EMV A Gated Parking Systems Perspective PIE 2014 March 18 th 2014
EMV & Gated Parking Systems Past practice PCI EMV in Canada NFC Contact & contactless Terminals Certification Support What s next?
Past practice Cash & revenue control Credit cards in parking Toronto Parking Authority
PCI - Certification ACCESS AUTOMATION - Encryption - Merchants PARKING - Manufacturers ACCESS CONTROL
EMV in Canada and around the world Chip and PIN Terminals Acquirers & Gateways Certification protocol PCI Certification & De-certification Contact & contactless
System retrofit vs. replacement Some things to consider System communication protocol, (RS422, TCP/IP) Where do I put the EMV terminals? What about credit card transactions in the exit lanes? How long do card payment terminal certificates last? How long will it take to upgrade my system?
Support Who fixes what? The partnership. The supply chain
Full Service Payment Stations
EMV Card Payment Terminal
EMV Kiosk Terminal
What s next? Telephones, tablets, and cars oh my!
Thank you
Impark s Approach Managing EMV Parking Industry Exhibition (PIE) Chicago, March 18, 2014 Christoph Jan Sepp, Director, Business Solutions
Agenda About Impark Organizational Nuances EMV in Canada Approach to dealing with EMV Equipment procured by Impark Other equipment Actual Exposure 2
About Impark Impark is one of the largest commercial parking operators in North America Manage more than 2,400 lots in Canada and the US Portfolio includes close to 500,000 stalls in 34 branches and 300,000+ assignments in ecommerce Suite (subscribers/monthly parkers) Processed 30 million credit card transactions in 2013 ¾ Canada ¼ USA Overall credit card transaction ratio vs. other methods of payment grew 48% over 3 years (2011 to 2013) and almost doubled in the US Manage close to 3,000 devices with a credit card reader (2,300 single/multi space pay stations, 200+ PIL/POF terminals, 400 stand alone POS terminals) 3
Organizational Nuances Impark identified in 2008 that PCI Compliance and associated payment network expertise would be a competitive advantage A group was formed consisting of members of the Impark Treasury Department and Impark IT: Credit Card Processing Group Deal with all credit card payment streams centralized function Reconciliation and credit card revenue trending Incident investigation and management Deal with standards changes such as EMV mandated by payment networks 4
EMV in Canada 2003 Visa announced migration to chip technology 2005/2006 Other payment networks followed with similar announcements 2012 December 31, 2012: Definitive Liability Shift Effective Date in Canada for Visa and MasterCard (Amex was Oct 31, 2012) 5
Equipment procured by Impark Approach to Dealing with EMV Means: Impark did negotiate terms and conditions of procurement of such equipment with manufacturers Mandatory requirements as part of performance level clauses in Master Supply and Services Agreements with key equipment vendors: [ ] equipment will meet or exceed all PCI PA-DSS requirements and all industry developments mandated by credit card issuers and payment networks and technological innovations in credit card processing [ ] including without limitation, EMV standards. Impark is procuring certain types of equipment directly from acquirers. Typically such equipment meets/exceeds payment networks standards (i.e. EMV) 6
Other equipment Approach to Dealing with EMV Following scenario typical for Pay-in-Lane / Pay-on-Foot deployments: 7
Other equipment Approach to Dealing with EMV Typically means Impark did not negotiate terms and conditions of procurement of such equipment Risk / exposure mitigation Negotiation with acquirer re/ participation on No Signature Required (NSR) programs Clauses in management agreements Awareness / education of clients (that own such equipment) Work proactively with equipment manufacturers and partners towards compliance and/or towards risk mitigation (i.e. P2PE) Leverage Credit Card Processing Group alike functional department to monitor chargeback volumes, unusual revenue levels, patterns etc. to detect fraudulent transactions early 8
Actual Exposure In 2013, Impark has performed investigations for the following types of incidents: Revenue liabilities towards clients Revenue recovery Credit card fraud liabilities towards acquirers and customers (10.9% of all investigations in 2013) Skimmers on multi space pay stations (EMV + mag stripe would not address the issue) Fraudulent credit card testing on 3 rd party card not present environments (not applicable as Card not Present ) Conclusion: Since liability shift had occurred in Canada, Impark did not have any detectable incidents in 2013 that can be attributed to EMV chip/pin vs. mag stripe 9
Thank You. Christoph Jan Sepp csepp@impark.com 10
EMV IN THE US! PIE, Chicago, March 2014
PATH to EMV ADOPTION RATES Parkeon, PIE, Chicago 2014
PATH TO EMV WHY MIGRATE?» Fraud level» Liability shift: costs induced by frauds are supported :! Either by card issuers! Or by Merchants that don t have an EMV terminal: if the use of such a device could have prevented the fraud from occurring, the retailer may bear the cost of fraudulent transactions, depending on the terms and conditions between that retailer and its Acquirer Parkeon, PIE, Chicago 2014
HERE COMES EMV LET S GET READY FOR CARD SWITCH» Huge amount of investment has been made in EMV technology around the world» The chips in the cards also can support other functions, including contactless payment and loyalty programs.» Are they the best alternative to fend off breaches and meet the growing demand for functionality that cloud-based mobile apps can bring to the table?! At least for now, they seem to be the surest bet & the major card networks certainly believe so. Parkeon, PIE, Chicago 2014
PARKEON EMV Solutions Parkeon, PIE, Chicago 2014
PARKEON EMV EXPERTISE» Accepting EMV transactions since 2006 in 12 different countries» More than 20 million EMV transactions processed on 2013 Parkeon, PIE, Chicago 2014
PARKEON CREDIT CARD READERS IN NORTH AMERICA EMV COMPLIANCE» M900 card reader! Widely deployed in USA & CAN! Chip no pin OR Chip and pin! No PCI PTS compliance» Can it be used for EMV in the US?! We have confirmation from Visa & MasterCard Europe (Need to be checked for the US) that for configurations with chip no pin and contactless, PCI PTS does not apply, so M900 could be used in that configuration! If US EMV requires chip and pin authentication then Parkeon can deploy the M1000 Parkeon, PIE, Chicago 2014
PARKEON EMV CREDIT CARD PAYMENT SYSTEM WORK IN PROGRESS IN THE US» MEET ALL PARKEON PAYMENT PARTNERS! Understand the EMV specifics in the US! Share the roadmaps! Provide on EMV migration plans! Adapt our current solutions to US EMV in 2014! Specifics for unattended terminal categories» WORK PROACTIVELY WITH OUR US CUSTOMERS! Inform the cities about EMV requirements! Help them understand the risks! Audit current systems and propose migration solutions Parkeon, PIE, Chicago 2014
Thank you for your attention