Key Considerations in Launching Your EMV Program

Transcription

1 Key Considerations in Launching Your EMV Program

2 Shoreline, a Gemalto company +2bn END USERS BENEFIT FROM OUR SOLUTIONS $2.7bn 2014 REVENUE 14,000+ EMPLOYEES 116 NATIONALITIES 180+ COUNTRIES WHERE OUR CLIENTS ARE BASED 2,900 R&D ENGINEERS 114 NEW PATENTS FILED IN

3 3 The Payment Ecosystem Before EMV

4 EMV Standards: A 20 Year History 1994 Europay, MasterCard and Visa initiate the development of specifications for Integrated Circuit Cards aka the EMV spec 1996 The first version of EMV specifications is published 1999 EMVCo LLC is formed by Europay, Visa, MasterCard to manage, maintain and enhance the EMV Specification 2000 s 2004: JCB joins EMVCo 2008: The most recent version, EMV 4.2, is published 2009: American Express joins EMVCo 2013: Union Pay joins EMVCo 4

5 Key Benefits of EMV o Enhanced Payment Security Reduces the risks & costs relating to fraud o Technology Platform for new payment channels Contactless Payment Mobile Payment ecommerce o Global Interoperability CONTACT OUTSIDE INSIDE EMV chip cards use an embedded microprocessor for payment transactions Secure chip stores payment information Chip card authentication prevents counterfeiting Adds cardholder verification methods Offers online or offline authorization 5

6 One Technology = Three Consumer Payment Options EMV contact card is placed into a device that reads the data on the chip CONTACT PAYMENT TERMINAL Enter individual PIN code. The card checks the PIN stored on the card. The PIN may also be verified online. Sometimes PIN is omitted and a signature is required. EMV contactless payments simply tap the card and pay securely CONTACTLESS PAYMENT TERMINAL 2 inches Mobile EMV = NFC mobile payments provides secure mobile payments, increased loyalty and marketing options for issuers NFC-enabled phone CONTACTLESS PAYMENT TERMINAL 6

7 EMV Adoption Map? 7

8 The date is near o October, 2015 Fraud Liability Shift The party that has made investment in the most secure EMV options is protected from financial liability for card-present fraud losses for both counterfeit and lost, stolen and non-receipt fraud on this date. Bottom line: the weakest link in the EMV transaction chain is responsible for fraud Kaspersky Lab revealed that lost financial data ranged from $66,000 to $938,000 per organization, depending on the size of the firm. Meanwhile, the American Bankers Association took a look at losses after a major corporate breach and found that the average loss on a fraudulently used debit card was $331. (Source: Not a deadline or a mandate EMV is not solving card not present fraud by itself; limited exposure? CNP specific solutions are out there 8

9 Aftermath of Recent Data Breaches o Breaches have created a tipping point in consumer and media perception of payment security. o Securing the payment eco-system is now a matter of urgency. 9

10 US EMV Card Projections After Target Breach Before Target Breach

11 Why EMV? o Static data stored on a magnetic stripe can be easily skimmed to make cloned cards %B5268xxxxxxxxxxxx^Smith/John^ ? ;5268xxxxxxxxxxxx= o No way to verify card authenticity cloned cards are indistinguishable from the original o Signature is a weak form of cardholder authentication Counterfeit Original COPY = ORIGINAL 11

12 Why EMV? o Chip dynamically communicates with authorization system or POS to guarantee Card Authenticity Cardholder Authenticity Transaction Authenticity A C8859DE1F37E74D8B657FB70D C035400BA038001C E16181 E20242A8488A8AEB2CADADC C C5A C DFA F F D CAC E B B C C D00620A A5E00620B B3B00620E5F00620ECB00621EF C E921AB21A721E521C2219E A B07880C A105A00C004BA185A057A5A000005FA005A FA005A05FA05FA FFA A A554E EA60004E200F A0A A83C13175E AB0EE34F54EAA431EA2AE557264CC12A1F6E868A E0D0833DB0F19D15DC4C706DE3BCAB A291D970A2C20DF76EE60E022CB646C AAD126F5A5A5A5A5A FF B6373B15ABED28E130038FCE57D5A752AD9B0CF98F FF FFFFFFFF FFFFFFFFFFFFFFFF A19F270 19F02065F2A029A039F36029F D55502F60200D F D019F235502AA0100CA CB5502A40600C45502FB0300C55502FE0300C35502F80300C D1 5502C3199F4F C C D35502DC1200D FA15502AB06 9FA25502BD0600CD55032A0300CE55032D0300CF DE D D FA DA56 02F20200DB5602F40200DC5602EE0200DD5602F C46B600E5D1ECC0FE9EB0F42B13E15FEA9F7479A0F3217C4BCD D9FB07D11F32A F1328BF92E6CCEF353D1FD4386C68DDD9B9EA1EEAB978E5B8B3074BB128D07F50B DEAAD0C034B755ED83A38BD82B2A74D69CE1E65F0B9E7454BE9224FB65AA859BEA5DFBBEAB631A51FB1F5F54E16F3934C 8DFC833A6A110158BAE3217DEE096E409DD20FDFEF2EB6716CB23A71B42E318C23546F88BB9AECBF36390E569CBD1F5C5 A3366CFDBAFBE54A29D4CC696DF2E60163D58950C8AF189BD38BEF90B0A9ED4E F1300E C440BFAF41EB52 D98E916DAE7F1DDB FC869DF8CF99E0114A77AF8AF0EFF5226D5CF2D4F9E8C2A50FF6B6FD1E4AEFA2C DB FCEF9C F07A A4D F278407A A51C500A4D F2D02656EBF0C059F4D020B0A o Protects against Card Skimming Card Cloning Man in the Middle Attacks Original Mag stripe data on a chip card is different than on a regular card; if cloned or stolen the EMV enabled systems will not allow a non-emv transaction 12

13 Three basic steps of an EMV transaction o Verify the Card is Authentic o Verify the Cardholder is Authentic o Authorize the Transaction 13

14 What is an EMV Profile? o An EMV Profile is a set of rules and controls that determines how an EMV Chip Card will behave in the field o Ingredients of an EMV Profile: Card and transaction authentication: Online vs. Offline Cardholder verification: Pin vs. Signature Usage type: Contact vs. Contactless Usage & Transaction Risk Limits 14

15 Standard EMV Profiles o Payment Associations have defined off the shelf EMV profiles to simplify the decision making process o Payment processors will support some or all of these off the shelf profiles o Debit profile examples VISA : U.S. Debit Personalization Profile for Online-Only Card, supports Durbin-compliant Common AID, Signature preferring (VISA), Online PIN preferring (Debit Network) MasterCard: Profile 35 in combination with 61 (common debit AID), online only, supports Durbin-compliant Common AID, Online PIN preferring MasterCard: Profile 19 in combination with 61 (common debit AID), supports offline card authentication (C/DDA), supports Durbin-compliant Common AID, Online PIN preferring Try it yourself: 15

16 Contact vs. Contactless Dip & Wait nature of contact EMV is not in line with consumer & merchant expectation of immediacy & convenience o Contactless EMV solves checkout speed issue o Contactless EMV helps capture cash o Contactless EMV increases cardholder stickiness translating to issuer top of wallet o Contactless EMV creates a consistent consumer experience between card and mobile transactions. Apple Pay is driving merchant activation of contactless POS 16

17 Which chip card to buy? The brand says we only need the 4k chip, but the personalization vendor continues to push the 10k and the instant issuance vendor says 12k. I have been getting the run around from all of my vendors. - a frustrated VP of payment solutions 17

18 What type of EMV Card should I Buy? o What Payment Applications? VSDC 2.8.1am2s MChip Select MChip Advanced o How Much Memory? 4k 8k, 12k o What Operating System? Java Multos Native o What type of CVM? SDA DDA CDA 18

19 Shoreline suggests a simpler approach o Type? Contact EMV Contact + Contactless EMV o Quantity? 1,000 10,000 o What EMV Profile? Visa US Debit Profile MasterCard Profile #X o Color of Module? Gold Silver (palladium) 19

20 Shoreline suggests a simple approach o Shoreline is integrated & certified today for EMV Issuance with major processors o Pre- Approved by payment associations o Shoreline offers Gemalto cards which can support any standard EMV profile and facilitate a future proof roll out strategy 20

21 EMV Card procurement and inventory considerations o Lead times 8-12 weeks for custom orders after design s approval o Cost vs. Volume vs. Minimum Order size o EMV roll out strategy Friends and family pilot Natural re-issue, lost/stolen replacements Mass re-issue o Chip (operating system + payment application) expiration dates Not related to card expiration Initial term 3 years, with subsequent 1- or 3-year renewal(s) Applies to - Card manufacturer s ability to sell - Issuer s ability to issue (+12 months) 21

22 Adapt Your Card Artwork to EMV Proof and approval needed o Shoreline offers 6 pin chips as standard for contact only cards o Request a design specification sheet/mock card design 22

23 We are #1 in Payment Cards Payment Cards with Chips vs. Mag Stripes Only (mil.) 2013 Chip Gemalto Perfect Oberthur G&D CPI Valid Morpho AB Note IntelCav Magnetic Stripe 101/52 13/135 47/78 15/350 30/247 2/ / / /150 Note: Chip cards include Visa, MasterCard, American Express, JCB, and Maestro cards with mag-stripes as well as ATM-only and domestic-only debit cards, transportation cards, and other proprietary cards The Nilson Report Total Chip Card Shipments 2013 Rank Manufacturer/Headquarters Millions 1 Gemalto Netherlands 2, Oberthur France Giesecke & Devrient (G&D) Germany Morpho Germany Watchdata System China/Singapore Bluefish Technology Denmark Beautiful Card Taiwan AB Card Group Turkey Asia Credit Card Production China Jing King Tech Holdings Hong Kong Exceet Card Group Germany COS Software Co. China Goldpac China DZ Card Thailand Valid Brazil HID Global United States CPI Card Group United States 76.6 Experience Matters Scale Matters Global Presence Matters 23

24 QUESTIONS PLEASE 24