VARTECH NATION. EMV Certification for IT Professionals

Transcription

1

2 The modern credit card is an American invention but in the twenty-first century, Europe has led the way in credit card technology. The first smart cards, equipped with their own computer chips, showed up in France more than thirty years ago. It s taken a while for those cards, now known as EMV cards, to take hold in the United States, but the trend is irreversible. IT professionals working in retail and hospitality need to know how to navigate the EMV certification process, so their clients and companies can make the most of EMV chip technology. EMV is Here, and Here s Why The move to EMV is mostly about security and fraud concerns, because the computer chip offers far more protection to merchants and customers than the magnetic stripe found on traditional cards. Magnetic stripes contain data that never changes, creating opportunities for identity theft and making it easy to create counterfeit cards. The EMV chip, on the other hand, generates a unique code for each transaction, which makes counterfeit cards useless. Adding a PIN number gives the chip an additional line of defense in cases where a card is lost or stolen. Card fraud has steeply declined in businesses using EMV, but it s been rising in places that can only process magnetic stripe cards. In fact, banks and other credit card issuers have been able to shift some of the liability for losses onto those businesses, because they can now hold merchants financially responsible if fraud occurs in a transaction using the older technology. 2.

3 Opportunities There are other good reasons for businesses to make the shift to EMV: Integrating customer loyalty programs with payment In this scenario, specific offers and discounts could be seamlessly enabled in a single card transaction. Ease of use While inserting chip-enabled EMV cards into a reader can take a little longer than the old magnetic swipe system, new contactless NFC systems promise to make using the cards easier than ever. Global acceptance Most European and many Asian customers already carry EMV cards and will be ready for American vendors to adopt the system. Customer expectation Even if security issues aren t always top of mind for shoppers, many customers appreciate and understand the added safeguards the new technology brings. 3.

4 Challenges With much of the world already using EMV, you might be asking yourself why it isn t already the universal standard in America. That leads us back to EMV Certification. The fact is, converting to the new technology isn t simple, for several reasons. Market size 13,000+ card-issuing financial institutions 5M+ retail locations 15M+ payment terminals in domestic marketplace Cost EMV means new hardware and software, and there are testing and certification expenses. The benefits are real, but resources are needed up front to make the shift. Other players Most businesses rely on payment processors to expedite transactions and merchant acquirers who accept the risk on transactions and hold the funds necessary to resolve them. So EMV certification involves a number of parties: a merchant managing the point of sale, a payment processor and merchant acquirer handling the money, in addition to the financial institutions that issue the cards in the first place. It s the retail or hospitality merchant who manages the point of sale who probably needs your help with EMV Certification, so let s break the process down. 4.

5 The Road to EMV Certification Standards and EMVCo Using EMV means meeting the standards established by EMVCo, a consortium of card issuers that includes Visa, MasterCard, American Express, and Discover. Retailers and other merchants need approval from EMVCo in order to accept the new cards. Setting a Strategy When you re working toward EMV Certification, begin by building a plan with a timeline. Depending on the size and complexity of the business, EMV certification can take the better part of a year. Migration Providers Many choose a migration provider to smooth the way, so use your IT expertise to choose a provider with the right kind of industry experience. Every industry has its own challenges and opportunities, with implications for payment processing. Your migration provider should be able to demonstrate familiarity with those specific issues. Following Through Having an agenda and scheduling frequent reviews with your stakeholders will ensure the fastest possible progress. If you re working with a migration provider, make sure you include them in developing your plan. You re laying the foundation for the rollout of EMV technology at the point of sale, which is critical to every retail or hospitality business. 5.

6 The EMVCO website provides documentation and regular updates; access to some material requires a paid subscription. Certification Requirements If you re not already familiar with them now is the time to get current on certification requirements. The place to start is at emvco.com, the EMV consortium s official online source. Under Approvals and Certifications, you ll find detailed information on key topics: Terminal Type Approval Terminal ESD Evaluation Terminal Integration Security Evaluation Card Type Approval Mobile Type Approval 6.

7 The Tools You ll Need Hardware and Software After you ve reviewed the details on certification, your next move is to help your client or company choose the right hardware and software. If you ve established a relationship with a solutions provider, they ll be your best resource at this stage of certification. Of course you ll need to select a terminal that s approved not just by your client or company, but also by their payments processor and by the financial institutions that issue cards in the first place. The Starting Point Put together an inventory of the current point of sale hardware, including any peripherals, like scanners and printers. Get a handle on what works and what doesn t, and you ll know what features you do and don t need going forward. Mobile and NFC This might be the right time to add mobile payment capability, since you ll be refreshing hardware and software anyway. You should also think about whether you want features like NFC contactless payment. It s convenient, but there s a price tag attached and it s not required for EMV Certification. Time for PIN? You ll want to consider if it makes sense to have chip and PIN terminals, so that customers can enter their PIN numbers this will depend on the region in which your company operates. In the United States, all debit transactions with EMV require chip and PIN validation. However, this may not be the case internationally. PIN and signature is a valid option with many international cards, or cards that are being run as a credit card as opposed to debit. Be sure you know the needs of your customer base, and consider the best choice for implementing a chip and PIN solution. How Specialized is the POS? You ve already brought your solutions provider and payment processor into the discussion, and now it might be time to involve an independent software vendor, or ISV. That s especially true if your client or company has a distinctive or highly individualized point of sale operation. The hardware and software you choose will be the building blocks of the new payment system a foundation for the continued growth of your company or your client s business. 7.

8 Final Certification Steps Once your new hardware and software is installed, it has to be tested in order to win certification from EMVCo. There are three levels of certification. Levels 1 and 2 Most clients and companies only have to think about these. In fact, many small and medium-sized businesses won t have to take a very active role even at Level 1 and 2, because most available hardware and software is already compliant with EMVCo standards. After the payment systems are in place, testing makes sure each of the terminals is secure and able to operate with all the credit card brands accepted at the point of sale. Level 3 Larger and more complicated systems may require more intensive certification. While the first two levels focus on hardware and software, Level 3 certification deals with the entire chain from the merchant s acceptance of a card at the point of sale, through payment processors and merchant acquirers, all the way to the major credit card issuers who make up EMVCo: Visa, Master- Card, American Express, and Discover. Essentially, Level 3 Certification validates the integrity of the payment process by testing every kind of transaction the terminal is equipped to do. The ISPs, as software providers, will be involved as well. The more you learn about testing and requirements, the more valuable you will be to the merchants making a sometimes confusing transition. While the first two levels of certification can go quickly, Level 3 Certification can take weeks or even months to complete. In contrast to hardware and software, Level 3 is an end-to-end certification conducted between the merchant and the brand. The cost to your client or company will vary with the size and level of the certification required, and can range from a few hundred dollars to thousands. The more you learn about testing and requirements, the more valuable you will be to the merchants making a sometimes confusing transition. 8.

9 Keeping Your Customers Protected and Happy EMV certification is an involved and sometimes lengthy process, but the most important test won t come until the first customers reach the EMV-equipped point of sale. Improved security won t make up for a bad experience when a shopper is frustrated by a slow or balky terminal, so make sure your client or company finishes the EMV Certification process with a payment system that s customer-friendly as well as technically compliant. It should be fast, user-facing, and easy to navigate. Fortunately, a carefully constructed and well-tested EMV system will not only keep customers happy, it will help avoid issues that might delay certification. The shift to smart, chip-equipped cards is well underway. The immediate improvements to security, and the potential for better customer engagement, are too good to pass up. IT professionals can be sure that their EMV expertise will be in demand. Training courses and workshops, online and in person, will give you the chance to hone your skills and stay current. Showing your clients and companies how to win EMV Certification builds your professional standing and creates loyal client relationships--but more importantly, it makes the whole global payments infrastructure more reliable and secure. 9.