EMV's Role in reducing Payment Risks: a Multi-Layered Approach

Transcription

1 EMV's Role in reducing Payment Risks: a Multi-Layered Approach April 24, 2013

2 Agenda EMV Rationale Why is this worth the effort? Guides how we implement it EMV Vulnerability at the POS EMV Impact on CNP Fraud Preparing Now 2

3 EMV Benefits 3

4 EMV Helps Prevent Fraud EMV payment cards improve security over magnetic stripe technology through an embedded computer chip Validates the card is legitimate, protecting against counterfeit cards Cardholder authentication reduces fraud from lost and stolen cards Authentication can be "chip & PIN or "chip & signature or none EMV Fraud Prevention Features Card Authentication Cardholder Verification Method (CVM) Transaction Authorization U.S. Card Fraud Losses 1 $1.3B or 16% $1.4B or 17% $2.8B or 32% Functionality Protects against Counterfeit Fraud Transactions require an authentic card that is validated either online or offline Helps combat Lost and Stolen card fraud, particularly with cardholder PIN Helps ensure that the person attempting to make the transaction is the person to whom the card belongs Options include Offline PIN, Online PIN, Signature or no CVM Combats Counterfeit and Lost/Stolen Fraud EMV transactions are authorized by the issuer based on security parameters they have established 1 Aite Group, LLC, Card Fraud in the United States: The Case for Encryption, January

5 Global Experience Supports a Chip and PIN Model 2008 U.S. debit card total fraud losses comparison per dollar volume 3 Signature-based transactions:.13 percent or 13 basis points Vs. PIN-based transactions:.035 percent or 3.5 basis points PIN provided 73% better fraud protection than signature alone U.K. experience indicates Chip & PIN provides better fraud protection 4 Between 2005 & 2010, total card purchase volume grew 32%, while total card fraud decreased 17% Lost and stolen card fraud is at its lowest level since the 1990s Counterfeit card fraud is at its lowest level since Retail Payments Risk Forum, Chip-and-PIN: Success and Challenges in Reducing Fraud, Douglas King, January Financial Fraud Action UK, Working Together to Prevent Fraud Euromonitor Data) 5

6 EMV Vulnerability at the POS 6

7 Layered Security Strategy at the POS EMV helps mitigate fraud at the POS EMV does not protect card holder data once the payment method and consumer are validated Data is still in the clear The strong encryption and tokenization technologies in the TransArmor solution can bolster the security of the entire payment transaction and reduce PCI compliance efforts Cardholder security is our first priority at First Data and we offer many layers of security. The TransArmor solution combined with chip-based technologies is the perfect combination of data theft protection and fraud prevention technologies. The TransArmor Solution Card Data Security Protects sensitive payment card data against the theft or exposure from the point of swipe through storage in back-end systems - in transit, in use and at rest. EMV, Chipbased Technology Card Fraud Protection Provides fraud protection against counterfeit, lost or stolen cards at the point of sale. Authenticates card presented is valid, verifies funds are available and validates user as the card owner via a PIN or signature. 7

8 Without Layered Security EMV card is inserted or tapped / waved Card and cardholder are validated Card data sent in the clear Point of capture Card data CORPORATE HEADQUARTERS LOSS PREVENTION MARKETING BILLING REPORTING CUSTOMER SERVICE STORE CONTROLLER DATA CENTER 8

9 Without Layered Security Card data received, used & stored in the clear Point of capture Card data CORPORATE HEADQUARTERS LOSS PREVENTION MARKETING BILLING REPORTING CUSTOMER SERVICE STORE CONTROLLER DATA CENTER 9

10 Without Layered Security Card and cardholder validated with EMV Card data is not encrypted and tokenized, resulting in a large card data environment (CDE) at risk and in scope Point of capture Card data CORPORATE HEADQUARTERS LOSS PREVENTION MARKETING BILLING REPORTING CUSTOMER SERVICE STORE CONTROLLER DATA CENTER 10

11 With a Layered Security Strategy EMV card is inserted or tapped / waved Card and cardholder are validated Card data is encrypted prior to transmission Point of capture Tokenized data Encrypted data CORPORATE HEADQUARTERS LOSS PREVENTION MARKETING BILLING REPORTING CUSTOMER SERVICE STORE CONTROLLER DATA CENTER 11

12 With a Layered Security Strategy Tokenized data is returned, protecting entire card data environment Point of capture T Tokenized data Encrypted data CORPORATE HEADQUARTERS LOSS PREVENTION MARKETING BILLING REPORTING CUSTOMER SERVICE STORE CONTROLLER DATA CENTER 12

13 With a Layered Security Strategy Card and cardholder are validated, reducing counterfeit and lost / stolen fraud Card data is protected throughout the entire payment process PCI scope is reduced to point of capture CORPORATE HEADQUARTERS LOSS PREVENTION MARKETING BILLING REPORTING CUSTOMER SERVICE STORE CONTROLLER DATA CENTER 13

14 EMV Card Not Present Fraud Impact 14

15 Potential Impact of EMV on CNP Fraud Global experience shows adoption of chip technology can reduce fraud at POS but can drive higher card not present (CNP) fraud 6 UK: France: CNP fraud more than doubled, rising to 62% of all fraud on UK cards in 2010 from 30% in 2004 CNP fraud represented 54% of all card fraud on French cards, up 25% from 2006 to 2010 Canada: From , CNP fraud losses increased 37%; overall CNP fraud losses were 31% of all fraud losses in 2008 & rose to 50% in 2010 Australia: CNP fraud increased nearly 70% from Netherlands was in a similar situation to current U.S. state - low fraud rates and slow to adopt EMV, even though Europe was migrating to chip-and-pin 3 Fraud rate in 2005 was.02%;.05% by a 150% increase With Canada and Mexico already adopting EMV standards, US is in similar situation 6. Fraud: The Facts, 2011, Financial Fraud ActionUK 15

16 Merchant Fraud Exposure in CNP Environment EMV technology adoption helps shift liability at the POS only Merchants own the fraud liability in a CNP transaction, not card issuers Higher interchange rates due to greater risk No physical signature or paper receipt to dispute a chargeback Fines/fees apply per chargeback Danger of losing merchant account Merchant placed on Excessive Chargeback list if supporting documentation isn t provided or disputed charges vs. gross charges is > 3% 16

17 Thank you! 17