Frequently Asked Questions. Regarding EMV Update Webinar for Epicor Eagle Customers

Transcription

1 Frequently Asked Questions Regarding EMV Update Webinar for Epicor Eagle Customers

2 In this document, we provide our view about the upcoming EMV standards. The contents of this document are for informational purposes only and are subject to change without notice. Epicor Software Corporation makes no guarantee, representations or warranties with regard to the enclosed information and specifically disclaims, to the full extent of the law, any applicable implied warranties, such as fitness for a particular purpose, merchantability, satisfactory quality or reasonable skill and care. This document and its contents, including the viewpoints, dates and functional content expressed herein are believed to be accurate as of its date of publication, September, However, we do not accept and specifically disclaim any liability for any statements that may be inaccurate. You should independently verify any statement you intend to rely upon. The usage of any Epicor software shall be pursuant to the applicable end user license agreement and the performance of any consulting services by Epicor personnel shall be pursuant to applicable standard services terms and conditions. Usage of the solution(s) described in this document with other Epicor software or third party products may require the purchase of licenses for such other products. Epicor, the Epicor logo, and Eagle are registered trademarks of Epicor Software Corporation, registered in the United States and other countries. All other marks are owned by their respective owners. Copyright 2015 Epicor Software Corporation. All rights reserved.

3 Table of Contents What happens if the merchant receives a chargeback/contested charge on an EMV capable card between Oct. 1 and implementation?...1 Any thoughts on what we might say to customers who are concerned that we don t have EMV?...2 Can we start to upgrade pin pads before Oct. 1st?...3 Can you update your pads over the course of several days or do they all have to be done at once?...4 What estimated percentage of retailers will be ready for Oct. 1 for the EMV deadline?...5 Since so few cards have been issued, so few merchants ready, why hasn't the EMV deadline been pushed back?...6 Can you update to RBA 12.0 before you have transactional security turned on? Will it affect anything?...7 Can we update the pin pads once we are close to the EMV implementation or do we need to update more than once?...8 We do not accept debit cards, but do we have to setup debit security still?...9 The presenter said that one of the things that we can do to prepare is to "order debit encryption." What is that? I've attended all of the EMV preparation webinars and this is the first I've heard of it EMV Update FAQs Copyright Epicor Software Corporation2015

4 What happens if the merchant receives a chargeback/contested charge on an EMV capable card between Oct. 1 and implementation? The chart below is one we believe well captures the various scenarios. The It s our view that the chances are not high that a retailer will see a fraudulent EMV card in the next 3 months, especially in our markets (i.e., someone created a fraudulent EMV card with the coding that indicated it is an EMV card and the pin pad sees it as an EMV card). What is the website url where you found that EMV chart? Do I have to pay the customer or does the bank/issuer handle and I lose the funds? If there is a chargeback, the bank will not pay the retailer for the transaction. Is LPS a field tech? Yes, the LPS (Local Platform Specialist) is the field engineer/technician 1

5 Any thoughts on what we might say to customers who are concerned that we don t have EMV? Here is one suggestion: We are working with our POS provider to be EMV enabled but it is a complex chain of integrations, which are out of our control. (Assuming the following is true, you could add: We have adopted practices and deployed technology that are designed to protect your credit card data. Do I hold off on installing Level 25.1 if I am on level 22 now? Each upgrade is very time consuming for us. This is a business choice. If there are no issues that are fixed in R24.1 or R25 and you do not need any of the new features, then you may want to wait till R25.1 which will have both EMV credit and EMV debit. Why is Epicor not covering EMV fraud? We do not believe we are responsible for the delay. Rather, Because of the delays of other parties in the payment card chain, we were not provided the time to complete our work. What are the system capabilities after installing level 25 and RBA12.0? The pin pads functionality remains, but you would be able to turn on Apple Pay/NFC and purchase and use Transactional Security. What is econnect, how do you sign up, and is it necessary? econnect is a free feature that allows the collection of information from the pin pad for EMV upgrading. It also allows remote upgrading of your Eagle clients from the Eagle server or an econnect master PC. You can contact you LPS for more information on setup. For EMV implementation, it will be necessary. Will there be any additional firmware updates needed beyond the RBA 12.0 needed for transactional security? Yes, the final RBA firmware has not been confirmed yet due to current testing and issues we found during testing. What s the timeframe for updating 3rd party purchased isc250s? For 3 rd party pin pads, when we know the final RBA firmware needed and the KP4 key required, we can provide that information to you so you can have the 3 rd party inject this KP4 key and firmware onto your 3 rd party pin pads. We will also let you know when you processor is certified. 2

6 Can we start to upgrade pin pads before Oct. 1st? In the presentation, it lists what you can do NOW to prepare for EMV. Will I need to have at least 24.1 or level 25 (original release) installed before January to start getting ready? Or can I just wait until March? This is a business decision. If you want to wait until March, then you will get both EMV credit and EMV debit and we can perform the implementation at one time. Is the latest econnect available now or should we wait until closer to the installation date? The latest econnect is not available until October. Why isn't transactional security the norm? Why is there a fee? There are costs we incurred internally and security and hardware purchased from a partner to implement Transactional Security in our Gateway. Shouldn't you or the processers accept the liability? I pay a lot of money for support each year, and have spent significantly getting ready for this. Why is it on us? Why isn't Epicor stepping Subtitle up and doing Placeholder the right thing here? Again, we do not believe the delay is our responsibility. Please see our answer above. If only a $600 exposure (which is an average not an Maximum) why doesn't Epicor just cover the dealer cost if it happens to a dealer First, the $600 exposure is a derived from a number of assumptions. Some may experience more and some less. Second, Epicor is not responsible for the delay and not responsible for any actual loss. Is it known yet when RBS WorldPay for DIB Members will be certified for EMV or Transactional Security? As of today, we are still awaiting for RBS WorldPay to provide us a date when we can be certified and when they can move over to the Gateway. We continue to push on RBS WorldPay to get this completed. For multiple store companies, can we turn on EMV store by store or do all stores have to turn on at the same time? When EMV is ready, you can turn on EMV pin pad by pin pad. Our recommendation is that you start with one pin pad for EMV then after 1-2 weeks, then turn on others. 3

7 Can you update your pads over the course of several days or do they all have to be done at once? You can update the pin pads over as many days as you like. Eagle will work with different firmware in the pin pad and different pin pads (old and new). Will all chip cards have to be used with the magstripe until next year or will they now work to a certain extent? For Eagle, all chip cards will need to be used with the magnetic stripe swipe until EMV is enabled. Where can we get econnect? Contact your LPS for instructions on econnect. Can you show screen shot for the isc250 update again? The presentation is available at epicor.com/emv How do we have Transactional Security activated? Please contact your account manager to order Transactional Security and then follow the step by step guide in Training on Demand or in cloud help. We always thought if we processed a transaction on a fraudulent card, we were always liable. So, that is not correct? According to the information from the card brands, not always. It may depend on the situation. I was going to upgrade to Level 25 next week. What are we missing if we wait as it sounds like we should? This is a business choice. If there are no issues that are fixed in R25 and you do not need any of the new features, then you may want to wait until R25 EMV version (January 2016) or R25.1 (March 2016) which will have both EMV credit and EMV debit. For EBT transactions, will we be able to take them and are they getting chips installed? EBT cards will probably also be EMV chip enabled. Yes, you will be able to take these cards but they will also have a mag stripe. 4

8 What estimated percentage of retailers will be ready for Oct. 1 for the EMV deadline? The estimate we have is from July, which is 5% of retailers are ready. By October, I don t believe you will see more than 10% that are ready. Why weren t we told in the spring about the issues with EMV? Your Account Reps were pushing us to buy the software and Signature capture pads. In spring 2015, we were still pushing hard to get EMV ready and did not believe that we would face delays that were outside our control, including processor issues, pin pad coding, and delays in certifications. Is the $52.25 / month- $600/year possible liability number based on the July numbers of EMV cards distributed (28.8%)? The numbers are based on average overall bankcard transactions and counterfeit fraud for the industry as a whole. And, as we have explained, we believe our merchants should experience an even lower rate. With Epicor Transactional Security is there a per transaction flat fee? If so, does it apply to Apple Pay and Android customers? When might we be able to start accepting Apple Pay? Transactional Security has a per pin pad promo of $10/pin pad per month or a per transaction fee of $0.02 per transaction ($0.01 per transaction for Epicor Payment Exchange customers). Apple Pay/Android Pay does not require Transactional Security and the data is already tokenized by Apple and Google. What happens with Debit after the initial EMV rollout in Jan., before the Debit release in March? Debit functionality remains consistent as it does now with swipe. If the card is an EMV Debit card, you can run the transaction as a credit transaction by inserting it or run it as a Debit with a swipe. Is Epicor going to check our pin pads to make sure they're EMV ready or is it our responsibility to contact Epicor? We will be checking every pin pad and pulling information to determine if it is EMV ready. Then we ll work with you on the implementation. We want to make it as easy as possible for our retailers. 5

9 Since so few cards have been issued, so few merchants ready, why hasn't the EMV deadline been pushed back? This is the same question everyone is asking but we don t have a good answer except they want everyone to keep pushing toward EMV. EMV credit is ready in the broad release. Would Chip and Debit be allowed at this point or would it be in the March 2016 release for debit ready? EMV credit will be ready in January 2016 (pending all processor certifications). EMV debit will not be ready until R25.1 in March If we are getting the isc250 from ACE, will these be ready to go or do we still have to do something to them? And which computer do you put the econnect on? We are working with ACE on the ACE pin pad upgrade program and hope to be able to provide all the firmware and KP4 debit key information for them to load on the new pin pads to be ready for EMV. However, for these pin pads to work, you would need to upgrade to the R25 EMV version. econnect can Title be placed on Placeholder the Eagle server or a PC. Contact your LPS for more information. Does this mean level 25 is delayed or is it shipping now? Release/Level 25 is released now with new features and enhancements. The Release 25 EMV version is delayed until January Can this information be printed off? The slides will be available on the epicor.com/emv website From what part of the country did you pull those numbers to come up with the possible fraud number? We are in South Florida so our fraud exposure is much higher than other parts of the country. How do we address our exposure? The aggregate information is for the US as a whole. One way to enhance your security profile is to adopt transactional security (tokenization and point to point encryption). Please explain what is difference between an EMV card vs. swipe card? The epicor.com/emv website has a good flipbook that explains the differences. Do you anticipate that another firmware update for the isc250s (Beyond RBA12) will be required for EMV? Yes, we have not finalized the RBA version for EMV yet. 6

10 Can you update to RBA 12.0 before you have transactional security turned on? Will it affect anything? You can update to RBA before turning on Transactional Security with no real effect to Eagle. We purchased new PIN Pads from Epicor in July, we assume they are ready to go with all necessary software and modifications. Is that correct? Unfortunately, we will still need to do updates to the firmware and debit keys, which we are working to be able to update in the field for Epicor purchased pin pads. I am already on RBA Do I still need to update the pin pad? You are all set on updates for the pin pad until the EMV RBA version is ready. If we upgrade the software on the pin pad to the RBA now, can we go ahead and accept Apple Pay? Yes, RBA is required for Apple Pay. Instructions on how to turn on Apple Pay is in Training on Demand and in cloud help. Are the targets Jan.2016 credit and March 2016 debit EMV rollout dates dependent on the processors communicating in a timely fashion with you? If so, are they getting caught up with you? Yes, this very much depends on if the processors can get us into the qualification testing, provide feedback and then do any retesting for certification. The good news is that we have finished EMV credit certification with one processor already. If we just purchased (within the last 60 days) the new isc250 pin pads, did they come loaded with RBA 3.0 Unfortunately, these will have RBA 2.3 and will need to be upgraded. We have three isc250 s purchased from a source other than Epicor. Can these be updated by Epicor The process for 3 rd party pin pads are not set yet. You will probably need to go back to the 3 rd party source to update these debit keys or work with Ingenico to do that work. 7

11 Can we update the pin pads once we are close to the EMV implementation or do we need to update more than once? You can wait until you are ready for EMV implementation to update the pin pads. If the pin pads are not updated to RBA 3.0 or higher and you are not on econnect and bedcheck, we would not be able to read your pin pads to get the data we need. What software release is required to do the prep steps before Jan. and is there a separate cd software required? Eagle Release 24.1 or 25 Is econnect the same as bedcheck? econnect is the features to update your Eagle clients. Bedcheck is the features for Epicor to upload data from your servers to Epicor and download patches to your Eagle server. Will the ecommerce update be billable if you already have ecommerce? No, updating econnect is not billable if you can do that yourself. What is the liability for a manually keyed over-the-phone delivery-order on a chipand-pin terminal? The liability for these transactions stays the same as they are now. Please see the chart above. How do we see what level software we are on? Contact the Advice Line or review online help to find the About Eagle Browser pop up or type in PCO in network access to see what level you are on. If it is better, why isn't Transactional Security the norm? In the industry, Transactional Security/Point to Point encryption/tokenization are not the norm because each bankcard processor, pin pad manufacturer and POS provider may have different manufacturers of this type of service so there is no consistency right now. We believe it should be the norm. Are there any special considerations with Offline Point-of-Sale and EMV? Offline POS will function the same as before, except EMV cards can authenticate with the pin pad and confirm it is a valid EMV card even in offline. 8

12 We do not accept debit cards, but do we have to setup debit security still? This is the change with EMV. Because EMV credit has options for the card to ask for a pin number, you will need to have a debit encryption on the pin pad, even though you are not accepting pin based debit transactions. Is Apple Pay automatically installed on the isc250 pads? If so, how does it work? Apple Pay is a free feature available on Release 24.1 and higher. Instructions for setup and use are in Training on Demand or cloud help. I was going to upgrade to Level 25 next week. What are we missing if we wait as it sounds like we should? This is a business choice. If there are no issues that are fixed in R25 and you do not need any of the new features, then you may want to wait till R25 EMV version (January 2016) R25.1 (March 2016) which will have both EMV credit and EMV debit. Epicor keeps framing our liability as only "fraudulent EMV bankcard... counterfeit fraud chargeback," but what we've been taught from day one (by Epicor) is that the merchant becomes liable Subtitle for any EMV-capable Placeholder transaction where the merchant did not support the EMV standard and the transaction is challenged. There is nothing in that statement suggesting a "fraudulent" card or a "counterfeit fraud chargeback". What's to prevent any and every EMV cardholder from going into a non-emv supporting store and then challenging the resulting charge simply as a means to game the system? Please see the chart above. In our view, the fraudulent aspect of EMV cards is what would trigger a chargeback on an EMV card, so a valid EMV cards used in a non-emv terminal would not trigger a chargeback and hence there is no liability. For your example, an EMV cardholder can try to game the system but the bankcard companies will flag these rejections and turn off the card and then investigate if the cardholder actually made these transactions and were in the vicinity of his home. The Discover chart above is the best depiction we have seen showing liability exposure. 9

13 The presenter said that one of the things that we can do to prepare is to "order debit encryption." What is that? I've attended all of the EMV preparation webinars and this is the first I've heard of it. The debit encryption requirement we were informed of in the summer as we were working on coding to the pin pads. Debit encryption is the security key that is injected into each pin pad for pin based debit processing. Because EMV credit will have pin based credit processing, you will be required to have a debit encryption key in the pin pad. We've been encouraged to apply the available firmware update (either RBA 3.0 or 12.0) now, knowing that it will take a full hour per card reader. Will time spent applying the currently available firmware updates reduce the amount of time that will need to be spent when applying the EMV-capable firmware update? Yes, updating to RBA 3.0 or RBA will reduce the time to update to the EMV firmware in the future. If the pin pads are not updated to RBA 3.0 or higher and you are not on econnect and bedcheck, we would not be able to read your pin pads to get the data we need. This is the first time I've heard Epicor actually discourage their customers from applying an update that is Subtitle in general release Placeholder (25). What's going on? Epicor is not discouraging customer from upgrading to R25 but trying to reduce unnecessary upgrades of software if they don t need the R25 enhancements or features. R25 is fully tested and released. They mentioned a special rate for Transactional Security per card reader through the end of this month. What's the special rate? And if we commit before the end of the month how long will that rate be good for? The promotional rate for Transactional Security is $10/pin pad per month, vs our standard rate of $0.02 per transaction ($0.01 per transaction for Epicor Payment Exchange customers). If you sign up before September 30, 2015, this rate will be your rate for at least 3 years. Transactional Security seems like it will be obviated once everyone (card issuers, card processors, and software providers) is fully EMV-compliant, since under EMV no useful credit card information whatsoever is stored client side. Given that, is Transactional Security something that we can drop once Epicor has finally released both the credit and debit portions of their software and card issuers have finished distributing EMV-compliant cards? There is a lot of confusion on EMV and Transactional Security. EMV does not encrypt or tokenize bankcards in your Eagle system. From the point of insertion on the pin pad to the 10

14 Eagle client, the bankcard number is in clear-text; i.e. the whole bankcard number can be read easily. In the Target and Home Depot breaches, the malware read all the bankcards coming into the POS client before it was eventually encrypted by the POS client. If customers were using EMV cards during the Target and Home Depot hacks, the hackers would still be able to pull actual card numbers. Transactional Security encrypts the EMV or mag stripe card at point of swipe or insertion, so the actual bankcard is encrypted immediately and travels to our Payment Gateway fully encrypted. Eagle will never see the actual bankcard number. Both EMV and Transactional Security features are complementary and one does not replace the other. EMV protects your liability if a fraudulent EMV card is used at your business while Transactional Security protects your business from storing, processing or transmitting any actual bankcard numbers that can be hacked and resold in the black market. 11

15 Corporate Office 804 Las Cimas Parkway Austin, TX USA Toll Free: Direct: Fax: Latin America and Caribbean Blvd. Antonio L. Rodriguez #1882 Int. 10 Plaza Central, Col. Santa María Monterrey, Nuevo Leon, CP Mexico Phone: Fax: Europe, Middle East and Africa No. 1 The Arena Downshire Way Bracknell, Berkshire RG12 1PU United Kingdom Phone: Fax: Asia 238A Thomson Road #23-06 Novena Square Tower A Singapore Singapore Phone: Fax: Australia and New Zealand Suite 2 Level 8, 100 Pacific Highway North Sydney, NSW 2060 Australia Phone: Fax: EMV Update FAQs Copyright Epicor Software Corporation 2015