E M V I M P L E M E N TAT I O N TO O L S F O R S U C C E S S April 2012
A G E N D A EMV Overview EMV Industry Announcements EMV Transaction Differences, What to Expect Solution Decisions VFI EMV Solutions Market Certification Considerations In-Field Maintenance Requirements Questions 3
W H AT I S E M V? A joint effort between Europay, MasterCard, and Visa It is a security framework that defines the payment interaction at the physical, electrical, data and application levels between the chip cards and the payment device. EMVCo was founded in 1999 to bring about interoperability between the card schemes U.S. adoption has been slow, but recent announcements from the card brands are pushing the U.S. towards EMV adoption 4
W H AT S G O I N G O N W I T H E M V? Until recently, not much publicly Globally Several organizations exist today in the U.S. and globally, all with a goal of eventually standardizing on EMV (SEPA, EMVCo, SCA, etc.) VeriFone has been deploying EMV capable devices for many years. VeriFone has shipped EMV capable V X and VX Evolution products to 145 countries over the past 7 years In the U.S. Major retailers, like Wal-Mart, have been planning for a shift to EMV capable payment acceptance VeriFone has been deploying EMV capable devices for many years, though adoption in the U.S. market has been slow Several Chip and PIN pilots have been undertaken, mostly by small banking institutions, like credit unions 5
U. S. K E Y D AT E S Visa MasterCard Discover October 2012 - Visa will extend the same Technology Innovation Program (TIP) to merchants in the U.S., allowing them to skip the annual PCI DSS validation for any year in which at least 75% of merchant Visa transactions originate from dualinterface EMV chip enabled devices plus other qualification criteria such as being PCI DSS compliant. April 2013 - Acquirers/processors will be required to support merchant acceptance of EMV chip transactions. October 2015 - The party that is the cause of a contact chip transaction not occurring will be financially liable for any resulting card present counterfeit fraud losses. Does not include automated fuel dispensers (AFD). October 2017 - Deadline for automated fuel dispensers (AFD) to comply. October 2012 PCI audit relief takes effect. April 2013 Acquirers and sub-processor mandate to fully process EMV transactions. Cross border Maestro ATM liability shift to non-emv ATMs. October 2013 MasterCard ADC relief takes effect (50%). October 2015 MasterCard ADC relief takes effect (100%). MasterCard liability hierarchy takes effect (excluding fuel). October 2017 MasterCard liability hierarchy takes effect for fuel dispensers. Discover s approach to EMV is both universal and choice-centric, meaning the company will not restrict any channel, verification process or transaction type. Discover will support: All card authentication channels including online and offline All cardholder verification methods including both chip & PIN or chip & Signature transactions All commerce channels including contact and contactless (which includes mobile) The media has reported that Discover will support the same October 2013 requirement for acquirers and directconnect merchants and the same 2015 Liability Shift guidelines as provided by MasterCard. Note: Discover s EMV deployment efforts are already underway domestically. In January 2012, Discover processed its first U.S. EMV card transactions at enabled Walmart locations. Walmart is certified to process D-PAS in both the U.S. and Canada. 6
C A N A D I A N E M V L E A R N I N G S 1. Industry Adoption How was EMV adopted in the Canadian Market? 2. Customer Impacts As a card holder, what can you expect with EMV? 3. Solution Time to Market Payment solutions have new requirements, challenges, how will this impact the number of choices going forward? 4. Training and Support Merchants are self trained now, how did this change? 5. Card Requirement Changes How did new card products change the landscape? 7
W H O I S E M V C O? EMVCo current members are MasterCard, Visa, JCB, and American Express, each owning an equal share R O L E O F E M V C O Owns, manages, and maintains the global payment industry specifications to define interoperability requirements between chip based payment cards and acceptance terminals Administers the testing and approval process for both chip payment cards and chip acceptance terminals EMVCo is not responsible for specific card brand certifications EMVCo maintains specifications for both contact and contactless payment schemes EMV Contactless specification published to define a common contactless interface to be used by the card brands Currently each card brand uses its own proprietary application MasterCard M/Chip, Visa qvsdc Applications are similar, both follow EMVCo standards 8
W H AT A R E T H E B E N E F I T S O F E M V? EMV focuses more on the security of point-of-sale transactions, with an end goal of reducing credit card fraud EMV requires encryption like VeriShield Total Protect, secured by RSA, to be completely secure B E N E F I T S F O R M E R C H A N T S Fewer chargebacks Reduce liability for card-present transaction fraud If merchant doesn t support EMV and fraud does occur merchant / merchant acquirer is held liable Will help foster the adoption and integration of other payment technologies such as contactless and NFC F O R C O N S U M E R S Fraud reduction Reduced exposure for counterfeiting and card skimming Global interoperability (e.g. European travelers will be able to use their chip cards in the U.S. and vice versa) Will help foster the adoption and integration of other payment technologies such as contactless and NFC 9
W H AT A B O U T C O N TA C T L E S S? How does EMV Contactless differ from EMV Contact? D I F F E R E N C E S E M V C O N TA C T Cards are inserted into the chip card (ICC) reader and remain until the transaction is completed Different from what consumers are accustomed to today Data is read from and written to the chip during a transaction so the card is updated each time it is used Transactions will likely be processed online in the U.S. but offline transaction processing is possible E M V C O N TA C T L E S S Contactless cards must be placed in close proximity to the contactless reader (typically ½ to 3 inches and remain only momentarily Transaction is completed after the card has been removed from the contactless field Dual interface cards access the same chip for processing via contact or contactless read Contactless card usage is typically used for transaction speed and convenience 10
W H AT A B O U T N F C? NFC and EMV Contactless are not synonymous E M V C O N TA C T L E S S V S. N F C Both use short range wireless technology allowing communication between devices at close proximity Contactless is typically a one-way transaction between a passive device (contactless card) and an intelligent reader (contactless capable POS device) NFC-enabled transactions involve twoway communications whereby an NFC capable device (such as a smartphone) exchanges data with an NFC enabled POS device NFC Shares a core technology with RFID tags and contactless smartcards, but there are differences Multiple ISO standards govern NFC cards ISO/IEC 14443 is a group of four standards covering card type variations Type A and Type B Reader / Writer mode governed by ISO/IEC 14443 standard ISO/IEC 18092 Near Field Communications Interface and Protocol Peer-to-Peer mode governed by ISO/IEC 18092 standard 11
U. S. T R A N S A C T I O N V I E W T O D AY & F U T U R E Mag-stripe Validation Host Processing Fraud/ Velocity Check Open to Buy Check MAG-STRIPE DELIVERY Card Swipe Clerk Data Entry/ Amt. Other Send to Host Response From Host Approval/ Decline Message Receipt Printing Application Selection Offline Data Auth. Terminal Processing Processing Restrictions Cardholder Verification CVM) Terminal Risk Management Terminal Analysis/ Decision Card Validation Host Processing Fraud/Velocity Check Open to Buy Check EMV CONTACT Clerk Data Entry/ Amt. Other Card Insert Terminal Verification Results (TVR) Send to Host Response From Host Approval/ Decline Message Receipt Printing Remove Card Card Processing Host Processing Terminal Verification Results (TVR) Terminal Analysis/ Decision Card Validation Fraud/Velocity Check Open to Buy Check EMV CONTACTLESS Clerk Data Entry/ Amt. Other Card Tap Send to Host Response From Host Approval/ Decline Message Receipt (may not be required) 12
T R A N S A C T I O N T I M E S C O M PA R I S O N DIAL Card Swipe Clerk UI (Amount) Transmit/Receive Pre-Dial Connect Print Receipt DIAL WITH EMV Clerk UI/Entry of Data (Amount) Dial Transmit/Receive Insert Card Connect Print Receipt 13
P R O D U C T D E C I S I O N S F O R T H E U. S. Stand Alone Devices Customer total amount verification, EMV card insertion, and CTLS tap Speed of transaction Hand over, external pin pad (with Contact/CTLS/Mag-stripe Delivery support) Integrated Customer facing, Communication options, USB, RS232, IP Register software changes to drive the device differently (Amount first, no walk up and swipe) Semi-Integrated Light cash register integration Direct to host for processing, removing register knowledge of EMV or transaction data 14
E M V C A PA B L E D E V I C E S V X & V X E V O L U T I O N S O L U T I O N S Countertop series V x 570 V x 810 DUET VX 520 VX 820 DUET Portable series V x 610 V x 670 VX 520 VX 680 Consumer Facing series V x 810 VX 805 VX 820 15
E M V C A PA B L E D E V I C E S M X S E R I E S S O L U T I O N S MX 800 series MX 900 series MX 850 MX 860 Consumer Facing series MX 915 MX 870 MX 880 MX 925 16
M A R K E T S O L U T I O N C E R T I F I C AT I O N C H A N G E S Certification Criteria Level 1, Level 2 Certifications Brand Testing Card Scheme testing, individual tests vary by scheme Each card scheme has their own specification (based on EMVCo) Contact and Contactless testing require specialized tools Tools updated frequently to provide necessary scheme simulation Results of New Criteria? Certification will take more time to accomplish at the acquirer levels Ongoing certification work must be maintained for solutions Ongoing investment is required to keep up to date on tools and certification process Specialized training will be required to accomplish this new solutions delivery 17
F I E L D U P G R A D E S, H O W E M V I S D I F F E R E N T Today Devices are deployed, and in some cases, not touched for years Merchants are reluctant to be reprogrammed, to give time for the activity Infrastructure (dial lines,..etc) not setup to handle large download projects Tomorrow, EMV Differences (Contact and Contactless) EMV components, kernels for contact and contactless can and will change New cards issued with new functionalities happen, require downloads to accept the card Interoperability will be impacted if devices are not kept up to speed CTLS software components, EMV and for NFC initiatives, will require updates and changes to remain field-ready for new cards 18
F I E L D U P G R A D E S, R E Q U I R E M E N T S Merchant Device Support Need for more frequent download will require more merchant interaction, either in a manual or automated manner Devices will need to phone home to check for updates at a defined frequency Updates can, and should be, delivered to the POS in an automated manner to ease this new market requirement VeriFone Estate Management Solutions VFI can provide end to end solutions for management of these software components, along with other application requirements Solutions can be delivered as host it yourself, or through VFI Managed Services Allowing for management of your own portfolios, maintenance of your portfolios, and real time dashboards of your status VeriCentre look and feel can be provided to ease adoption 19
M O R E I N F O R M AT I O N To learn more about EMV and VeriFone s hardware, software, training and support solutions that can smooth the EMV migration process, please go to www.verifone.com/emv-us and www.verifonezone.com. 20
Q U E S T I O N S
T H A N K Y O U!