EMV and Restaurants What you need to know! November 19, 2014

Transcription

1 EMV and Restaurants What you need to know! Mike English Executive Director of Product Development Kristi Kuehn Sr. Director, Compliance November 9, 204

2 Agenda EMV overview Timelines Chip Card Liability shifts demystified Considerations EMV, Cardholder Security and PCI

3 EMV Overview EMVCo Owned & operated by Improved security = Decreased fraud Global payment standard = consistent experience worldwide Building block for future technology

4 What EMV is not EMV Mandated / required EMV Protection against all chargebacks EMV Secure holder data EMV PCI DSS Merchant choice to implement! Liability shift is for counterfeit & lost/stolen only. EMV does not protect or encrypt numbers. EMV protects against fraud, PCI focuses on security of sensitive data.

5 Chip s EMV News: Projections Only about % of the -billion-plus credit, debit and prepaid s in the United States currently have an EMV chip. By the end of 205, 70% of U.S. credit s and 4% of U.S. debit s will be EMV enabled, says Aite Group. 2 EMV Migration Forum Projections 3.2B 900M 2M 800M 600M 400M 200M 00M 20M 2M 20M 7% 0% 4.5M 38% 600M 50% 7M 58% 75% 9M 75% 0M 8M 6M 4M 2M Chip-capable s 0M 2% M Chip s Chip-capable s Implementation goals Data from EMV Migration Forum, September 204 Meeting

6 EMV Progress EMV issuance Sam s Club MasterCard Bank of America Barclay (Arrival Plus World Elite) MasterCard Chase (British Airways, Hyatt, Select, Palladium, Sapphire, Marriott) Visa Citi (AAdvantage, Hhonors) MasterCard Target RED MasterCard USAA Wells Fargo Platinum State Employee s Credit Union (NC) United Nations Federal Credit Union EMV acceptance Walmart (enabled) Sears Target CVS Announced accelerated roll-out (i.e. before October 205) References:

7 Investments and Benefits of Implementing Chip Technology Investments Software upgrades Hardware upgrade Testing and certification Time, resources, and training Benefits Fewer disputes for fraud Data becomes less attractive for hackers Path to innovation Consumer confidence

8 U.S. EMV Timelines for Restaurants Oct-202 PCI validation relief Oct-203 MC ADC relief takes effect (50%) Oct-205 Liability shift Oct-206 Visa GCAR relief Apr-203 Processor support for chip processing Oct-205 MC ADC relief (00%) Visa GCAR: Global Compromised Account Recovery MasterCard ADC: Account Data Compromise Applies to Level & Level 2 merchants where 75% of transactions come from a dual interface, chip-enabled,

9 Liability Shifts There is no mandate for merchant to implement EMV! Liability Shift = Potential Chargebacks Generally liability is going to shift to the party using the least secure technology Rules outlined in following pages are as of September 204

10 23 Counterfeit Card Fraud Liability Shift American Express, Discover, MasterCard & Visa Current October 205 For chip s, merchant if non-chip A variety of factors play into liability, such as if the full track data was provided, but for simplicity purposes using the current general scenario

11 24 Counterfeit Card Fraud Liability Examples Current Oct-205 & Beyond + = + = Chip 2 + = Chip 2 + = Chip 2 Chip 2 + = Merchant Same applies for all brands 2 With or without PIN capabilities

12 25 Counterfeit Card Fraud Liability Examples Current Oct-205 & Beyond To summarize + Liability for fraud shifts = to the merchant when a + counterfeit mag stripe = from a chip is used at a Chip 3 + mag stripe = after Oct-205/207 Chip 2 + = Chip 2 Chip 2 + = Merchant Same applies for all brands 2 With or without PIN capabilities

13 26 Lost/Stolen Card Fraud Liability Shift American Express, Discover & MasterCard Current October For chip & PIN s, merchant if is less secure Visa rules on lost and stolen fraud are different than the other brands and will be covered later in the presentation. Applies to face to face transactions 2 A variety of factors play into liability, such as if the full track data was provided, but for simplicity purposes using the current general scenario

14 Lost/Stolen Card Fraud Liability Examples: American Express, Discover & MasterCard 2 Current Oct-205 & Beyond + = + = Chip + = Chip & Sig + = + = + Merchant Chip & Sig = Chip & Sig Merchant + = + = Applies to face to face transactions 2 Visa rules are different; the issuer is responsible for lost & stolen; see details for Visa later in presentation

15 28 Lost/Stolen Card Fraud Liability Examples: American Express, Discover & MasterCard Current Oct-205 & Beyond To summarize Liability shifts + = to the a restaurant when a lost or stolen chip & PIN + = Is used at a Chip less secure after Oct = Chip & Sig + = + = + + = Merchant Chip & Sig = Chip & Sig Merchant + = Applies to face to face transactions

16 Lost/Stolen Card Fraud Liability Shift Visa Current October No change Applies to face to face transactions 2 A variety of factors play into liability, such as if the full track data was provided, but for simplicity purposes using the current general scenario

17 30 Lost/Stolen Card Fraud Liability Examples: Visa Current Oct-205 & Beyond + = + = Chip + = Chip & Sig + = + = + + = Chip & Sig = Chip & Sig + = Applies to face to face transactions

18 3 Lost/Stolen Card Fraud Liability Examples: Visa Current Oct-205 & Beyond + = + = Chip + To summarize = A restaurant is + never = for Chip & Sig + lost and stolen = fraud with a Visa product Chip & Sig + = Chip & Sig + = + = Applies to face to face transactions

19 POS Considerations Supported Cardholder Verification Method (CVM) PIN Signature No Signature (such as implemented at a QSR; also called no CVM) NFC / Contactless Support Is speed of service a need? Do you serve a demographics that is looking to mobile payments?

20 Process Adjustments Staff training Customer verification method Intuitive for the holder Tap, swipe or insert? Patron comfort factor Forgotten s? Additional time per transaction Position yourself for future technology considerations such as NFC, BLE, QR codes and others

21 Next Steps Seek education and updates from a trusted advisor Your processor, acquirer or ISO Your POS or provider The NRA & Heartland helpline [email protected] Reference materials provided by NRA & Heartland EMV & Restaurants, What you need to know How to Successfully Implement EMV Payment Acceptance Evaluate your existing environment Can you update your POS and what is the cost Location and demographics that are best for EMV Chargeback ratios PCI, EMV and holder security

22 EMV Card and Security Validating the Cardholder Offline or online PIN validate the holder Card Authentication Authorization Request Cryptogram verifies the is authentic Authorization Response Cryptogram verifies the issuer is authentic to the Validating Card Use Transaction Certificate (TC) value that provides evidence to the issuer that the was present and was used for payment Combating Replays The Application Transaction Counter combat replay attacks 204 Heartland Payment Systems, Inc. 22

23 EMV and Cardholder Security Implementing the EMVco and Card Brand EMV specifications leaves a customer s primary account number (PAN) and discretionary data exposed In the event that crimeware has found its way into the retailer s POS system or network, the holder data could be stolen and used fraudulently Every EMV being issues in the US includes a magstripe Visa has provided no sun set date on magstripe support Visa International Operating Regulations (Public version), 5 April 203, page 42, reference ID#: Heartland Payment Systems, Inc. 23

24 EMV, E3 and Tokenization EMV is inserted in The and encrypted Transaction wrapped in SSL encryption Cardholder data decrypted in a PCI compliant data center for authorization Single use token returned to POS (reference number) Watch for a future NRA & Heartland webinar on technology! 204 Heartland Payment Systems, Inc. 24

25 Mitigating Risk! EMV and encryption remove ability to skim and monetize data through combinations of verification and encryption EMV and encryption eliminate man-in-the-middle attacks Encryption and tokenization remove data from the businesses environment Encryption eliminates the risk of monetizing stolen data Encryption and tokenization are a definitive response to all organizations should assume they ve been hacked Encryption and tokenization reduce a merchant s PCI scope as per a Coalfire study Cisco 204 Annual Security report Heartland Payment Systems E3 MSR Wedge Technical Assessment White Paper, Coalfire, January 4, Heartland Payment Systems, Inc. 25

26 QUESTIONS? Kristi Kuehn Sr. Director, Compliance (972) Mike English Executive Director of Product Development (877) x2756