Community Financial Institution EMV Readiness

Transcription

1 Community Financial Institution EMV Readiness EMV is a trademark owned by EMVCo LLC 2014 First Data Corporation. All Rights Reserved. Copyright 2014 First Data Corporation

2 EMV Timeline 2011: EMV technology was introduced with a U.S. push for adoption 2013: In the U.S., processors like First Data were required to accept EMV-based payments from merchants 2014: First Data reaches agreements with Visa & MasterCard to utilize US Common AID 2015: Pending fraud liability shift to POS devices (excluding Automated Fuel Dispensers) 2017: Fraud liability shift for Automated Fuel Dispensers By 2015, the total costs of fraud in the U.S. will be an estimated $10 billion per year. In an effort to reduce fraud exposure and the likelihood of customers becoming victims, First Data has adopted EMV technology to provide more secure transactions. Starting in October 2015, the liability shifts to the entity with the lesser technology, so when a fraud occurs and an organization did not have EMV capability, that organization is liable for the fraud loss. Although adopting EMV is not a U.S. Federal mandate, these shifts should motivate clients to act. First Data has done a lot of work on our clients behalf, but they will still need to make a series of decisions regarding their card programs First Data Corporation. All Rights Reserved. 2

3 To get started, here is a quick introduction to EMV technology EMV is a micro-chip payment standard created by Europay, MasterCard and Visa over 10 years ago as a way to improve security of credit and debit card transactions and reduce fraud. The liability shift to the entity with the lesser technology will begin October If the card is EMV and the merchant is not, the liability will shift to the merchant. If the merchant is EMV enabled and the card is not, the liability will remain with the issuer. If both the card and merchant are EMV enabled, the liability will remain with the issuer. The U.S. is the last member of the top 20 world economies to commit to a domestic or cross border liability shift associated with chip payments. By the end of 2015, it is forecast that the U.S. will have 166 million EMV credit cards and 105 million EMV debit and pre-paid cards in circulation First Data Corporation. All Rights Reserved. 3

4 Current marketplace The U.S. is set to transition more than 1.2 billion payment cards and 8 million point-of-sale (POS) terminals to meet the requirements for EMV smart card payments to be ubiquitous. Physical EMV hardware (cards and POS terminals) will cost issuers and merchants more than $6.8 billion in the U.S. By the end of 2015, it is forecast that 166 million EMV credit cards will be in circulation in the U.S. (29% of the total), and 105 million EMV debit and prepaid cards (17% of the total). More than half of U.S. retail locations are projected to be EMV-capable by the end of The long tail of EMV migration will be small and micro businesses. The EMV transition will help fix an important loophole in card fraud: counterfeiting; however, based on experiences in other markets, card fraud is expected to migrate to the point of least resistance - the card-not-present environment First Data Corporation. All Rights Reserved. 4

5 Readiness Plan & Worksheet 2014 First Data Corporation. All Rights Reserved. 5

6 EMV Client Considerations The Basics Familiarize yourself with EMV options Involve your marketing team and educate internal staff First Data will provide cryptography services unless otherwise instructed by the Issuer Online PIN only is supported at this time Offline transactions will be supported utilizing First Data defined offline limits; limits may not be modified once card is issued. Choosing a profile that supports offline transactions is optional. EMV implementation timelines estimated at 6 9 months following assignment of a project manager Contact your Client Business Consultant to request an EMV Agreement Complete the EMV worksheet and submit to your Client Business Consultant EMV Budget Considerations BIN Setup Fee BIN Certification Chip/Plastics Procurement Card Personalization Authorization Transaction Processing Application Transaction Counter Processing 2014 First Data Corporation. All Rights Reserved. 6

7 EMV Worksheet Use this worksheet to document your EMV rollout plan. Upon working through this plan, you will have a working list of vendors and details you need to get started executing your EMV card rollout. Card Programs Which First Data processed programs do you plan to issue (debit and/or credit)? Card Personalization Who will be producing your EMV cards? Networks What networks will you be utilizing (i.e. MasterCard, VISA, STAR )? Consider timing of launch plans with availability of other networks. Chip Expiration How far in the future will your chip expiration dates be? This will affect your plastic orders First Data Corporation. All Rights Reserved. 7

8 EMV Worksheet Chips What type of chip will be embedded into your plastic (type, format, memory size)? Contact Dual Interface Cardholder Verification Methods Which cardholder verification methods will you support? Operating Systems Which operating system will you be including on your chips (i.e. Java, Native, Multos)? Core Processing Changes to your batch maintenance and ISO file will be required by EMV to conform to industry standards First Data Corporation. All Rights Reserved. 8

9 EMV Plan Explanations Card Personalization Who will be producing your EMV cards (First Data, Third Party Provider or Instant Issuance)? Networks What networks will you be utilizing? These may include VISA, MasterCard, STAR or others. Chip Expiration How far in the future will your chip expiration dates be? While the chip card will not cease to function once issued, chips due expire. It is recommended to keep that in mind when ordering chips. Chip card plastic stock differs from what is in place today for mag-stripe cards. The chips embedded into EMV plastics have an expiration date. Once the chips reach their expiration dates, the expired chips will still work on existing cards but new cards cannot be issued with an expired chip. Therefore, in order to prevent having to destroy plastic stock with expired chips, it is recommended that you order only enough cards for a month supply. Card expiration dates are typically 3 to 4 years in the future. Chips What type of chip will be embedded into your plastic (type, format, memory size)? There are a large number of chip manufacturers producing EMV chips of different memory sizes, types and formats. In order to determine which chip to include in your card, you will need to make some decisions: Will your EMV card operate by contact or dual interface? Contact cards are inserted into the EMV reader. Contactless capability allows the terminal to communicate with the card using near field radio frequency by waving the card near or tapping the card to the terminal. Some cards have both contact and contactless technology built into them. Dual personalization cards those with both contact only & contactless capabilities are still undefined in the Industry. Currently, there is no published certified specification for contactless support for the US Debit AID. FD supports 4, 12, 16 K The larger chips are for dual interface and are more expensive How much memory do you need? The memory size of the chip will be determined by the number of applications and AIDs to be stored on the chip along with the functionality First Data Corporation. All Rights Reserved. 9

10 EMV Implementation Explained Cardholder Verification Methods (CVM) Cardholder verification methods (CVM) allow issuers to prioritize which verification method they will support, along with their order of preference. The terminal will also have a CVM preference, but the card will determine which methods are available for the transaction. The card and terminal must have at least one matching CVM in order for the transaction to proceed. You will need to determine which cardholder verification methods you will support: online pin, signature, or no CVM. A selection should be made based on the profile that fits your needs. FD has standard profiles to aid with a quicker to market set up. Online PIN the encrypted PIN is verified online by the issuer Signature verification compares the cardholder signature to the signature on the card No CVM usually includes terminals used by low dollar, quick serve, swipe and go merchants Most U.S. credit and debit cards will support online, signature and no CVM, with offline PIN remaining offline to debit issuers. Issuers will need to determine their order of preference for the CVM used on transactions. Core Processing If First Data is performing cryptography there are minimal changes to the Core Processor. Operating Systems The most common operating systems are: Java, Native and Multos. Java and Multos operating systems are both based on industry standards, while Native systems are unique to the chip manufacturer and are not necessarily dependent on industry standards. Pros and cons should be weighed against availability and costs associated with each operating system. Cryptography Cryptography authenticates information by using mathematics to transform it (encrypt it) into an unreadable format. Cryptography is used in EMV to authenticate the chip, and thus the card, which is being presented. Though the issuer, the processor, or an Association (Visa/MasterCard for example) can perform the cryptography needed in an EMV transaction, most are electing to have First Data complete this work. First Data has completed all of the work to perform cryptography on every chip transaction. This will alleviate the additional development time and expense on your organization from having to receive additional information on every transaction to perform cryptography First Data Corporation. All Rights Reserved. 10