U.S. Smart Card Migration: Stripe to EMV Claudia Swendseid, Federal Reserve Bank of Minneapolis Terry Dooley, SHAZAM Kristine Oberg, Elavon

Transcription

1 U.S. Smart Card Migration: Stripe to EMV Claudia Swendseid, Federal Reserve Bank of Minneapolis Terry Dooley, SHAZAM Kristine Oberg, Elavon UMACHA Navigating Payments 2014 October 8, 2014

2 Who We Are Claudia Swendseid Senior Vice President Federal Reserve Bank of Minneapolis Serves on the Minneapolis Bank s senior management committee Provides executive oversight to operations, customer service, technology & payments functions, as well as to the Financial Services Policy Committee Support Office Conducts industry relations on behalf of the Federal Reserve System, serving as a liaison to selected national banking & business associations Vice Chair, Accredited Standards Committee X9, Financial Industry Standards Federal Reserve Banks Provide financial services to depository institutions & U.S. government Supervise & regulate financial institutions Establish & execute U.S. monetary policy Maintain a stable financial system & contain systemic risk 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 2

3 Who We Are Terry Dooley Executive Vice President & Chief Information Officer SHAZAM Leads SHAZAM s product development, application development & IT infrastructure, corporate & IT security, vendor & customer relationship management, security consultative services, & business continuity groups Chair of the Payments Processing Information Sharing Council (PPISC) Chair of the Secure Remote Payment Council (SRPc) Vice chair of the Debit Network Alliance (DNA) The SHAZAM Network is a single-source provider of core, risk management, card, ATM, marketing, merchant, mobile & ACH 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 3

4 Who We Are Kristine Oberg Vice President & Global Industry Strategist Elavon, Inc. Responsible for vertical segmentation strategy Specific domain expertise includes public sector, healthcare, e-commerce, recurring billing, & B2B payments While a product development leader in Treasury Management at U.S. Bank, she introduced the bank s first commercial bill payment, check conversion, & remote deposit products Background includes strategic planning, product development & innovation, product management, & experience in card acquiring, issuing, ACH, & cash management A wholly-owned subsidiary of U.S. Bancorp 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 4

5 Agenda Status of U.S. EMV Migration Key Roadmap Dates: ATM is next Trends in Card Issuance & Acceptance Debit Card Regulatory Issues Stakeholders Points of View Potential Impact on Card Not Present Fraud Disclaimer: Opinions expressed are those of the individual presenters, not their respective organizations 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 5

6 Status of U.S. EMV Migration 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 6

7 U.S. EMV Migration Roadmaps Key Dates Visa MasterCard Discover American Express October 2012 PCI audit relief April 2013 Acquirers & processors required to support merchant acceptance of EMV transactions October 2013 Account Data Compromise (ADC) relief (50%) PCI audit relief April 2015 October 2015 October rd party ATM acquirer processors & subprocessors required to support EMV data Card-present counterfeit liability takes effect excluding automated fuel dispensers (AFD) ADC relief (95% - 100%) ATM liability shift Lost or stolen liability shift 2013 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. October 2017 ATM liability shift Card-present counterfeit liability takes effect for automated fuel dispensers Lost or stolen liability shift for AFD 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 7

8 When & How Will ATMs Be Impacted? Processors must gear up to accept EMV transactions Visa s roadmap calls for U.S. third party ATM acquirer processors to be certified to handle EMV transactions by October 2015 o ATM manufacturers only recently made available the option of purchasing EMV card readers & software Looming ATM liability shift affects acquirers & issuers Currently, card issuers bear the liability for fraudulent ATM transactions. In October 2016 MasterCard s ATM liability shift occurs; in October 2017 Visa s ATM fraud liability shift takes place. o Shift applies to all ATMs that use magnetic stripe card readers rather than new EMV card readers. Accountability for counterfeit fraud transactions will shift to the party acquirer or issuer - that has not adopted EMV chip technology. The principle is that the party that is the cause of a contact chip transaction not occurring will be financially liable for any resulting card present counterfeit fraud losses. The ATM industry has a great deal to do to implement EMV technology 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 8

9 U.S. Issued Chip Cards By the end of 2015, more than 575 million U.S. cards will include EMV chips (almost 1 in 2) Many are signature-based rather than PIN Industry is exploring enhanced security options like tokenization & point-to-point encryption Perspective: about 1.3 billion magnetic stripe cards are in circulation in the U.S. Source: EMV Cards to Top 575 Million in U.S. in 2015, August 14, Based on data from nine key card issuers Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 9

10 Card Brand Roadmaps Motivate Merchants with Carrots & Sticks Carrots PCI audit relief Ability to accept chip cards from customers Sticks Starting in October 2015, fraud liability for card-present disputed transactions will shift to the party that is not EMV-enabled o Some merchants face later dates for liability shift 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 10

11 Merchant Acceptance Is Slow Only about 10% or less of U.S. point-of-sale (POS) systems are capable of accepting chip card transactions And only 1% of all U.S. POS terminals are enabled or live Testing & certification required first; & the queue is long EMV Readiness at POS Not capable, 90% Live/ Enabled, 1% Capable, 10% Source: USA Today, Data Breaches Heighten Talk of Chip-PIN Cards, February 3, Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 11

12 Is There a Positive Cost/Benefit Proposition for EMV Acceptance by Merchants? Acceptance: Pros Acceptance: Cons Reduces counterfeit fraud in cardpresent transactions Avoids assuming liability shift Reduces PCI reporting cost May help protect against fraud loss shifts to U.S. from countries adopting EMV Supports standard card payment methods across countries Ability to accept EMV cards from international travelers New investments in equipment, software, & infrastructure Protection still needed for card lost or stolen fraud & card-not-present fraud CNP fraud may increase Check out may take longer; cards may be forgotten more often Complexity of supporting different card brand roadmaps May not integrate readily with mobile payment acceptance 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 12

13 The Saga of Debit Card Regulatory Issues Durbin amendment required that all debit cards be able to support at least two debit networks in order to enable merchant routing choice. The EMV specification was not designed to support this. Considerable discussion & debate ensued as the industry tried to find a workable solution. Just as a framework for a solution was beginning to emerge in July 2013, Judge Richard Leon of the U.S. District Court rejected Regulation II, the Federal Reserve's implementation of the Durbin amendment. Leon stated that the dual routing provision is applicable to signaturedebit as well as PIN-debit transactions. This ruling introduced substantial uncertainty that slowed the industry's EMV migration until the high-profile Target data breach in late While EMV would not have stopped the breach, it certainly would have impeded the criminals' ability to monetize it, & the lack of EMV technology in the United States took center stage in subsequent media coverage & congressional hearings. This scrutiny, combined with a January 2014 ruling by the U.S. Federal Court of Appeals striking down Judge Leon's opinion, has re-energized the U.S. EMV migration Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 13

14 Stakeholders Points of View 2013 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 14

15 EMV Migration Forum Cross-industry body working together to facilitate the U.S. migration More than 140 member companies, including global payments brands, issuing financial institutions, merchants, processors, acquirers, regional debit networks, industry associations & suppliers Members pay fees to Smart Card Alliance Entire group meets about every 3 months Working Committees include: Debit, Testing & Certification, ATM, Card-not-Present, Communication & Education, & EMV Deployment Coordination Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 15

16 Main Benefits of Chip Cards Improved usability of U.S. cards in worldwide EMV markets Reduced POS counterfeit fraud (benefits issuer) Harder to skim data from EMV transactions Chips authenticate card readers & EMV cards to one another at POS, & can detect tampering Reduced fraud from foreign EMV cards used as mag stripe cards in U.S Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 16

17 Potential Impact on Card Not Present Fraud 2013 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 17

18 Impact on Fraud Chip cards mainly reduce counterfeit fraud at POS, but fraudsters are making strides Chip cards don t change cardholder authentication per se, PIN or signature are both choices Chip cards alone don t prevent data breaches, but can reduce the resulting damage Clear-text card numbers sent from chip to POS Source: Digital Transactions, EMV: Has Its Day Come? February, Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 18

19 Chip Card Impact on Cardnot-Present Fraud Chip cards don t protect card-not-present transactions in the e-commerce space; other solutions must be applied Other countries have seen fraudsters target CNP once chip cards take hold Fraud attacks shift to most vulnerable channels 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 19

20 Card-not-Present (CNP) Fraud after EMV (local currency) Sources: Financial Fraud Action UK, The Observatory for Payment Card Security, Canadian Bankers Association, Australian Payments Clearing Association France data is not available yet Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 20

21 Importance of Securing CNP Transactions EMVCo s current & upcoming next generation standards do not cover how to secure card-notpresent transactions Gap is being addressed by the EMV Migration Forum CNP Working Committee, which is identifying & assessing effectiveness of CNP fraud mitigation tools; white paper expected later in 2014 ASC X9F Data & Information Security Subcommittee has offered to collaborate 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 21

22 Questions? 22

23 Contact Information Claudia Swendseid Federal Reserve Bank of Minneapolis Kristine Oberg Elavon Terry Dooley SHAZAM Network 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 23

24 Resources EMV Migration Forum public educational website EMV in the U.S.: Putting it into Perspective for Merchants and Financial Institutions, FirstData EMV for U.S. Acquirers: Seven Guiding Principles of EMV Readiness, MasterCard Advisors Post Durbin & Pre-EMV: Payment Acceptance Trends Evolving for Retailers, Association for Financial Professionals PostDurbinandPre-EMV.pdf The Efficiency & Integrity of Payment Card Systems, FRB Philadelphia Discussion Paper, U.S. EMV Roadmap Announcements Visa MasterCard Discover American Express Card Payments Roadmap in the U.S.: How Will EMV Impact the Future Payments Infrastructure? Smart Card Alliance Contactless Mobile Payment, EMVCo Managing the Migration to EMV & NFC Payment Technology, Frost & Sullivan The Migration to EMV Chip Technology: EMV Implementation in the U.S., Gemalto FRB Atlanta Blogs on EMV Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 24