EMV ESSENTIALS EMV U.S. ISSUERS FOR AND MERCHANTS. Essentials for U.S. Issuers and Merchants A Mercator Advisory Group Whitepaper Sponsored by SHAZAM

Transcription

1 EMV ESSENTIALS FOR U.S. ISSUERS AND MERCHANTS 2010 Mercator Advisory September

2 About SHAZAM Mission To provide and enhance the opportunity for SHAZAM-affiliated financial institutions to compete effectively and profitably in the marketplace through the delivery and support of quality, comprehensive, innovative, and timely electronic financial services. All services will be provided at the lowest possible cost without compromising quality or reliability. Background The SHAZAM network was founded in 1976 by community financial institutions wanting a voice in the delivery of electronic convenience to their customers. Today, the SHAZAM network provides electronic funds transfer (EFT) services to more than 1400 financial institutions in 333 states. SHAZAM provides a comprehensive suite of products and services so community financial institutions can compete. SHAZAM's products and services include: ATM processing Card authorization services Automated Clearing House (ACH) services Debit and ATM card processing Merchant processing Core Banking Mobile Solutions SHAZAM will help set your institution apart in the marketplace and drive your bottom line with enhanced products and services such as: Privileged Status surcharge-free ATM network Health Savings Account (HSA) cards Business debit cards Power Marketing Program SHAZAM Secure security solutions SHAZAM R.A.D.A.R. fraud risk management 2

3 Table of Contents Introduction... 4 EMV Essentials... 5 What Is EMV?... 5 What Is an EMV Card?... 6 Multiple Deployment Choices: The PIN Is Optional but Should It Be?... 6 Why EMV Now?... 9 The PIN Is Powerful... 9 When Is EMV Coming to the U.S.?... 9 Where Is Issuance Today? EMV Comes at Considerable Cost Costs Are Front-Loaded, Benefits at the Back To Dual Interface or Not to Dual Issuer Payment Card Replacement Cost Merchant Terminalization Is Not Trivial One ATM Update After Another Issuers PIN Management Concerns Limited Flexibility Raises Cost Regulation II, EMV, and the Debit Networks Recommendations for Issuerss Start with the Travelers Recommendations for Merchants Conclusion Address the Issues No Jump to NFC Is There Really a Hurry Here? Mixed Signals Watch This Space

4 Introduction Two major payments technologies are coming to America in the next several months and years. The first, Near Field Communications (NFC), is generating plenty of buzz because mobile is hot and NFC is all about contactless payments, smartphones, and mobile marketing. The other, the EMV smartcard standard, may be receiving less attention in the popular press, but it has a far greater impact on payment security, card issuance, issuer planning, payment acceptance and more than its contactless, smartphone-based cousin. The simultaneous advance of these two approaches is causing considerable concern and confusion among merchants, issuers, and much of the U.S. payment industry. By replacing the magnetic stripe (magstripe) card and its easily counterfeited data, this smartcard technology represents a significant security upgrade to the U.S. payments system and the specific problem of counterfeit cards. But EMV s cost consequences are significant as well. For merchants operating in the real world of existing payment infrastructure and massive investments in that infrastructure, EMV represents new costs, but it offers benefits in the form of fraud mitigation. Financial institutions operating ATMs and customer-facing terminals confront similarly complex changes and new costs. EMV also represents a significant cost to almost every stakeholder in the payment transaction. Every point-ofa sale (POS) terminal and every ATM s card acceptance subsystem will require either replacement or enhancement. Issuers, in addition to reissuing cards, must decide on whether and where to employ personal identification number (PIN). With the impact of Regulation II, the Federal Reserve Board s final rule on debit card interchange fees and routing, still hitting financial institutions, EMV s arrival particularly complicates the debit processing picture. For many years, the PIN has secured magstripe card transactions. In particular, the PIN s role in domestic EMV transactions is in question and must be the focus of thoughtful industry evaluation. There is little doubt that the PIN, as another authentication factor, has a real impact on both fraud rates and account holders confidence in the security of their transactions. This report answers key questions about EMV s arrival in the United States, explains why merchants and financial institutions should care, suggests the next steps for these entities to consider, and discussess some of the challenges the introduction of this technology poses for the payments industry. 4

5 EMV Essentials What Is EMV? EMV is a payment security approach based on smartcard technology. It adds dynamic data to the transaction stream that, unlike the static data on standard magstripe cards, makes it nearly impossible to replay payment transactions. More important, because every EMV card is a small securee computer, EMV cards are functionally impossible to counterfeit. Although alternative improvements to payment card security exist, EMV is the technology that the payment card brands and global financial institutions who are the owners of the EMV standard have chosen to use to reduce card fraud losses for PIN-secured offline transactions as well as signature credit and debit transactions. The organizationn responsible for development of EMV standards is EMVCo, a consortium governed by MasterCard, Visa, Amex, and JCB. EMV is now in wide global deployment (Exhibit 1). Globally, more than 1.3 billion EMV cards are in circulation and 15.4 million EMV point-of-sale terminals are acceptance points. A 100 percent penetration rate of EMV cards and terminals is the eventual goal. The United Kingdom and Lithuania have already reached that goal, Ireland is 1/100th of a percentage point away, and both Germany and France are within 5 percent of complete EMV deployment. Canada and Mexico are well along in their EMV roll-outs. One hundred percent EMV deployment willl be the long-term goal for the U.S. as well. Exhibit 1: Global Card and POS Terminal Deployment Rates, Q EMV Cards EMV Terminals Region Penetration Number Issued Penetration Number Deployed Canada/LATAM/Caribbean 38.0% 259,549,, % 4,342,,000 Asia-Pacific 20.2% 317,316,, % 4,174,,000 Africa and Middle East 20.2% 25,882,, % 380,000 Europe Zone % 708,914,, % 10,985,,000 Europe Zone % 31,739,, % 586,500 United States < 1% - ~100,,000 - ~100,000- Source: EMVCo, 2011 Today the largest card and terminal market, the United States, is a magstripe island, increasingly surrounded by EMV-based countries and, as a result, increasingly exposed to cross-border card fraud. 5

6 What Is an EMV Card? An EMV card is a smartcard, in essence a small computer. Each card is exactly the same size and thickness as a standard magstripe card (Exhibit 2). Unlike a magstripe card, an EMV card is not swiped through a reader. It is inserted into a slot on the POS terminal. When the card is inserted, a metal contact on its face connects the card to the terminal and the two devices are then able to communicate. Almost all EMV cards also have a magstripe for use at terminals that haven t been upgradedd to EMV. Exhibit 2: Example EMV Card Source: Visa EMV also supports contactlesss payments. A card capable of both contact and contactless transactions is called a dual interface card. Such a card can be either tapped at the POS terminal for a contactless transaction or inserted into the EMV card reader for a contact-based transaction. From a risk perspective, these options are nearly the same. In Canada, nearly 100 percent of MasterCard-branded cards are dual interface cards. The contactless EMV interface is the same one that smartphones equipped with NFC chips use, and so a POS terminal that supports both contact and contactless EMV is ready to accept mobile payments from smartphones. Multiple Deployment Choices: The PIN Is Optional but Should It Be? For many U.S. readers, the term EMV has been synonymous with a contact-only, PIN-only technology that can be used for either online or offline transactions. Often referred to as chip-and-pin, this approach, used in the U.K. and other countries (Exhibit 3), is just one of the available deployment options. Signature-based EMV transactions via the contact interface exist, as do contactless EMV transactions. The EMV standard supports credit, debit, and prepaid payment cards with or without a PIN. And it can be built into smartphones armed with NFC chips (Exhibit 4). 6

7 Exhibit 3: EMV Deployment Options by Country and Customer Verification Method Chip-and-Offline PIN European Countries Chip-and-Signature / Online PIN European Countries Belgium Netherlands Germany Portugal Estonia Norway Italy Spain France Poland Countries in Other Regions Finland Slovakia Australia China France Sweden New Zealand India Ireland United Kingdom Rest of Europe uses signature Countries in Other Regions Russia Turkey Malaysia (after 2015) Rest of Asia uses signature Brazil Canada Japan Malaysia(after 2015) Chile Source: Mercator Advisory Group, 2012 EMV supports multiple cardholder verification methods (CVM) including PIN, signature, and no CVM. The PIN and this is a critical distinction may be offline or online. Offline PIN means the PIN is stored on the card and the validation step is conducted by the card and the terminal without going online to validate the PIN. The cardholder inserts the card into the reader and enters the PIN on the encrypting PIN entry device, and the terminal then sends the PIN to the card for validation. Transaction size and velocity limits may be stored on the EMV card to further limit the need to go online. 7

8 Exhibit 4: The Multiple Form Factors and Multiple Communications Links of EMV Consumer may enter a PIN (Chip + PIN), a signature or no factor based on limits or in contactless mode Contact Interface Contactless Interface NFC Secure Element SIM Card In Phone, Fob, microsd EMV System EMV Security Stack - Crypto Offline Mode Online Mode Authorization / Limits Payment Network Source: Mercator Advisory Group, 2012 EMV cards can also be deployed for online authorization, called chip and signature. The choice of which authorization approach to employ is generally made on a national level but is, in fact, a decision thatt is up to the card issuer (again, Exhibit 3). Because the United States is an all online all the time authentication environment, some major stakeholders, particularly the card brands, are suggesting that offline PIN and its associated higher costs (the card requires stronger cryptography and larger memory in each card) are not necessary to serve the needs of the U.S. domestic market. While signature-based EMV debit cards will no doubt exist, Mercator Advisory Group expects debit card issuers to continue to employ online, host-based PIN authorization with their EMV debit cards to maximize their fraud loss performance and continue to provide consumers with a confidence-building security feature. Offline capability was a key design criterion for EMV because telecommunications costs in Europe were very high during the 1990s, making online authentication too costly a mode for European banks and merchants. Smartcard technology was the method chosen to limit the need for online capability. By that time, telecommunication costs weree already low in the U.S., and they have since dropped dramatically in Europe. In other words, one of the initial use cases for EMV has melted away. 8

9 Why EMV Now? The venerable magstripe card has served the payment card well for decades, enabling untold numbers of electronic transactions. But the magstripe is no longer able to fend off fraudsters armed with low-cost magstripe readers, card duplication gear, and Internet-sourced card dataa that can be entered into the payments system without strong account holder authentication. As those fraudsters have proven over and over, it is simply too easy to create counterfeit magstripe payment cards. Because credit cards lack PIN protection and online PIN entry is not widespread, multifactor authentication is not available to improve security. The result has been an outbreak of card skimming that has cost financial institutions, merchants, other card issuers, and consumers millions. With most of the developed world now using EMV to prevent counterfeit card fraud, increasingly card fraud is migrating to the United States, affecting both signature-based point-ofsale and card-not-present e-commerce security. From the point of view of payment security, the U.S. is a sitting duck, especially exposed to cross-border fraud and continued growth in card-not-present fraud. The PIN Is Powerful Of course, the PIN s multifactor authentication power is well known. As the 2010 PULSE Debit Card Issuer Survey determined, fraud losses on PIN debit cards were $0.17 per card while signature debit losses were $2.29 per card. Even though PIN is not a dynamic data type, it is a potent fraud mitigation tool, as these numbers demonstrate. It is for this reason that many national EMV implementations include the use of PIN for both credit and debit transactions. At least one country, Malaysia, has chosen to add the PIN after its initial signature-based deployment did not meet its fraud mitigation goals. When Is EMV Coming to the U.S.? The adoption of EMV technology in the United States having been anticipated for years, the card networks have only in the last year begun announcing their intent to bring EMV s smartcard-based payment security to U.S. shores. On August 9, 2011, Visa announced the beginning of the beginning of a U..S. EMV roll-out. Visa s avowed purpose was to pave the way for contactless and NFC-based mobile payments, all taking advantage of EMV s dynamic data security model. On January 31, 2012, MasterCard answered with its own announcement in support of the U.S. EMV rollout. With both major card networks behind the initiative, EMV s arrival in the U.S. finally has some dates to support it. To nudge the payments ecosystem acquirers and merchants in particular Visa announced three separate programs with dates: 9

10 Technology Innovation Program (TIP).. The TIP program allows merchants to skip their annual Visa PCI compliance validation once 75 percent of their Visa transactions are originated on chip-enabled (EMV compliant) POS terminals. The U.S. TIP program goes into effect October 1, Qualifying POS terminals must accept both contact and contactless chip cards and contactless transactions from NFC- just the equipped mobile devices. Visa s TIP program does not eliminate a merchant s PCI requirements, validation once three-quarters of Visa transactions originate from EMV capable terminals. Merchant Acquirers Get Ready. By April 1, 2013, acquirers must be ready to process the cryptographically generated dynamic data associated with each EMV transaction. Merchant Get Ready Liability Shift. After October 15, 2015, if a cardholder with an EMV card must use the magstripe on that EMV card because the merchant does not have an EMV-capable POS terminal, the merchant acquirer will be responsible for any counterfeit fraud associated with that transaction. The merchant acquirer is likely to, in turn, make the merchant responsible for the fraud on that transaction. This shift in liability will be in effect for both domestic and cross-border POS transactions. Gasoline retailers have another two years to prepare, given the high cost of upgrading their automatic fuel dispensers. The phrase liability shift is frequently used in discussions of EMV rollout. The purpose of the liability shift is to encourage the transition to chip cards. With chip-to-chip transactions, there is no concern regarding liability shift. MasterCard s dates are equally aggressive. Both networks are pushing for a comparatively swift EMV rollout in the United States with that October 15, 2015 date. Of course, for thatt to happen, U.S. issuers have to agree to a massive EMV card rollout, but their concurrence is hardly assured. The United States being the largest card market in the world with 1.2 billion payment cards, the return on investment, especially for credit card issuers, is not entirely clear. The mandated migration dates are aggressive. In most other card markets, the EMV migration has been a decade-long process. There is no reason to suspect the largest card and POS terminal market in the world, the U.S., will move any faster despite the card network mandates. On March 15, 2012, Discover announced its support for the North American roll-out with a similar 2013 date for acquirers. Discover processed its first EMV transactionn for Walmart in January At the end of June 2012, AMEX joined the other card brands in support of EMV and announced similar dates for acquirers, incentives, and liability shift. Where Is Issuance Today? EMV issuance in the United States is gettingg under way, but the numbers are modest to date. A few large banks have begun to issue EMV cards to their corporate and high-net-worth customers. Silicon Valley Bank now issues EMV cards to its corporate cardholders. Several credit unions have issued EMV cards as well. More broad-based issuance is still a couple of years or longer. 10

11 EMV Comes at Considerablee Cost Much of the prior discussion addresses the positive benefits of the smartcard-based approach. Numerous issues are associated with the proposed roll-out of EMV, however. This section discusses these concerns. Costs Are Front-Loaded, Benefits at the Back EMV cost is a function of hardware, installation, and time. It is a matter of many billions of dollars. The benefits of an EMV deployment are only realized years after everyone makes the investment. Getting merchant terminals upgradedd takes one time period. Getting cards issued takes another. ATM upgrades will take another. Having consumers learn how to use the cards and make chip-to-chip payments takes even longer. Based on the U.K. experience, fraud reduction benefits don t start to accrue until 70 percent of both cards and terminals are EMV capable and 50 percent of transactions are EMV-based, chip-to-chip payments where both the terminal and the smartcard communicate. Today, U.K. fraud rates are at a 10-year low as measured in basis points. EMV is finally doing its job there, but the wait for results a decade long. To Dual Interface or Not to Dual One of the complicating factors for card issuers and brands is the future of contactless. If you believee in the eventual arrival of NFC-based mobile payments, and Mercator Advisory Group does, then the contactless future is assured. And, if that s the case, then issuance of dual interface cards will be prudent because issuers want to keep their card programs relevant. While over 40 percent of mobile subscribers have smartphones today, plenty of consumers will still be using simple, non-nfc phones for some time. Giving them contactless capability gives them a level of conveniencee and security. Remember, cards aren t going away for a decade or two. Neither option is especially cheap by comparison to magstripe. An EMV contact and contactless dual interface card, including some fulfillment costs to the consumer, costs approximately $2.35 today. With new designs and scale, that cost is forecast to drop below $2.00 shortly and within 18 months reach the $1.20 for the card alone thereafter. At that price point, resistance should melt, but that s for the cards alone. Personalization costs drive the expense up far higher. Issuer Payment Card Replacement Cost Reissuance cost for all payment cards in the U.S. based on cards in circulation and card cost estimates is hardly trivial. Replacing all payment cards will require issuers to spend some $2.42 to $2.85 billion, depending on the contact/contactless choice that they make. Replacement costs for smartcards may also be higher than the current magstripe approach althoughh there is some evidence that smartcard reliability may be higher than magstripe cards. 11

12 Merchant Terminalization Is Not Trivial U.S. merchants have to upgrade over 10 million devices because EMV requires new security hardware and software in the point-of-sale terminal. That is another huge change. Large merchants typically refresh their payment terminals every five to seven years. Small merchants can keep them for far longer. For those reasons alone, despite the liability shift, Mercator Advisory Group s forecasts EMV terminal deployment at just 50 percent by 2016 with another five years to reach 98 percent deployment. EMV deployment in every other market has taken a decade. Given that the U.S. is still the largest card and POS terminal market, it is unreasonable to expect the U..S. migration to EMV proceed at a faster pace. From the merchants point of view, the cost is roughly similar to the card replacement burden. The total aggregate cost of reterminalization in the U..S. ranges from $2.4 billion to $2.6 billion or more, depending on the eventual mix of contact/ contactless capabilities at the POS. Since Mercator expects most merchants to choose contactless payment capability within a couple of years as NFC gains ground, we project thatt final costs will be at the upper end of the range. One ATM Update After Another The cost of ATM updates is an estimated $310 million and more. This is a challenge for small issuers with ATM fleets and for ATM acquirers and independent sales organizations (ISOs) that are still recovering the cost of capital improvements made to comply with the requirements of the Americans with Disabilities Act (ADA). MasterCard s 2013 date for ATM support of EMV pushes yet another heavy cost burden onto ATM operators within a very short period of time and is mandated well ahead of domestic U.S. need, given the issuance pattern to date. Issuers PIN Managemen nt Concerns PIN debit issuers are very familiar with the need for multiple PIN change methods operating at the ATM, online, and in the branch. EMV PIN changes will require a similar range of options; however, at the outset their uneven availability will cause customer service issues. Limited Flexibility Raisess Cost EMV cards have limited flexibility. If an issuer puts out a Visa EMV card and subsequently wants to change network brand or add another application, the reissuing process involves branding issues, costly chip real estate for the application, and management of the application lifecycle over the life of the card. Unlike smartphones and apps, EMV capabilities are largely in the hardware. This limitation has two implications. First, the cost of making major changes includes reissuance of an entire card. At today s estimated cost of $2.00 for a dual interface card, dual interface can t compete with the very low cost of the magstripe and PIN combination in place today. 12

13 Regulation II, EMV, and the Debit Networks If you thought EMV was complicated, now consider its implications for debit processing as it meets the new regulatory environment ushered in by the Durbin Amendment to the Wall Street Reform and Consumer Protection Act. EMV and Regulation II represent a collision of technology design and regulatory intent. EMV s design and deployment modes are based largely on European requirements. For example, high European telecom costs of the 1990s influenced the offline PIN functional design. EMV has worked well in the European market and across much of the globe. Its translation to the U..S., however, is more problematic especially with respect to Regulation II. Besides putting a cap on debit interchange, Regulation II mandates that the merchant have a choice of two unaffiliated debit networks over which it may route transactions. The goal and intent is to give the merchant a measure of least-cost routing control over its debit transactions. The European model of tying a network app to network rails does not support the Regulation II mandate. In pre-durbin days, issuers and networks designed transaction routing preferences to optimize their own revenue streams and cement business relationships. Under Regulation II, however, these issuers and networks no longer control transaction routing. While merchants who operated their own payment switch in pre-durbin days could inspect a bank identification number (BIN) and make a routing determination, today all merchants are supposed to be able to require their acquiring processor to route based on their preferences. With the entry of EMV, however, it appears that merchant choice may be harder to maintain. The EMV specifications themselves direct the card to inform the terminal to select a specific application. At the same time, payment brand rules specify application priority, a rule enforced by the certification processes for card issuance, proofing, terminals, and acquirer processors. In other words, the merchant s routing preference may not be respected by the application with the higher priority. This is especially challenging because, once the terminal selectss the application, the issuer endpoint must have the encryption keys needed to validate the application during card authorization. This further constrains the BIN routing rules used and merchant acquirer s routing choices. If the issuer does not hold the needed keys for a specific application, then the acquirer cannot route the transaction to that issuer and must send it via the other route. The EMV technical specification and payment brand rule restrictions, then, appear to conflict with the letter and spirit of Durbin Amendment Regulation II routing choice provisions. In response to this long list of concerns, the EFT network community has formed a Chip and PIN Working Group through the Secure Remote Payments Council. Its members include several of the major U.S. debit EFT networks, such as SHAZAM, Pulse, Star, Jeanie, COOP, NYCE, ATH, and NETS. The goal of this PIN debit industry group is to bring focus to these issues and to advocate for chip and PIN solution that is compliant with the spirit of Durbin Regulation II and interoperable among all payment brands. 13

14 The other goal of Regulation II was to lower interchange costs. While card networks and issuers have complied with the new capped fee structure, the legislation failed to address in its rulemaking all of the entities in the transaction chain. That means not all merchants are seeing the benefits of the capped interchange fees and should review their processing partnerships. Heartland Payments Systems, with its Durbin Dollars marketing campaign, is complying with the regulation s spirit and passing those savings through to small and medium-size ticket sizes, had already negotiated low debit processing rates. For those merchants, the merchants. Ironically, many of the very largest merchants, especially those with low average new capped debit processing fees were not much of an improvement. Recommendations for Issuers Start with the Travelers An excellent method for issuers to gain experience with EMV and to measure its benefits to cardholders is through a travel card program. Now that EMV is broadly deployed around the world, some U.S. travelers visiting Europe, for example, have encountered problems getting their magstripe-only cards accepted at the checkout. Sometimes the clerk does not know what to do with a magstripe card. Magstripe cards, especially in France, do not work at some unattended locations. So, for some U.S. issuers, continued use of magstripe cards is potentially threatening customer satisfaction. To address this concern if you are an issuer, based specifically on your evaluation on the number of the travelers among your cardholders, put an EMV pilot card issuance program on your schedule. Once you ve performed an analysis of your cardholders travel patterns and consulted with your processor and network partners, issue EMV cards to those travelers who will appreciate the convenience and security that EMV cards offer during travel. As a number of larger U..S. issuers have chosen to do, you may wish to issue cards that are offline PIN capable. While more expensive, they work at every EMV terminal in the world provided, of course, that your cardholder remembers his or her PIN. Issuing travelers EMV cards is not a massive task. You may be surprised at how small the number of travelers in your card portfolios is. Of the 311 million U.S. population, Mercator Advisory Group estimates there are just 70 million passport holders. By starting out with a limited portion of your card portfolio, you can gain the experience and supply chain familiarity you will need to complete a larger scale transition of your entire card portfolio after issuance and acceptance trends in the U.S. become clearer. There is no pressing need to consider a masss reissuance of your entire portfolio at this time. An EMV issuance plan that fits your normal card replacement schedule makes sense with travelers as an effective use case. To date, a number of U.S. issuers have issued EMV credit cards to their high-net-worthh traveling customers. For these card products, thesee issuers have chosen to support offline PIN. While this option requires a great deal of customer education on the use and importance of recalling a PIN for credit transactions, this option 14

15 was chosen because the chip and PIN format is accepted at the greatest number of ATM locations and POS terminals. Card issuance beyond the traveling cadre must wait on the pace of domestic EMV roll-out. reduces sales friction and risk, As merchants in locations that cater to international travelers find that EMV card acceptance they will deploy EMV terminals in their U.S. stores. We may then see domestic issuerss put EMV cards into the wallets of account holders living in popular U.S. tourist destination areas such as New York City, San Francisco, and Florida to take advantage of that merchant footprint. An EMV Road Map to Begin Planning. There are many moving parts to an EMV deployment. An EMV road map is a method to manage a process that includes a range of considerations: Card Verification Method. You have decisions to make regarding the capabilities of the card you issue. For credit cards, what cardholder verification methods do you wish to support: Signature only, or do you want a PIN? Do you want to make sure the card works absolutely everywhere? (Consider, for example, that in France, there are bicycle rental kiosks, ticket machines, and after-hours fuel pumps thatt accept only offline PIN capable cards.) Or are you OK with operation in online markets? Debit and Credit. Protecting both credit and debit card portfolios requires issuance of EMV cards for both types. While credit transactions will generally be run as signature transactions in the U.S..(that choice is, however, technically up to you as a card issuer), PIN debit as we know it adds security strength to a nearly counterfeit-proof smartcard. Given the PIN s strength in lowering lost, stolen, and friendly fraud losses and given today s cost-sensitive debit operations, an EMV debit card with online PIN authentication is the best and most secure option. Dual Interfaces. Almost 100 percent of MasterCard-branded contact chip interface and the upgraded, EMV-compatible contactless interface. Because both Visa and MasterCard are encouraging POS terminal upgrades to cards issued today in Canada are dual interface, containing both the standardd support both contactlesss card and NFC-based smartphone transactions, the number of merchant locations capable of taking a contactless transaction is, once again, expected to grow. The contactless feature is one to add to the planning exercise because contactless payments willl become more prevalent via the NFC-equipped smartphone. The use of a PIN adds security, of course, but may be unnecessary and unwelcome, from the merchants point of view, for transactions under $25, for which speed is paramount. ATM Update Process. ATMs will require new card readers to support EMV transactions. ATM software must also be upgraded and, for older ATM models, that may have an impact on your ATM replacement plans. Make sure ATMs planned for acquisition are EMV-ready. Ask your ATM supplier about transaction capabilities including mobile top-up, virtual card support, cash advance, and other features. 15

16 Processorr Readiness. Your card processor must be ready, of course, to handle EMV transactions. Many processorss in the U.S. have experiencee with EMV through their international operations but are not ready for domestic EMV operation. It is prudent to make sure your processor can handle the new format. Ask your processor what EMV services are available or in their plan. Prepare Staff and Customer Training. EMV will require training for both your staff and your cardholders. At the very least, cardholders will have to learn not to swipe the card but to insert it into the card reader. Your staff may need to answer questions regarding the liability shift for non-chip transactions (it affects the merchant, not the cardholder). And your staff will be able to point out the advantages during international travel (no acceptance concerns, higher security) ), whether to Canada, Mexico, or somewhere more distant. Not Your Plain Old Plastic Card. Production of EMV cards is very different from the process issuers are accustomed to with magstripe cards. The card itself, as a small computer, is far more complex. Every card product requires its own script a program thatt defines its capabilities and each script requires testing. Personalization of EMV cards requires a different process as well. Thesee services, as well as the cards themselves, will cost more than today s offerings. Obviously, instant issuance will be impacted, requiring new equipment capable of programming an EMV card. Interchange. At this time, the card brands have not announced any upcoming changes to interchange rates as a result of their EMV rollout plans. EMV is a security measure that replaces today s magstripe infrastructure, and its economics are tied to improved fraud and risk performance. For example, PIN debit EMV cards will offer improved performance over magstripe PIN debit cards. It would be unwise to factor higher interchange into your plans to fund the higher cost of EMV card issuance. The PIN debit industry working group sponsored by the Secure Remote Payments Council (SRPc) is an opportunity to bring focus to important issues. Participation here will help shape the way EMV is deployed in the United States. Another recommendation is to participate in the EMV Implementation Forum (EMF), a new organization formed under the auspices of the Smart Card Alliance. The EMF has been formed to give all stakeholders an opportunity to influence the direction of the U.S. transition to EMV. Again, the complexities of EMV deployment are of special importance to debit issuers, and thesee two groups can influence the outcome. 16

17 Recommendations for Merchants The pace of payments change is particularly acute for merchants. Not only do they need to consider the EMV initiative, but they also need to consider the growing number of mobile approaches to payments that may be important for sales. NFC s card emulation facility is just one. NFC s peer-to-peer mode is another technique that goes around card emulation mode. It allows a handset to communicate with a payment terminal (or another handset) provided both have software that understands the message. A wide range of other techniques also needs to be considered. Among these are two-dimensional (2D) or Quick Response barcodes, software-only approaches based on card on file, card-not-presenof phone numbers, card readers used with smartphones, and more. It is a lot to keep track of. payments augmented by geolocation, application-specific PIN codes, direct entry To prepare for EMV, merchants of almost any size should consider the following items: Make sure your acquiring processor is passing along the interchange savings mandated by Regulation II. If you are concerned with online PIN debit acceptance and cost and merchant choice in routing, look to participate in the Securee Remote Payments Council or to monitor the work of the Chip and PIN Working Group operating under that Council. Participation in the EMV Migration Forum, a newly formed organization under the auspices of the Smart Card Alliance, is another excellent way to influence the direction of the U.S. transition to EMV. Buy EMV-capable terminals when refreshing your point-of-sale terminals. Spend the extra $10 per device. Make sure you re ready to take chip and PIN payments. If mobile commerce and payments are a consideration, and they should be, evaluate the purchase of terminals that support both contact and contactless EMV so that NFC-based transactions are possible. Look for terminals that have the contactless capability built into the terminal directly, not via an add-on card or external device. That will keep the cost lower. If you haven t already, consider PIN debit acceptance. Because EMV does support PIN, nearly 100 percent of EMV terminals include PIN pads. So put those pads, and the lower cost of debit risk, to work. Keep track of payment and customer experience changes brought on by EMV in particular, those enabled by mobile devices. Drive a hard bargain. There is going to be heavy competition for POS upgrade business. Given all of the changes in mobile commercee and payments, flexibility is a key requirement. Make sure your payment acceptance infrastructure is not locked into single approaches. 17

18 Conclusionn EMV does a lot to improve the counterfeit card problem at the point of sale and the ATM. Skimming card data gets much harder. But it will take nearly a decade to achieve 100 percent EMV deployment in the U.S. Magstripe cards and magstripe risk will be with us for some time. In the meantime, security concerns and business issues remain. Address the Issues Significant business issues with EMV relativee to routing and merchant choice remain that need to be ironed out between the stakeholderss and perhaps regulators to ensure compliance with Durbin Amendment s Regulation II. The newly formed EMV Migration Forum, created under the auspices of the Smart Card Alliance, is chartered to address these issues throughh industry alignment, development of best practices for issuers and merchants, and account holder education. The EMV Migration Forum offers an opportunity for all stakeholders to help set the direction for U.S. EMV deployment. EMV has the potential to improve payment security as well as overall transaction security in the areas of commerce, healthcare, online access, and more. Participation in the EMV Migration Forum should be considered by any stakeholder looking to achieve a strong ROI from the EMV investmentt as well as build on the proven security improvements offered by PINs, smartcards, and other means of authentication. No Jump to NFC Speculation continues that the U.S. will skip over the EMV card form factor and move right to NFC-equipped smartphones for contactless transactions. That is not going to happen. Cards, in all their forms, are too important, too widespread and familiar to consumers. While a phone-based payment approach is foreseeable a decade or more from now, the card form factor will be with us for a very long time. With EMV, NFC, and a host of mobile-based authentication and payment technologies arriving at the same time, smart merchants and financial institutions will struggle to choose which approach to take. Flexibility from their technology providers should be a key characteristic when acquiring new technology. The goal is to take advantage of both the security features and the marketing advantages these new approaches may offer. Is There Really a Hurry Here? Given the complexities involved, never mind the massive investment of many stakeholders, it is not unreasonable to wish for an industry-wide assessment of EMV s benefits and timeline. While EMV standards are mature, other payment standards are in a high state of change, especially NFC. Since EMV is 1990s technology, perhaps there really is no hurry. 18

19 Mixed Signals Security concerns and PCI compliance are among the drivers put forward for EMV s rollout. That said, the card brands that are responsible for both EMV and PCI standards appear to be willing to take on new riskss to grow volume. Visa s investment in mobile payment facilitator Square and MasterCard s release of best practices for mobile POS acceptance indicate how very aware they are of the speedy emergence of new payment methods and the benefits of that increased volume. But this is a case of mixed signals, given that so much of the EMV proposition revolves around completing the global EMV perimeter to improve overall security while, at the same time, new and untested methods are being brought on board. Watch This Space The 2015 date for the merchant liability shift is the first major date for EMV in the U.S.. What happens between now and then, especially in the areas of EMV card issuance and PIN debit handling, will tell a lot about how important EMV support is to the payment ecosystem. Given their positive experience with PIN debit, merchants are skeptical of the benefits of a signature-only approach. Everyone is, or should be, concerned with consumer reaction to the new approach for both credit and debit transactions. Hopefully, the EMV Migration Forum will help produce the best outcome for all. Surrounding all of this is the swirl of mobile payment announcements regarding payment acceptance, mobile wallets, NFC, and other initiatives. If ever there was a time to be vigilant, to be on alert for major events, and to advocate for what you need, this is it. Copyright Notice External publication terms for Mercator Advisory Group information and data: Any Mercator Advisory Group information that is to be used in advertising, press releases, or promotional materials requires prior written approval from the appropriate Mercator Advisory Group research director. A draft of the proposed document should accompany any such request. Mercator Advisory Group reserves the right to deny approval of external usage for any reason. Copyright 2012, Mercator Advisory Reproduction without written permission is completely forbidden. 19