Level 1 Certified EMV Kernel Level 2 Certified Retail System Register Back-Office Retail Payment Host (Switch) Processor Host 8 Full text of the amendment FIS confidential and proprietary information. 9

10 For you as a merchant, this means that you need to purchase hardware and software that has basic certifications, known as EMV Level 1 and Level 2. You can check these certifications on the EMVCo.com website. However, these components alone are not a certified solution. You will need to work together with your vendors and processor to ensure that you receive a Level 3 certification from each of the payment brands that you accept. This is often known as Terminal Integration Testing. Level 3 ensures that the entire system is secure so that messages generated by the customer s card interacting with your POS reach the card issuer without risk of alteration, interception or manipulation of any kind (see visual above). This creates the trusted framework necessary for a modern payments infrastructure. This is a whole new process and makes EMV implementation more time and resource consuming than magnetic stripe, but the benefits make it wholly worthwhile. Due to the added complexity, the major U.S. processors have worked with a number of expert suppliers to provide accredited support solutions for merchants migrating to EMV. Known as the U.S. EMV VAR Qualification Program, it gives you access to training programs, implementation support and pre-certification services that have been proven to make EMV migration easier and reduce your time to market. FIS is a part of this program and also accredited by American Express, Discover, MasterCard and Visa to provide EMV migration services in the U.S. The EMV benefits make it wholly worthwhile. FIS confidential and proprietary information. 10

11 Conclusions While it s clear that you re not under any mandate to migrate to EMV Chip as a merchant, the business rationale for doing so is quite compelling. You will gain customer trust, reduce card declines and avoid becoming liable for counterfeit fraud transactions that take place in your stores. But most of all you put in place the technology that will allow you to accept new ways of paying which will potentially generate additional revenues. The liability for fraud is a pass-through cost and you are at the end of the line. With $20 million of fraud committed each day, the longer you wait, the bigger your share of that fraud will be. EMV is about implementing an entire payment ecosystem, so it s not something that you can do alone. You need to speak to your reseller and will ultimately be in contact with your processor during the certification process. While implementing EMV Chip technology is not simple, there are established programs to help you and the experts providing these have proven experience in EMV implementation in multiple nations around the World. EMV is tried and tested around the globe meaning that retailers in the U.S. benefit from all of the evolutions in the technology created to solve problems elsewhere. There s a lot of free information available about EMV, but always be aware of the validity of the source and when the information was created as EMV standards continue to evolve. For the best support, make use of the EMV Migration Forum to support the U.S. migration. But more importantly talk to certified vendors such as FIS OTS for independent advice. About FIS Open Test Solutions Unlocking the power of EMV can be a challenge. You may not have the time, the right specialization or knowledge to implement your project autonomously. We help you remove obstacles, identify critical steps and guide you through each stage of your migration journey to ease your acceptance process as much as possible. We aim to build a true partner relationship and generate insights to develop the solution that fits your business perfectly. You can bank on us for certified test solutions, accredited services and consultancy. EMV is in our DNA. For more than 25 years, FIS OTS (formerly Clear2Pay) has been an evident partner for global banks, payment networks and payment processors. We work closely with organizations such as EMVCo, the EMV Migration Forum and major payment networks such as American Express, Discover, MasterCard, UnionPay and Visa. More information: Contact: emv@clear2pay.com FIS confidential and proprietary information. 11

12 FIS Open Test Solutions 3050 South 35th Street Suite C Phoenix, AZ E: emv@clear2pay.com W: