toast EMV in 2015: How Restaurants Can Prepare for the New Chip-and-Pin Standard

toast EMV in 2015: How Restaurants Can Prepare for the New Chip-and-Pin Standard

Table of Contents For more than 40 years, merchants and consumers have used magnetic stripe credit cards and compatible payment terminals to complete card transactions. In 2015, commerce in the United States will undergo the most dramatic transformation in decades as the U.S. begins the process of adopting EMV (Europay, Visa, and MasterCard) credit and debit card security standards. The adoption of EMV specifications will require credit card issuers to stop offering magnetic stripe cards, replacing them with EMV chip cards -- credit and debit cards with embedded microprocessor chips. Section 1: What is EMV?... 3 Section 2: How does EMV work?... 4 Section 3: EMV in the U.S.... 6 Section 4: The October Deadline... 8 Section 5: The Benefits of Being EMV Compliant... 9 The transition to EMV standards will pose a number of challenges to the way restaurants (and nearly all other business types) have traditionally operated. Anyone who is not prepared for the adoption of EMV regulations in 2015 will risk exposing themselves, and their businesses, to potentially crippling consequences. In order to protect their establishments, restaurant owners need to be informed about the imminent changes and start preparing for the new payment environment before it s too late. This ebook is designed to help you understand what the adoption of EMV will mean for your restaurant and provide you with the information that you need to set your business up for success in 2015 and beyond. Section 6: The Future Implications of EMV Adoption... 11 Section 7: Preparing for the Liability Shift & EMV... 13 Page 2

1 EMV is an acronym that stands for Europay, MasterCard, and Visa, the three major corporations responsible for creating the new security standard. Section 1: What is EMV? 2 EMV security standards are a set of global payment specifications that outline the requirements for transactions between chip-enabled consumer cards and compatible payment terminals. 3 The EMV security standards are defined and maintained by EMVco, a corporation created in 1999 by the major credit card companies responsible for creating the initial EMV specifications. Today, EMVco is made up of the six major credit card issuers around the world: MasterCard (Europay and MasterCard merged in 2002), Visa, American Express, Discover, JCB, and UnionPay. 4 For most of the world, EMV is not a new security standard. The first EMV specifications were published in 1996 and it is estimated that 40% of the world s active credit and debit cards and 70% of its payment terminals are already using the EMV standard (FIS Global). Page 3

1 EMV requires what are known as integrated circuit cards, commonly referred to as chip cards or smart cards, and EMV compliant payment hardware to complete transactions. Section 2: How Do EMV Transactions Work? 2 Chip cards are credit and debit cards with an embedded computer chip. The chip securely stores data and can communicate encrypted information to compatible payment terminals to authenticate and verify transactions. 3 EMV transactions require a two-factor authentication process to complete payments. While the data stored on the embedded microprocessor chip is used to authenticate the credit card, a pin, or in some cases a signature, is required to validate the identity of the cardholder. The two-factor authentication adds an additional layer of security against fraud compared to the swipe-and-sign magnetic stripe card method we are accustomed to in the U.S. 4 There are two methods for connecting chip cards to payment terminals in order to complete EMV transactions, known as contact and contactless payments. Page 4

4a Contact Payments Contact payments require physical contact between the chip card and the payment terminal. This is done through a process referred to as card dipping, in which the chip card is inserted into an EMV compatible card reader. The terminal and chip are then able to communicate encrypted data back and forth in order to validate the card and verify the transaction. If you ve used a credit card in Europe recently, you ve likely already experienced this type of transaction. 4b Contactless Payments With contactless payments, no physical contact is required between the chip card and the payment terminal. Instead, contactless payments are completed using Near Field Communication (NFC). When a chip card is placed in close proximity to a NFC scanner, data is communicated wirelessly between the chip and payment terminal through radio frequencies. Page 5

Section 3: EMV in the U.S. The U.S. has been notoriously slow to adopt EMV and has only recently begun the process of adopting this global payment standard. However, the process will advance drastically in 2015 as the U.S. looks to join the rest of the world s major economies on the EMV standard. Although there have been conversations about US adoption for several years, merchants should no longer question whether or not the U.S. will convert to EMV; that much is confirmed. Instead, merchants should learn how the transition to EMV will progress in the U.S. and what implications it will have on the way they run their businesses. The process of adopting EMV will advance drastically in 2015 as the U.S. looks to join the rest of the world s major economies on the EMV standard. Page 6

1 On October 17, 2014, President Obama announced a new initiative called BuySecure to help expedite the adoption of EMV standards in the United States. The executive order highlights the government s favorable stance towards the adoption of EMV and requires that all newly issued and existing government credit cards be replaced with EMV chip cards. The BuySecure initiative also mandates that federal agencies begin upgrading their payment terminals to enable chip card transactions. 3 The major credit card issuers in the U.S., MasterCard, Visa, American Express, and Discover, in conjunction with lawmakers, have confirmed that October 1, 2015 will mark the deadline by which all merchants in the U.S. (except for fuel dispensers) are expected to have POS systems in place that are capable of enabling EMV transactions. 2 In response to the government s support of EMV and after a year of devastating credit card hacking incidents, a number of major retailers have announced that they will begin the process of switching over to EMV payment terminals by January 2015. Among those who have pledged to transition are retail giants Target, Home Depot, Walgreens, and Walmart. Page 7

Section 4: The October 2015 Deadline The October 2015 deadline is significant primarily because it will mark a major liability shift for merchants in the U.S. Currently, the card issuer is liable for any losses resulting from credit or debit card fraud. On October 1, 2015, liability will shift to whichever party, the issuer or the merchant, is least EMV compliant in a fraudulent transaction. As a restaurant owner or manager, you will not be forced to purchase a new POS system. However, the shift in liability means that while you aren t required to update to an EMV compliant POS system, if you do not update by October 1st, you are vulnerable to potentially crippling penalties if a fraudulent charge occurs at your establishment. For instance, if a guest pays with an EMV chip card, and you do not have an EMV compatible system in place, and fraud occurs, you will be liable for all resulting losses. On October 1, 2015, liability will shift to whichever party, the issuer or the merchant, is least EMV compliant in a fraudulent transaction. Page 8

While the adoption of EMV requires some extra time and effort, there are a number of significant merchant benefits that result from upgrading to an EMV compliant POS system. Section 5: 6 Benefits of Being EMV Compliant 1 Liability Protection The first and most obvious benefit of switching to an EMV compatible POS system for restaurant owners is, of course, protection from fraud liability as a result of a transaction at your restaurant. 2 Accept Guests Primary Payment Method By the time the October 2015 deadline arrives, industry experts expect that at least 70 percent of active U.S. cards will have EMV chips. While the decision to accept EMV payments will ultimately be at the merchant s discretion, customers will not have the option to select magnetic stripe cards after October 2015. This means that guests will inevitably use EMV cards as one of their primary payment methods. By acquiring a solution that accepts EMV transactions, restaurants will be able to better accommodate guests and meet their expectations. Page 9

3 Fraud Protection The two-factor pin-and-chip (or signature) authentication process required to complete EMV transactions adds an extra layer of protection against fraud compared to the swipe-and-sign method. The embedded chip is used to verify the credit card and a pin or signature is used to confirm the identity of the cardholder. This extra layer of authentication makes it more difficult for criminals to use counterfeit and stolen credits. This not only protects restaurant guests, but also reduces headaches for restaurant owners and managers. 4 Local Transaction Verification With magnetic stripe cards, payments have to be sent out to the credit card processor for validation. EMV transactions, on the other hand, can be approved locally through the EMV devices, thus ensuring that a payment is legitimate at the time of the transaction. The ability to validate cards locally can also speed up the payment process, making it possible for restaurants to serve more guests during their busiest hours. 5 Fewer Chargebacks The two-factor authentication method and the ability to verify payments locally using EMV compliant POS systems will likely result in fewer fraud-related chargebacks for merchants, as the number of lost and stolen credit cards, and the prevalence of skimming decline. 6 Opportunity to Improve Your Business If you learn that you ll be required to pay your POS vendor to upgrade existing software, or if you have to purchase a new system altogether, it s probably time to update your system anyway. View these changes as an opportunity to introduce modern technology into your establishment that can improve operations, cut costs in the long-term, and increase revenue with a more optimized system. By the time the October 2015 deadline arrives, industry experts expect that at least 70% of active U.S. cards will have EMV chips. Page 10

Section 6: The Future Implications of EMV Adoption 1 Prioritization of Newer POS Technologies Restaurant owners are looking to modern POS systems that utilize newer technologies to enable greater functionality in preparation for EMV. In a recent study by Hospitality Technology, restaurant executives ranked cloud-based POS, tabletbased POS software, and POS that is priced on a software-as-a-service (SaaS) model among the top things they will look for in their next POS upgrade. These functionalities allow for a more flexible POS experience. Cloud and tabletbased systems create a more mobile POS experience that is not tied to a back office server. They also allow for easier and more regular system updates as new releases can be downloaded to all connected devices remotely, allowing them to adapt to new requirements, like EMV, far more seamlessly than the traditional systems. SaaS POS systems provide restaurant owners peace of mind in knowing that they will not be trapped in a long term contract or commitment with their POS provider. As the US continues its transition to EMV standards, restaurant owners will likely continue to prioritize modern POS systems that utilize newer technologies to offer enable greater flexibility. Page 11

2 Pay at the table Looking ahead, don t be surprised if the United States mandates that merchants complete transactions without removing cards from the cardholder s sight. This regulation is already in effect in some parts of Europe, where they have been using EMV specifications for years. For full service restaurants and nightclubs, such a regulation could pose a serious threat to everyday operations. During your research into modern and EMV compliant POS systems, consider a POS system that offers handheld tablets if that mandate poses a threat to your business. Look for software capable of completing transactions table side, without taking the card to a central POS terminal. 3 Mobile payments The adoption of EMV will create a market for mobile payments. The microprocessor chip embedded in EMV cards can also be embedded in smartphones and wearable technologies like Apple Watch and Pebble. EMV compliant POS systems present major growth opportunities for mobile wallets and mobile payment options. These mobile payments can be completed using the same NFC technology that is used to facilitate contactless chip card transactions. Industry experts predict that in 2016, near field communications (NFC) or other contactless technology will be used by 36.2 million U.S. consumers and, by 2017, mobile payments will have a transaction value of 64 billion dollars. Page 12

The first step in preparing for the 2015 liability shift is evaluating the system that you are currently using at your restaurant. Try to get a sense of what you will need to do in order to implement a system that is EMV compliant before the October deadline. Section 7: Preparing for the EMV and the Liability Shift For restaurant owners, this means that it s time to start researching the various solutions available to you, if you haven t already, so you can ensure that you have EMV compliant technology before the deadline arrives. Page 13

1 Evaluate your Existing System s Plan for EMV If your restaurant already uses a point of sale (POS) system, you should start by talking with your POS provider about how they plan to adapt their hardware and software to meet the new EMV requirements. Your POS vendor should be knowledgeable about EMV and they should already be preparing to roll out the software updates and new hardware required to ensure that their customers will be able to support chip-and-pin by the October deadline. Once you are confident that your POS provider is prepared for EMV, make sure to get a sense of what you will need to do to get an EMV compliant system in place. Below are examples of the types of questions you should ask your POS provider: Will I be responsible for ordering new hardware? What specifically will I need? Will I need any software upgrades? What is it going to cost to upgrade my system so it is EMV compliant? Am I going to need to have an IT person on-site to install or implement anything? What exactly will be required on my end once I have the appropriate software and hardware? How much training will my staff need in order to a new process for completing chip-and-pin transactions? Page 14

2 Evaluate if You Should Change Your Technology If your establishment uses a system that stores information in a backoffice server/computer, there will likely be a significant cost associated with upgrading both the hardware and software required to accept EMV payments. The legacy POS technology in general is poorly suited for this new chip card landscape as software upgrades cannot be released and downloaded remotely. If you haven t already done so, spend some time researching cloud-based POS solutions. Switching to a new POS provider and system altogether could be significantly less expensive and more beneficial long-term than making the necessary upgrades with your currently legacy POS vendor. 3 Select a POS System Geared for the Future Until now, all POS systems and card readers have been designed for magnetic stripe credit cards. The switch to the EMV security standard in the U.S. will be a momentous shift for credit card processors, POS vendors and merchants alike. The October 2015 liability shift will inevitably be the first of many new regulations that pose serious challenges to the way merchants have operated historically. Be diligent in the research process so you do not purchase a new system only to discover that it is not prepared to meet future EMV mandate. Take your time as you read about the various systems available to you and do not select a POS provider that cannot give you a clear explanation of how they are prepared to meet EMV specifications for the October 2015 deadline and beyond. Page 15

What is Toast? Toast is an all-in-one point of sale and restaurant management system. Built specifically for restaurants on an affordable cloud-based platform, Toast offers advanced functionality including tableside ordering, quick menu modifications, real-time enterprise reporting, online ordering, and labor management on an easy-to-use interface. Toast s full-featured POS platform is used nationwide by restaurants, cafes, nightclubs, and enterprise franchises. Learn more at www.toasttab.com Page 16