EMV Migration for the US Parking Industry EMV and the Parking Industry

Transcription

1 EMV and the Parking Industry May 2013

2 Contents Introduction 03 What is EMV 04 Why EMV Matters 06 to Parking Overcoming the 08 Challenges Case Study 10 Best Practice Tips for 11 EMV Migration About Creditcall creditcall.com

3 Introduction Contents EMV has revolutionized payments and is already in place in many regions across the globe. So far, the US has delayed its adoption of the new standards, which replace magnetic stripe payments with Chip-based transactions. However, this is all about to change. The US payments sector has a migration plan in place and some imminent deadlines. Despite this, many organizations are unaware of the full extent of EMV, or even what it entails. The fact is - EMV is the present and future of payments and affects every card payment system, device and application. The International Parking Institute estimates that the US parking sector generates more than $25-30 billion in gross parking revenues annually. Payment systems are the lifeblood of that sector and are directly affected by this technology shift. Whether it is payand-display, single-space meters, pay-on-foot, mobile phone payment, unattended or online, manufacturers and parking operators must tackle the technology shift and deploy EMV-ready solutions across their infrastructures. While there are penalties for those that do not comply, EMV also offers major commercial benefits and the opportunity to put in place a foundation for future innovation. This guide addresses each of the challenges that parking operators and parking system manufacturers will face. It provides advice along with best practice tips on how they can utilize industry expertise around EMV and overcome the technology hurdles. The fact is, EMV is the present and future of payments and affects every card payment system, device and application. creditcall.com 03

4 What is EMV? EMV is a global standard for credit and debit payment cards based on Chip card technology. It covers the processing of credit and debit card payments using a card that contains a microprocessor chip at a payment terminal. For over 40 years, payment cards have used magnetic stripes or mag-stripes - to store data1. Terminals at the point-ofsale then read this data to process transactions. However, mag-stripe cards are easy to clone, so this system is particularly vulnerable to security breaches and payment fraud. EMV replaces this approach. Instead of a mag-stripe, it uses a Chip to store data, which all terminals must be able to read to then authenticate the transaction, often in combination with a PIN. The data on the card is validated using cryptography via public keys provided by the card issuers such as Visa and MasterCard. There are two main types of transactions possible with EMV-ready cards and terminals. The first is contact payments. When a cardholder inserts the card, with its embedded microprocessor chip, into a terminal, this contact allows the card and terminal to connect and exchange data. The second is contactless payments. Crucially, the move to EMV is a major step in making this a reality. Here, the cardholder holds the Chip near a contactless-enabled reader and then data transmits using radio waves all 04 creditcall.com...mag-stripe cards are easy to clone, so this system is particularly vulnerable to security breaches and payment fraud. without the card leaving the cardholders possession. This is often referred to as near-field communication (NFC) which is a set of standards that allows devices such as mobile phones to communicate with each other via radio waves when they are in close proximity. The term EMV itself stands for Europay, MasterCard and Visa, the organizations that first began developing the EMV specifications in The EMV standards and associated compliance processes are now managed by EMVCo, an organization owned by American Express, JCB, MasterCard and Visa. Specifically, it manages, maintains and enhances the EMV Integrated Circuit Card Specifications for Chip-based payment cards and acceptance devices, including point of sale (POS) terminals and ATMs. EMVCo also establishes and administers testing and approval processes to evaluate compliance with the EMV Specifications.

5 The EMV timetable The move to EMV is well-advanced in several regions, with 1.62 billion EMVcompliant payment cards in use worldwide as of Q4 2012, according to EMVCo. While the US might be late to the table, some merchants with large numbers of visiting overseas customers have already started to plan for the transition. Europe (zone 1) has led the way, with 81 percent of its cards and 95 percent of its terminals Chip-enabled as at Q Canada, Latin America and the Caribbean have also made good progress, with 49 percent of cards and 79 percent of terminals meeting the standard. Other regions, such as Africa and the Middle East, and APAC, have begun the transition, though are still in the early stages, with 29 percent of cards and 77 percent of terminals and 27 percent of cards and 51 percent of terminals respectively. Region EMV Cards Adoption Rate EMV Terminals Adoption Rate Canada, Latin America and the Carribbean 401M 49.2% 5.6M 78.5% Asia Pacific 372M 26.7% 5M 50.5% Africa & the Middle East 50M 28.6% 0.6M 76.7% Europe Zone 1 755M 80.7% 11.7M 94.5% Europe Zone 2 46M 15.5% 0.9M 73.2% United States** TOTALS 1.62B 44.9% 23.8M 75.7% Source: EMVCo, Q *Figures reported in Q and represent the latest statistics from American Express, JCB, MasterCard and Visa, as reported by their member financial institutions globally. **Figures do not include data from the United States. The US is one of the last major economies to adopt EMV and now has a timetable in place. There are a variety of important dates and deadlines that the parking sector needs to be aware of: August 2011 Visa announced its path toward EMV contact and contactless Chip technology in the US. October 1, 2011 Visa expands its Technology Innovation Program (TIP) to US merchants. April 1, 2013 The deadline for developing the processing infrastructure for acceptance of Chip. This requires merchants, integrators and processors to ensure their systems can pass contact Chip data or dynamic data from the acquirer system. October 1, 2015 The deadline to establish a fraud liability shift. This will see merchants take on responsibility for fraud from non-emv compliant cards. creditcall.com 05

6 Why EMV Matters to Parking Any organization in the parking payments ecosystem will need to ensure their systems meet the new EMV standards. For parking operators, as the owners of the terminals, the stakes are high because those that fail to migrate successfully risk penalties from the liability shift. Parking operators will be relying on their system manufacturers, as the suppliers of the technology, to help solve the issue. The liability shift is an important factor in the transition to EMV. This will see parties that are not EMV compliant bear the cost from fraud. As an example, a fraudster may carry out a fraudulent transaction using a mag-stripe card on a non-emv compliant terminal. In this case, the parking operator, as the owner of the terminal, will be liable for the cost if everyone else in the chain is already compliant. A further incentive is the transaction costs themselves. In other EMV regions, EMV transactions were charged at the old mag-stripe rate while new mag-stripe transactions were charged at a higher rate. It is possible we will see a similar approach applied in the US. Interoperability is another key factor in EMV. This is where cards from one region can be used in other territories because there is a universal payment standard. EMV promises that level of interoperability but until all nations have adopted it, true global interoperability cannot be achieved. The fight against fraud The most important driver for EMV is the need to reduce payment fraud. Regions already utilizing EMV Chipenabled cards have dramatically reduced fraud, simply because it is much more difficult to copy the cards. As a result, the US parking sector stands to benefit considerably from these antifraud measures. According to The Nilson Report in 2011, US payment card fraud losses reached an estimated $3.56 billion that accounts for 47 percent of all reported worldwide fraud losses. By contrast, fraud figures have dropped dramatically in the UK, where EMV Chip-enabled payments are now the standard. Counterfeit fraud from cloned or skimmed cards decreased from $3.56bn card fraud losses in % of all global fraud losses 06 creditcall.com

7 Fraud on UK-issued cards or card details used fraudulently outside the UK USA CANADA 11.0 AUSTRALIA 10.5 SPAIN 8.6 ITALY 21.4 USA 6.3 CANADA 5.2 AUSTRALIA 4.4 SPAIN 4.3 ITALY 21.5 USA 6.3 BRAZIL 5.2 SOUTH AFRICA 3.9 CANADA 3.3 INDONESIA 16.3 USA 4.9 FRANCE 4.4 LUXEMBOURG 3.2 GERMANY Source: Financial Fraud Action UK, Fraud the Facts IRELAND million in 2009 to just 42.1 million in 2012, according to Financial Fraud Action UK. Similarly, EMV technology has had a dramatic impact on fraud in Canada since the national roll-out of Chip and Pin in Losses from card skimming in Canada fell to CAD$38.5 million in 2012, according to the Interac Association, which operates the national Interac payment network. This represents a significant drop of more than 70 percent since 2009 when figures hit CAD$142 million. While these countries may have closed the gap on domestic fraud, criminals are still active in those regions and are often part of organized crime units. In February 2013, federal agents cracked down on a card fraud ring that reportedly amassed at least $200 million using 7,000 fake identities. The criminal operation spanned dozens of states and numerous countries and used stolen money to stock pile cash, purchase millions of dollars in gold, and fund a lavish lifestyle. The real risk is that this fraud is carried out in EMV mature markets then migrates to regions where EMV is yet to be deployed, such as the US. A potential problem in the parking sector is card skimming, which is on the rise according to a report from the European ATM Security Team (EAST). Online authorization technology has helped address part of the problem by detecting if cards are reported as stolen. However, it continues to be a major issue. The report from EAST found that five out of 23 European countries reported an increase in cardskimming devices attached to transport ticket machines. These devices capture data from the magstripe on users cards so the fraudsters can then create cloned cards. However, these cloned cards will only work in terminals that still accept magstripe cards. As a result, counterfeit fraud using cards from EMV mature countries is actually migrating to regions that have yet to transition to the new standard. All this makes the US parking sector a vulnerable target. Plastic card fraud in the US, using UK cards still carrying the mag-stripe, reached almost $25 million ( 16.3 million) in 2011, according to Financial Fraud Action UK. Moreover, history has shown that card fraud migrates cross-border to non-emv domains. With Canada and Mexico well advanced with EMV, this opens up further threats to the US. creditcall.com 07

8 Overcoming the Challenges The transition to EMV in the parking sector, and across all US payments, requires manufacturers and City operators to upgrade or replace every terminal and for banks to re-issue every credit and debit card. The scale of this project is the most likely reason that the US has taken so long to tackle EMV migration and why other smaller regions have got there first. Managing multiple moving parts With the move from mag-stripe to Chipenabled cards, the payments industry must tackle multiple moving parts. These range from hardware and software to transaction types and host systems. Banks will place the burden on city parking operators to comply with the standards and ensure payment systems are EMV-certified. Operators faced a similar task when the Payment Card Industry Data Security Standard (PCI DSS) was first introduced and they had to take on the responsibility for protecting customer card data 3. EMV is the next hurdle. Operators will need to implement contact and contactless devices and applications that meet the EMV specifications. Faced with further fraud losses and increased liability, they will need to rely on their system manufacturers for an EMV upgrade solution. As a result, the challenge falls to those manufacturers to determine the right migration path. 08 creditcall.com Aging legacy systems For manufacturers, replacing every terminal is a costly and time-consuming process. In addition to the hardware expense, they will need to integrate the new systems. The alternative is to provide EMV upgrades, which must take into account the age and type of machines in use with each customer. These must incorporate the necessary card readers with EMV Level 1 and Level 2 Kernels along with the necessary PA- DSS and PCI DSS compliance. Terminals must meet functional specifications and manufacturers must also validate the integration of the terminal with the acquirer banks host systems. When it comes to delivering an EMV solution, a big obstacle is the knowledge gap. Building EMV solutions calls for extensive knowledge about the EMV specifications and many manufacturers will want to avoid having to invest in growing this internally. The EMV certification bottleneck Another challenge is testing and certification. For terminals to become EMVready and approved, they must undergo extensive testing and certification. This burden will fall to the manufacturers and solution providers. The entire EMV solution must also complete end-to-end testing with each payment processor. Organizations face hurdles at both of these stages: EMV Level 1 and Level 2 testing: One of the roles of EMVCo is to ensure the correct implementation and interoperability between all of the EMV cards and terminals around the world. To achieve this, EMVCo requires all EMV terminals to pass a series of tests before they can become EMV-certified and be deployed at the parking operators or municipalities. The problem for manufacturers is the amount of time and resources required to build and test their own devices, with the EMV card reader and applications. Each unit adds cost and the whole process takes a lot of time. These resources are in short supply not only among manufacturers but also

9 0 EMVCo approved laborotories in the US EMV Migration for the across the payments sector. EMV tests are conducted by a small number of laboratories, which must first be approved by EMVCo. However, there are rigorous selection criteria for these, which is likely to result in a shortage of labs in the US. Currently, there are only 12 EMVCo approved laboratories worldwide, none of which are in the US at this point of time. Approved EMVCo Labs Worldwide Source: EMVCo, April 2013 End-to-end testing: This covers the integration of the messages from the terminal through the payment gateway and to the payment processor. There are two main requirements in this stage - MasterCard M-TIP (MasterCard Terminal Integration Process) and Visa ADVT (Acquirer Device Validation Toolkit). This is a laborious process that can take up to 16 weeks in a mature EMV-market. In the US, where EMV is new and there is less experience and expertise, it is likely to take considerably longer. In addition, parts of the testing need to be repeated for each processor. The processors themselves will be receiving high volumes of testing requests, so there could be major delays when it comes to scheduling the test slots. These issues create major bottlenecks in the process and could severely hinder manufacturers efforts to bring EMVready solutions to the market An EMV-ready solution An effective approach to overcome the technology hurdles is to make use of existing pre-certified, plugandplay EMV solutions already on the market, which have addressed many of the problems. In particular, manufacturers can integrate pre-certified EMV solutions that bundle a number of components, such as card readers and EMV Level 1 and Level 2 Kernels in a single off-the-shelf offering. This plug-andplay technology is then integrated with the POS device or terminal to offer a quick-to-market EMVready payment system for the operators. By using a pre-certified bundle, manufacturers can save valuable time as it avoids the need to test each POS device and terminal when it is deployed to the operator. It also significantly reduces the risk of testing failures as the solution has already met the EMVCo requirements. In addition to the time saved, using outside expertise avoids the need to invest resources in skilling up internal developers on the EMV requirements. creditcall.com 09 3 PCI Security Standards Council, data security standards:

10 Case Study London Heathrow Airport Migrates to Chip and PIN for Parking Payments London Heathrow Airport is the world s busiest airport with its five terminals handling over 65 million passengers a year. Although its on-site short and longstay parking lots have accepted credit and debit card payments since the 1980s, it operated using traditional mag-stripe technology. In 2008, the opening of Terminal 5 and a general upgrade of facilities provided the opportunity for Heathrow to initiate its migration to the new Chip and PIN standard. The vast scope of the project had to cover the parking lots 79 APT Skidata Pay-on-Foot pay-stations run by Apcoa, which was contracted to manage all parking operations at Heathrow. An integrated approach As part of its migration, machine manufacturer Skidata installed Spire s Artema Modular Chip and PIN card acceptance devices into the paystations. Apcoa then tasked Creditcall with devising an integration plan that would address the multiple components required to make the migration a reality. This included the hardware devices, a secure payment gateway and end-toend bank testing. and PIN devices, the parking paystations and its own payment gateway. This included integration of the messaging protocol from the device into the processing platform. In addition, Creditcall conducted the end-to-end testing and certification with the major credit card acquirers or processors. This meant that Creditcall could deliver a complete pre-certified solution to integrate the different elements of the airport s parking payments infrastructure. Following the successful planning stage, Creditcall achieved a smooth overnight implementation with minimal downtime for each installation. London Heathrow now operates with 79 EMV-compliant paystations across its parking lots, which connect to Creditcall through a network of on-site servers. Significantly, it is the largest unattended payment terminal installation in the UK in terms of volumes, processing millions of transactions each year. Creditcall achieved a smooth overnight implementation with minimal downtime... Crucially, Creditcall provided the EMVready payment gateway and had already developed software to handle the messaging between the new Spire Chip 10 creditcall.com

11 Best Practice Tips for EMV Migration The parking sector faces some significant challenges and complex technology hurdles so cannot afford to be complacent. However, there are proven best practices and solutions that manufacturers and operators can learn from to make the transition smooth. 1 Consider outsourcing Any internal development project requires dedicated time and resources. When it comes to EMV-compliant payment systems, the scope of the project is significant and must address both hardware and application requirements. This places a huge burden on manufacturers who also face time pressures to meet the new standards. By outsourcing the project, manufacturers can access both the expertise and a plug-and-play pre-certified EMVready technology. This allows them to focus on the integration, bypass the need for extensive testing, and deliver an EMVready solution ahead of the competition. 2 Use multi-platform, low-footprint Kernels When choosing to outsource, one of the most critical parts of an EMV-ready solution is the EMV Level 2 Kernel. Manufacturers should look for Kernels that are preapproved and simply plugand-play to reduce the risk, implementation time and cost of implementation projects. In particular, pre-approved Kernels allow manufacturers to outsource the entire certification piece. In the case of EMV Kernels, the supplier should use the same test tools as the EMVCo certification laboratory before submitting the Kernel for EMVCo certification. This will increase the likelihood of the Kernel passing the formal EMVCo certification first time, ensuring the project remains within budget and on time. With numerous operating systems and processors in use in terminals today, one EMV Kernel cannot fit all. Therefore, it is important to find one that works across all common platforms, including Windows, Windows CE and Java. 3 Choose the right partner Parking system manufacturers and vendors in many regions around the world have already tackled the EMV issue. The US stands to benefit from the expertise gathered in these project and also from technology that has already proved successful. Manufacturers know about designing and manufacturing parking payment terminals. However, they may not know about EMV. Therefore, when working with a third party provider, they should look for proven expertise in EMV and technology that is already in use in the parking sector. 4 Consider EMV in the Cloud One approach that is already achieving success is EMV in the Cloud. Here, the EMV Kernel resides in a Cloudbased server while other terminal features can be provided via a web service. The advantage of this is that the terminal has less software and less complexity. It also allows instant software updates, rollbacks and EMV configuration changes and simplifies data handling and management with transaction data stored in the Cloud. While there are limitations with this approach, such as slower transactions, for many this is proving a viable and agile approach. With over 100,000 devices already deploying EMV in the Cloud, this could be the future of payment technology. creditcall.com 11

12 5 Ensure the infrastructure is reliable For any EMV-ready payment system to deliver, it might run on reliable and stable payment infrastructure. The move to EMV is also an opportunity for manufacturers to address this infrastructure to ensure it support transactions and customer payments are not compromised. 6 Incorporate point-topoint encryption When processing credit and debit card transactions, protection of cardholder data is of paramount importance and this extends to transactions using EMV Chip-based cards. With EMV tackling fraud at the point of sale, it is vital that this sensitive information is not compromised by computer hackers while in transit. As operators accept Card payments, they must comply with PCI DSS which can be complex, time consuming and costly. When tackling EMV migration, manufacturers should also look to incorporate pointto-point encryption technology. This is deployed at the card reader and turns card data into encrypted information while it passes through WITHOUT P2PE Reading Cardholder Data Card Reader Merchant Network Secured with SSL Creditcall Payment Gateway Private Connection Bank Processor Authorization & % # WWW WWW $ Vulnerable: Needs to be Secured to PCI DSS at High Cost Secured PCI DSS Level 1 Environment WITH P2PE Reading Cardholder Data Encrypted Card Reader Merchant Network Secured with SSL Creditcall Payment Gateway Private Connection Bank Processor Authorization & % #? %! & $ % ^ WWW WWW $ Secured by P2PE at Low Cost Secured PCI DSS Level1 Environment 12 creditcall.com

13 About Creditcall Creditcall makes card acceptance simple from any device, anywhere. Whether attended, unattended, online or mobile payments, our award-winning EMV-ready payment gateway and EMV Migration solutions are at the very heart of our clients businesses, ensuring payments flow all day, every day. Founded in 1996 and with over 14 years of EMV experience, Creditcall has a proven track record in providing payment gateway services and offers EMV Migration solutions that are tried and tested. Our EMV Migration solution, ChipDNA, is a rapid EMV Migration SDK for Windows, Linux, ios and Android. It greatly helps ISVs transition from older magnetic stripe technology to EMV and Chip technology. ChipDNA is the easiest and most cost effective way of adding EMV payment functionality into an attended or unattended Point of Sale (POS) application. mpos EMV Migration We were the first EMV-ready Payment Gateway in the U.S., and completed our EMV certification in April Our Chip-based EMV Level 1 and EMV Level 2 Kernel software is used globally in contact and contactless environments such as ATMs, mpos, card readers, PINpads and other POS devices. We are the first EMV-compliant mpos solution to allow businesses accept Chip and PIN cards on the go via smartphones and tablets. Millions of users and billions of transactions depend on Creditcall EMV technology each and every day. Creditcall works collaboratively with companies across Europe, North and South America, South Africa and Asia-Pacific to deliver business-critical payment solutions. Clients include ATOS, DHL, Elavon, Hilton Hotels & Resorts, Toyota, Wayne (a GE Company) and Westfield. Creditcall The Heart of Payments. POS Transport Vending ATM Mobile & Online Parking Ticketing creditcall.com 13

14 Regional Offices Creditcall Europe Merchants House North, Wapping Road, Bristol, BS1 4RW, United Kingdom T: +44 (0) F: +44 (0) E: W: Registered No: VAT Registered No: Creditcall North America 1133 Broadway, Suite 706, New York, NY 10010, USA T: +1 (800) F: +1 (212) E: W: