HEADLINE INSIGHTS ON HERE EMV TRANSACTION SPEED PERFORMANCE OPTIMIZATION

Transcription

1 HEADLINE INSIGHTS ON HERE EMV TRANSACTION SPEED Subhead & POS Here PERFORMANCE OPTIMIZATION

2

3 EXECUTIVE SUMMARY It has been more than a year since the EMV liability shift came into effect in the U.S. and the larger retailers in the U.S. have upgraded their Point of Sale (POS) systems to support EMV. However, a Wells Fargo survey 1 identified the existence of a lag among the smaller merchants for migrating to EMV. Given that these merchants represent 54 percent of the total sales in the U.S., it is significant to note that as of Q3 2016, approximately 49 percent of them are not yet migrated to EMV. Aside from this lag in EMV implementation, the transaction speed at retail merchant locations has been a noteworthy conversation, and a matter of concern across the payments industry. Cardholders at EMV-ready merchants are perceiving slower speed-ofservice during check-out. Complaints and reports of slow transaction speed have followed and remain consistently impactful if the merchant experiences high volumes of customer transactions. These transaction delays can result in potential loss of revenue. Other implications include customer frustration and thereby lower customer satisfaction, negative brand recognition, and increased investment costs for adopting an alternative solution. There is a clear need to determine how a merchant s POS solution performs versus comparable market verticals, and more importantly, understand what factors can affect the speed of EMV transactions, and find ways to optimize existing solutions without jeopardizing transaction security. In the interim, the payment brands have come up with the 'faster' EMV solutions to address the issue of transaction speed (e.g., Visa, American Express, Discover Quick Chip 2 and Mastercard M/Chip Fast 3 ). Given the challenging problem at hand, analyzing payment applications to pinpoint bottlenecks and recommending the best viable solution is what the payments industry needs at this time. UL performed a detailed analysis and field study with proprietary test tools to identify trends in EMV transaction time for several merchant implementations. This white paper elucidates on UL s research and analysis on a wide range of merchant terminal POS applications with a mix of lab and field studies. There is also focus around methodologies and tools that can be adopted to enhance transaction speeds at the merchant point of sale. The viewpoints and recommendations provided in this paper can guide retailers, point of sale solutions providers and terminal manufacturers, who are planning to optimize their payment system and assess the critical factors for implementing the solution. 1 Source: 2 Source: 3 Source: page 3

4 INSIGHTS ON EMV TRANSACTION SPEED AND POS PERFORMANCE OPTIMIZATION BACKGROUND The initial feedback from merchants, as payment terminals migrated to accept EMV payments, was an expression of concern about the impact of the security enhancements on the speed of EMV transactions. In a magnetic stripe transaction, the card holder swipes their payment card on the terminal and puts it right back into the wallet. In a chip card transaction however, the card holder has to leave the card inserted in the terminal and has to pay constant attention to the small font text on the terminal display and listen for an audible alert for when the card can be removed. Moreover, in the US, there are over 10 million payment terminals of which some 60 percent are currently connected over dialup 4 (about 28 billion transactions are made using dial-up terminals). The fact that the card has to be left inserted in the terminal during the entire transaction authorization process (including on those terminals that connect through dial-up), makes for some anxious customers at the checkout lane and a wide perception that EMV is slow. To be fair, it is not reasonable for merchants to expect their consumers (cardholders) to have an extended attention span and a protracted payment experience at the point-of-sale. While dial-up connectivity presents only the tip of the iceberg of this perception problem, merchants have an obligation to themselves and their consumers to improve the EMV-transaction experience. UL s experts have helped some merchants, terminal vendors and ISVs optimize their EMV transaction flow and overall checkout experience at the point of sale, and have compiled this white paper to benefit the industry. QUICK CHIP AND M/CHIP FAST Quick Chip (or M/Chip Fast, in the case of Mastercard) is an attempt by the payment brands in the US to reduce the perceived transaction time (card insertion to card removal) at the acceptance device. There are two areas where Quick Chip may be used to speed up the transaction time: Pre-Dip: Cardholders can initiate the EMV process by dipping their card in the terminal before the final transaction amount is known. To accommodate pre-dip before the final transaction amount is known, a placeholder amount is used to generate the application cryptogram (ARQC). page 4 4 Source:

5 Card removal before online authorization or Pre-mature removal: With Quick Chip, the POS can terminate the EMV transaction with the card before the online authorization request, thus allowing the Cardholder to remove the card right after the cryptogram (ARQC) is generated. In comparison to traditional EMV, in a Faster EMV (Quick Chip and M/Chip Fast, henceforth referred to as Faster EMV for the sake of simplicity and brand agnosticism) transaction, the Cardholder is prompted to remove the card after the online cryptogram (ARQC) is generated by the chip (1st Generate Application Cryptogram). Since, the Cardholder can remove the card right away, this reduces the perceived transaction processing time by the customer. The final online authorization response is received thereafter, and the transaction outcome 5 is displayed on the terminal. Traditional EMV: "Faster" EMV: Figure 1. Traditional vs 'faster' EMV Faster EMV improves the consumer perception that chip is slow by reducing in-reader time and emulating the flow of a magnetic stripe transaction. With a Faster EMV implementation, Issuer Scripting, Reversal Scenario handling, Offline processing with the card, etc. are removed from scope, and thus helps in shortening the development time compared to a Classic EMV implementation. The brand certification test cases are also reduced with Faster EMV (for the same type of terminal configuration Faster EMV has around 60 percent reduced number of test cases compared to classic EMV implementations). The brands have announced that the merchants receive the same liability protection as with traditional EMV. Despite the benefits, there are some limitations of the Faster EMV solution. Issuer scripts enable issuers the opportunity to send updates to the card; and these can be APPLICATION BLOCK, PIN CHANGE or UNBLOCK, PUT DATA or UPDATE RECORD. In Faster EMV the card is taken out just after 1st Generate Application Cryptogram so there is no way to update scripts even if the issuer sends them along with the response message. This limitation reduces the issuer s control over their own product. In addition, Faster EMV requires POS application and possible terminal software changes. In certain integrated POS solutions, the card is inserted only after the final transaction amount is known, so this does not help in reducing the perceived time before card removal. Given the type 5 t is highly recommended to display the transaction outcome on the terminal page 5

6 of POS implementation, it is fair to assume that Faster EMV may have limited benefits to merchants with highly optimized contact chip implementations. An important part of the traditional EMV transaction process is the second terminal and card action analysis (2nd GENERATE AC) that also includes the validation of the response cryptogram sent by the issuer. With the exclusion of 2nd Generate Application Cryptogram from Faster EMV solutions, the process opens up the possibility of man in the middle attack. This is a very rare scenario, but if a fraudster possesses the capability of intervening in the communication with the host and alters the responses, the chip will not be available to validate it. For the faster chip implementation at certain merchant locations in the U.S., there has been notable reduction in EMV transaction time. This still depends on the type of point of sale system, back office integration and type of network connection. Merchants can also program the point of sale system to switch between Faster EMV and Classic EMV functionalities (e.g., based on time of day) while maintaining both the functionalities. It should also be noted than the gain in terms of transaction time may differ based on the function each component performs in the POS environment, for example, Cash register, PIN pad, etc. Although the time taken for issuer authorization is almost similar to that of Classic EMV, some merchants have experienced overall transaction times comparable to those of magnetic stripe. UL BENCHMARKING STUDY AND COMPARISON WITH INTERNATIONAL IMPLEMENTATIONS BENCHMARKING PROJECT APPROACH AND ANALYSIS A top-tiered US payment processor enlisted UL s Transaction Security Division to benchmark the performance of their terminals against other widely used terminals in the North American, European and Asia Pacific markets. The goal was to deliver a comparative study of these terminals with the added caveat of providing the payment acquirer with actionable recommendations to improve the transaction speed. APPROACH UL s approach followed the Classic EMV processing steps as described below for contact and a lesser number of steps for contactless/mobile. A pre-determined number of tests were performed using UL proprietary tools in a test environment and using production cards in a production environment to interrogate and provide statistical comparisons across factors, including terminal make and model, region and connection protocol. Terminals were selected with a generic payment application and the tests were executed by running transactions against a host simulator. For mpos terminals, the same methodology was adopted as described above. Production testing was performed to calculate transaction times from card insertion to card removal and compared amongst terminals in North America, Netherlands and Singapore. 1. Select Application 2. Read Application Data 3. EMV Risk Management 4. Terminal Decision 5. ICC Decision 6. Online Authorization 7. Issuer Scripting 8. Completion Figure 2: EMV processing steps page 6

7 ANALYSIS Region: In comparing similar terminals across regions, UL found that while transaction speeds were at par in most stages of the EMV transaction, the two stages that showed the most variation are those that required Cardholder interaction including Application Selection and CVM entry. Figure 3. EMV Transaction Timing Trend in the U.S. - Production Distribution Time in Milliseconds Figure 4. EMV Transaction Timing Trend in Europe, Middle East and Africa - Production Distribution Time in Milliseconds In comparing results across the regions, the wider variation observed around the mean suggests that implementations in the U.S. vary greatly among merchants, and may be a contributing factor to the slower speed experienced across the region. Network Connection: The connection used for a transaction also has a significant impact on the overall performance of the terminal. As one would expect, IP-based protocols (Wi-Fi and LAN) exhibit much better performance on average than dial-up connections. Dial-up increases the total transaction time by up to 25 seconds, regardless of the terminal. Also, the study revealed that there were significant variations in the transaction times calculated from the time a card is inserted to the time the card is taken out from the device. page 7

8 Figure 5. Transaction Trend with Signature Credit Card over WiFi and LAN - Test Distribution Time in Milliseconds Figure 6. Transaction Trend with Signature Credit Card over Dial-up - Test Distribution Time in Milliseconds Cardholder Interaction: The amount of user interaction required by each terminal clearly has an impact on the average transaction time. When the Cardholder must interact with the terminal to select a payment application, choose between Credit and Debit, or enter a PIN or a signature, the transaction time is impacted by up to 50 percent to the total transaction time in some cases. Figure 7. Transaction Trend with PIN Debit Card over Wifi and LAN - Test Distribution Time in Milliseconds

9 Figure 8. Transaction Trend with PIN Debit Card over Dial-up - Test Distribution Time in Milliseconds Conclusions from the study: The statistical analysis of the EMV transaction time revealed there is a large variance in the performance of different terminals and implementations. The factors that have a direct impact on the transaction timing, though not completely in the control of the merchant or the point of sale solution, are the amount of user interaction and the terminal communications protocol (Wi-Fi, Dial-up, etc.). With respect to the transaction timing trends in a production environment, the performance of terminals and point of sale implementations has been at par in the US and EMEA, although less variance was observed in the EMEA region. The data collected in both test and production environments was found to be statistically significant. Delving deep into the timing trends of various commands exchanged in the EMV transaction process provides strong evidence on the lag or delays in the communication in certain portions of the EMV transaction. Cards with lesser number of AIDs take less time in the READ RECORD step which constitutes around 20 percent of the total transaction time. The majority of the card-terminal interaction time (excluding online authorization) is consumed in Application Selection, Read Record, EMV Risk Management operations, and Terminal Decision processes. These steps constitute around 40 percent of the total transaction time. The remaining time is taken in Cardholder interaction during the transaction including Application Selection, CVM entry, Amount confirmation, Cashback selection, etc. These interactions can be minimized by automatic Application Selection and optimizing CVM entry and other prompts when not required. It is evident from the data that the onus of transaction delays lies on the ECR (Electronic Cash Register) to PIN pad API interface and performance of the payment application. page 9

10 UL PERFORMANCE ANALYSIS AND OPTIMIZATION TOOL Considering the interaction of ECR and POS terminal in the case of a fully integrated POS system, an EMV transaction is completed in multiple API calls within the terminal and the data exchanged in the process. Typically, in the first API call the processing of EMV Application Selection is performed. The second API call may take up the majority of the processing time with read data, terminal risk management, and generate application cryptogram functions. The final API call processes the response from the issuer and the transaction concludes. API processing constitutes a major portion of an EMV transaction irrespective of the payment application used in the terminal. It is therefore worthwhile to perform a deeper analysis of the API calls processed within the terminal (or PIN pad). The analysis further involves taking a closer look at each step of the transaction from the time the ECR communicates with the PIN pad to start a transaction, until the final response is displayed on the PIN pad. The components to be looked into as part of the merchant POS system including the ECR, PIN pad and the interface between them, payment application, merchant and acquirer payment switch or gateway, and any other internal or external functions like P2PE, tokenization, etc. that may be part of the acquiring ecosystem. The interactions in the POS system take place at several layers. Depending on the complexity of the POS architecture, it may become difficult to locate discrepancies in these interactions. Let s take a look at each of these components. In a POS system, there are card to PIN pad interactions; the interactions with the acquirer host and in turn with the payment network and the Issuer. In a standard merchant implementation, the terminal or merchant site to host connections are very straight forward, which makes it easier to locate delays and bottlenecks in the network communication. The communication of the Acquirer host with the Issuer host via the payment network is also standardized with SLAs determined by the brands (e.g., 6 seconds router to router round-trip time for Mastercard). So, in case either the Issuer or Acquirer host takes more than the stipulated time to respond back in the respective hops, the payment brand stands-in (if that is the agreement with the brand). The piece that requires deeper analysis is when something causes time lag or delays between the PIN pad and the gateway/ switch (that connects to the Acquirer host). This can either be from the interactions between the card and the PIN pad or Figure 9. EMV Transaction Steps the interactions between the PIN pad and the ECR. A detailed analysis of these interactions can make it easier to isolate the exact origin of delays or bottlenecks occurring in this part of the transaction. For performance analysis, UL has a suite of tools to analyze the interactions between card, terminal and point of sale and provide the combined logging information with the respective timestamps. This proves to be of great benefit in analyzing the problems/delays and advising on optimizing the POS payments system though will require a technically skilled resource to be able to use the information the tool provides to optimize the transaction timing. RECOMMENDATIONS CARDHOLDER INTERACTIONS With respect to the Cardholder and the form factors used for making payments, there might be certain impacts on page 10

11 Figure 10. High Level POS Architecture transaction speed. The presence of multiple AIDs in the card and especially AIDs that are not or will not be used can add to transaction processing delays. For example, when PSE (Payment System Environment) is not used in the card or the terminal for application selection, the terminal selects all the AIDs one by one (a.k.a. Explicit Selection), builds the candidate list, and then selects the most suitable application. Either the terminal should have intelligence built in for auto-selecting the AID (e.g., for US Common Debit) based on those present in the card and the terminal, or should present the minimum viable options to the customer in order to prevent any confusion. For AIDs pointing to different funding accounts the options still need to be displayed to the customer to select. PSE support on the terminal is highly recommended to speed up Application Selection process of an EMV transaction. The terminal prompts and messages displayed to the customer should be easy enough for the customer to take appropriate action. For example, if the merchant has visuals for the customer when to use a PIN or bypass a PIN, it would help in a seamless customer experience. Additional methods like combining the PIN entry prompt with amount confirmation reduces the number of interactions and hence the processing time. Other prompts like prompting for signature, card insertion and removal, re-insertion of card, magnetic swipe in case of fallback, etc. can be optimized as well. PIN PAD TO POS INTERACTIONS Performance tuning and optimization of the communication between the PIN pad and Cash register (ECR) and also between the point of sale systems (including PIN Pad, ECR, etc.) and the host can be helpful. As previously stated, the EMV transaction steps before 2nd Generate Application Cryptogram consume a majority of processing time. Through UL s study and research of the transaction timing trends, it has been determined that an average of 20 to 30 percent and as much as 50 percent of total transaction time is taken by the API processing for the EMV transaction. It is important to note that the NFC transmission time is percent of the overall transaction page 11

12 It is therefore worth analyzing the performance of terminal APIs and the payment application(s). This can be done by working closely with the terminal vendors, VARs and ISVs. There are additional security and encryption functionalities like P2PE, tokenization, loyalty, etc. that may consume time during the transaction. The merchants must be mindful that employing P2PE and tokenization solutions on the terminals may add to the transaction processing time since additional crypto functions are involved. Additionally, certain non-payment functions and background processes that may contribute to increased total transaction time can also be optimized or removed/replaced. Unnecessary prompts on the terminal and debug messages displayed for the cashier can be removed for faster throughput. Supporting Dynamic Currency Conversion (DCC) at the terminal may add another processing step in the transaction. This function should only be used where significant transaction volume of non-us cards (like lodging, car rentals, etc.) is expected. Additional viable options for speeding up the transaction are using NFC/contactless form factors. With communication speed of 106kbps 6 and transaction time as fast as 400ms, substantial operational advantage can be achieved for businesses expecting high throughputs. TERMINAL/POS TO GATEWAY/ACQUIRER Considering the network connectivity to gateways or acquirer processors, pre-dial is an efficient option since the system would be ready to exchange transaction messages before the start of an actual transaction. This would be beneficial to counter the slow dial-up networking speeds. Merchants can also look for alternatives to dial-up communication by installing TCP IP, wireless, or Wi-Fi connections with greater speeds and bandwidth. The type of network communication plays a crucial role in determining transaction speed. This also includes the number of network hops and handoffs during the course of a transaction. Furthermore, streamlining the number of hops in the network communication can facilitate greater speeds. With regards to the solutions offered by the brands besides Faster EMV solutions, VEPS and QPS benefit merchants and Cardholders by allowing for faster, more convenient low-value purchases. With about 98 percent 7 of the merchants eligible to implement these solutions, greater efficiency, customer satisfaction, and throughput can be achieved. ISSUER CONSIDERATIONS From an Issuer perspective, efficient card or payment product configuration is the key. The Application selection via PSE in the card can quicken the overall transaction processing. For this, PSE must also be supported by the terminal. With the presence of a PSE based application selection in both card and terminal, the terminal AID list is not used to create the read record commands, which saves time. The issuer also has the responsibility of educating the Cardholder on the usage and security features of chip cards by communicating via , website, videos, etc. Issuing Dual interface cards and enabling mobile payments can have additional manufacturing costs initially, but can be beneficial in the long run for faster checkout speeds and by providing an alternative payment option to the Cardholder (via the contactless interface). page 12 6 Reference: EMVCo requirement Bit Rate; Book D EMV contactless communication protocol 7

13 SUMMARY + CONCLUSION Merchants are trying to conduct business in an efficient manner, reducing operational and liability costs. This involves adopting innovative methods and 'out of the box' thinking. Though it may be perceived as bold, these approaches can distinguish an organization from others and provide substantial financial edge. The new methods introduced by the brands provide opportunities for the industry to look at transaction speed from a different perspective, and ways for improving the operational efficiencies. There are several complexities and underlying technicalities for implementing these solutions that a merchant or retailer should examine in detail. Moreover, thorough evaluation and testing of these solutions is crucial for successful and flawless deployments. UL s performance analysis and optimization solution can bring considerable benefits to new and existing POS systems. Combining the hardware and web-based performance analysis and optimization capabilities, the root cause can be isolated and fixed. The solution can also be a great asset for organizations that envision automating and advancing their existing operational efficiencies to higher levels with an intent of gaining greater business benefits. With merchants adopting innovative mechanisms for implementing EMV, including processes like Application Selection, CVM, etc. there exist greater opportunities and incentives to streamline and optimize POS systems. These, together with other optimization options, are specifically beneficial for POS systems communicating via dial-up and similar slower methods of communication. There also exists numerous opportunities for optimizing inefficient functions. Examples include inserting card for refund and cashback support on contactless. The need of the hour is to stay ahead of the competition. Either to fix or improve existing systems, adoption of relevant solutions can help achieving the desired Cardholder experience and better throughput. Employing performance benchmarking and optimization methodologies and tools can foster significant results in improving operational efficiencies at the point of sale. For further information on NFC applications and mobile payments, please contact: TRANSACTIONSECURITY@UL.COM or visit UL-TS.COM page 13

14 ABOUT US UL fosters safe living and working conditions for people everywhere through the application of science to solve safety, security and sustainability challenges. The UL Mark engenders trust enabling the safe adoption of innovative new products and technologies. Everyone at UL shares a passion to make the world a safer place. We test, inspect, audit, certify, validate, verify, advise and train and we support these efforts with software solutions for safety and sustainability. UL's Transaction Security division guides companies within the mobile, payments, and transit domains through the complex world of electronic transactions. UL is the global leader in safeguarding security, compliance, and global interoperability. Offering advice, training, compliance and interoperability services, security services, and test tools, during the full life cycle of your product development process or the implementation of new technologies. UL s people proactively collaborate with industry players to define robust standards and policies. Bringing global expertise to your local needs. UL has accreditations from industry bodies including Visa, Mastercard, Discover, JCB, American Express, EMVCo, UnionPay International, PCI, GCF, GlobalPlatform, NFC Forum, and many others. To learn more about us, visit UL-TS.com. UL HAS WRITTEN MORE THAN 1,600 STANDARDS DEFINING SAFETY, SECURITY, QUALITY AND SUSTAINABILITY UL REACHES MORE THAN 1 BILLION GLOBAL CONSUMERS ANNUALLY WITH SAFETY MESSAGES UL HAS ENHANCED TRANSACTION SECURITY FOR: 500+ BANKS 20+ PAYMENT SCHEMES 50+ GOVERNMENTS AND PUBLIC TRANSPORT OPERATORS 60+ MOBILE NETWORK OPERATORS UL MARKS APPEAR ON MORE THAN 22 BILLION PRODUCTS GLOBALLY UL SOFTWARE IS USED BY MORE THAN 10,000 ORGANIZATIONS IN OVER 20 INDUSTRIES UL WORKS TO PROTECT THE MARKET FROM COUNTERFEIT GOODS IN 2015 ALONE UL PARTICIPATED IN 508 SEIZURES, ELIMINATING MILLIONS OF DOLLARS OF COUNTERFEIT PRODUCTS FROM THE MARKET 3 OUT OF 4 U.S. CONSUMERS ARE FAMILIAR WITH THE UL MARK UL OPERATES IN MORE THAN 143 COUNTRIES UL SERVES 1 OUT OF 3 FORTUNE 500 COMPANIES AND ACROSS MORE THAN 20 INDUSTRIES UL S PRODUCT SUSTAINABILITY CERTIFICATION MARKS ARE REFERENCED OR PREFERRED IN 900+ SUSTAINABLE PRODUCT SPECIFICATIONS AND PURCHASING GUIDELINES AROUND THE GLOBE page 14

15

16 UL-TS.COM 2017 UL LLC. All rights reserved. This white paper may not be copied or distributed without permission. It is provided for general information purposes only and is not intended to convey legal or other professional advice.