October is Here: Are Issuers, Merchants & Consumers Ready for EMV?

Transcription

1 October is Here: Are Issuers, Merchants & Consumers Ready for EMV? Moderator: Claudia Swendseid Federal Reserve Bank of Minneapolis Panelists: Terry Dooley SHAZAM Bob Van Liere PREMIER Bankcard Navigating Payments Conference October 8, 2015

2 Claudia Swendseid Senior Vice President Federal Reserve Bank of Minneapolis Federal Reserve Banks Serves on the Minneapolis Bank s senior management committee Provides executive oversight to operations, customer service, technology & payments functions, as well as to the Financial Services Policy Committee Support Office Conducts industry relations on behalf of the Federal Reserve System, serving as a liaison to selected national banking & business associations Vice Chair, Accredited Standards Committee X9, Financial Industry Standards Provide financial services to depository institutions & U.S. government Supervise & regulate financial institutions Establish & execute U.S. monetary policy Maintain a stable financial system & contain systemic risk 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 2

3 Terry Dooley Executive Vice President & Chief Information Officer SHAZAM Leads SHAZAM s product development, application development & IT infrastructure, corporate & IT security, vendor & customer relationship management, security consultative services, & business continuity groups Chair of the Payments Processing Information Sharing Council (PPISC) Chair of the Secure Remote Payment Council (SRPc) Vice chair of the Debit Network Alliance (DNA) The SHAZAM Network is a single-source provider of core, risk management, card, ATM, marketing, merchant, mobile & ACH 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 3

4 Bob Van Liere Executive Vice President Card Services PREMIER Bankcard, LLC Responsible for operational and strategic oversight of Premier s Customer Service, Retention, IVR, Customer Web Site, Correspondence, Fraud/Security & Loss Prevention functions Oversees Human Resources & Facilities Management PREMIER Bankcard is the 12 th largest issuer of credit cards in the U.S. Has 2.8 million active cardholders 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 4

5 Agenda 1) Status of U.S. EMV Migration Key Roadmap Dates o o October Fraud Liability Shift is Here ATMs Are Next Trends in Card Issuance & Merchant Acceptance 2) Issues & Obstacles 3) Potential Impact on Card-Related Fraud Disclaimer: Opinions expressed are those of the individual presenters, not their respective organizations 5

6 Status of U.S. EMV Migration 6

7 What Is EMV? EMV (Europay, MasterCard & Visa) is a set of global proprietary specifications for credit & debit payment cards, point-of-sale terminals & card transaction processing networks based on smart chip card technology EMV chip cards use an embedded microprocessor for payment transactions 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 7

8 Main Benefits of Chip Cards Improved usability of U.S. cards in worldwide EMV markets Reduced POS counterfeit fraud Harder to skim data from EMV transactions Chips authenticate card readers & EMV cards to one another at POS, & can detect tampering Reduced fraud from foreign EMV cards used as mag stripe cards in U.S Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 8

9 U.S. EMV Migration Roadmaps Key Dates Visa MasterCard October 2012 PCI audit relief April 2013 Acquirers & processors required to support merchant acceptance of EMV transactions October 2013 Account Data Compromise (ADC) relief (50%) April 2015 October 2015 October rd party ATM acquirer processors & subprocessors required to support EMV data Card-present counterfeit liability takes effect excluding automated fuel dispensers (AFD) ADC relief (95% - 100%) Lost or stolen liability shift ATM liability shift October 2017 ATM liability shift Card-present counterfeit liability takes effect for automated fuel dispensers Lost or stolen liability shift for AFD Discover American Express PCI audit relief 2013 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. PCI reporting relief

10 Status of EMV Adoption - Issuance Is at a Tipping Point At end of 2014, about 120 million of the 1.2 billion credit & debit cards in circulation in the U.S. were EVM-compliant EMV Migration Forum estimates the U.S. will have 600 million chip cards in circulation by end of 2015 Ontrack Advisory predicts between 40 to 50% of U.S. cards will be EMV-ready by October 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 10

11 Debit Card Issuance Is Growing Debit issuance has increased 107% since beginning of 2015 Debit issuance is growing twice as fast as credit Natural migration based on 3 to 4 year expiration cycle is most popular method Issuers are migrating debit portfolios to EMV with or without a business case, seeking to: Improve security Minimize fraud Meet international standards Sources: Visa presentation to EMV Migration Forum June 2015; 2015 Pulse Debit Issuer Study Executive Summary 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 11

12 Status of EMV Adoption Merchant Acceptance Figures vary Merchant Advisory Group estimates that about 20% of merchants POS terminals will be EMV-capable by end of 2015; Ontrack Advisory pegs this at 25 to 30% Visa estimates 47% of POS terminals are activated to accept EMV cards* Larger retailers are installing EMV POS terminals *Visa presentation at June 2015 EMV Migration Forum meeting 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 12

13 Small Merchants Lag in EMV Readiness Only half of smaller businesses are aware of October liability shift Only 31% say their existing credit card processing system accepts chipenabled cards 29% plan to equip yet this year 40% have no plans Reasons Why Some Small Businesses Don t Plan to Upgrade to Accept Chip Transactions Not concerned about fraud losses, 41% Don't want to pay upgrading costs, 46% Upgrading POS terminal will not impact my business, 48% Source: Wells Fargo/Gallup Small Business Index July Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 13

14 Is There a Positive Cost/Benefit Proposition for EMV Acceptance by Merchants? Acceptance: Pros Acceptance: Cons Reduces counterfeit fraud in cardpresent transactions Avoids assuming liability shift Reduces PCI reporting cost May help protect against fraud loss shifts to U.S. from countries adopting EMV Supports standard card payment methods across countries Ability to accept EMV cards from international travelers New investments in equipment, software, & infrastructure Protection still needed for card lost or stolen fraud & card-not-present fraud CNP fraud may increase Check out may take longer; cards may be forgotten more often Complexity of supporting different card brand roadmaps May not integrate readily with mobile payment acceptance 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 14

15 When & How Will ATMs Be Impacted? Processors must gear up to accept EMV transactions Visa s roadmap calls for U.S. third party ATM acquirer processors to be certified to handle EMV transactions by October 2015 o ATM manufacturers only recently made available the option of purchasing EMV card readers & software Looming ATM liability shift affects acquirers & issuers Currently, card issuers bear the liability for fraudulent ATM transactions. In October 2016 MasterCard s ATM liability shift occurs; in October 2017 Visa s ATM fraud liability shift takes place. o Shift applies to all ATMs that use magnetic stripe card readers rather than new EMV card readers. Accountability for counterfeit fraud transactions will shift to the party acquirer or issuer - that has not adopted EMV chip technology. The principle is that the party that is the cause of a contact chip transaction not occurring will be financially liable for any resulting card present counterfeit fraud losses. The ATM industry has a great deal to do to implement EMV technology 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 15

16 Issues & Obstacles 16

17 Authentication Debate Many card issuers are issuing chip and signature cards 2/3 of IT decision makers prefer chip and PIN since it offers better security per a recent survey of IT experts by Randstad Technologies Gray Taylor, Conexxus Executive Director: This survey highlights what we have been telling the card brands for years: EMV is a monumental technology shift that lacks coordinated planning, benefits and financial incentives to be successful in any measure. Further, the proposed implementation without PIN squanders the opportunity to make EMV a serious anti-fraud enhancement. NACSonline.com,Lack of Time, Expertise are Top Obstacles to EMV Readiness, July 23, Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 17

18 PIN Implementation Considerations Should issuers allow each cardholder to choose his/her own PIN? If a PIN is assigned, how should issuers manage a PIN change if desired by the cardholder? Should issuers allow PIN change at the ATM? 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 18

19 Lost or Stolen Chip Cards Chip cards don t change cardholder authentication per se, PIN or signature are both choices Using a PIN with debit transactions reduces fraud by a factor of 5 times To PIN or not to PIN? Source: Six Reasons to Call an EMV Time-Out by Karen Webster, Payments.com, March 23, Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 19

20 PIN Bypass Button A new feature at the point-of-sale terminal for cardpresent transactions that allows PIN entry to be bypassed Several flavors being considered to allow merchant or cardholder decision to bypass PIN E.g., some approaches allow the merchant to opt out of PIN for purchases under a certain dollar threshold It s complicated! Card brand rules & processes differ Affects AID selection Depends on how acquirers deploy terminals 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 20

21 Is Apple Pay a Game Changer? Most issuers currently participate or plan to participate in mobile payments in 2015 How does Apple Pay work? Rather than using a physical payment card, the cardholder opens the Passbook app, selects a card, uses fingerprint technology to unlock the payment capability & aims the phone at the merchant terminal Behind the scenes, Apple Pay capabilities include NFC & tokenization (extra layer of security that scrambles the card number & replaces it with a non-sensitive data element) Some issuers question the Apply Pay value proposition; fear loss of control; plus consumer acceptance has been sluggish Some issuers appreciate security benefits (biometric authentication & tokenization) & interchange fees Source: Pulse 2015 Debit Issuer Executive Summary 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 21

22 Potential Impact on Card- Related Fraud 22

23 Chip Card Impact on Card Fraud Once EMV takes hold, other countries have seen fraudsters target on-line transactions, perpetrate elaborate ATM fraud schemes, & attack markets without chip-&-pin Chip cards don t protect card-not-present transactions in the e-commerce space; other solutions must be applied Fraud attacks shift to most vulnerable channels Merchants bear losses due to CNP fraud 2014 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 23

24 CNP Fraud Losses Expected to Rise Source: Aite Group as reported in Digital Transactions, September Federal Reserve Bank of Minneapolis. Materials are not to be used without consent Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 24

25 Fighting CNP Fraud Authentication Methods & Tools o Endpoint Security (device level authentication) o One-Time Password (valid for only one transaction or online session) o Randomized Pin Pad (scrambles the key pad & captures XY coordinates) o Biometrics (iris, retina, hand, voice, fingerprint, etc.) o 3D Secure (enables real-time cardholder authentication during an online transaction) o Tokenization (replaces personal account number with surrogate values) o Proprietary Approaches (e.g., membership, registration in customer loyalty programs) 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 25

26 Questions? 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 26

27 APPENDIX Additional Information 27

28 EMV Resources Card brands websites (Visa, MasterCard, Discover & American Express) Excellent public resources available from EMV Migration Forum at: o Video presentations: Implementing EMV in the U.S. How the U.S. Common Debit AIDS Facilitate Debit Transaction Routing and Ensure Durbin Compliance EMV 101 webinar o White papers: Understanding the 2015 U.S. Fraud Liability Shifts Near-Term Solutions to Address the Growing Threat of Card-not-Present Fraud Implementing EMV at the ATM; Requirements and Recommendations for the U.S. ATM Community 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 28

29 How EMV Works Integrated Circuit Card (ICC) Designed to be used as contact or contactless Not just a card but a system Terminals New messaging data New application logic New configuration settings All stakeholders affected Issuers Merchants Processors Networks Cardholders 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 29

30 EMV Liability Shifts October 2015 o Card-present liability shift for most merchants not including automated fuel dispensers (AFD) o Lost or stolen liability shift (MasterCard, Discover & American Express) October 2016 o Liability shift for ATM owners (MasterCard) October 2017 o Liability shift for ATM owners (Visa) o Liability shift for AFDs (Visa, MasterCard, Discover & American Express) o Lost or stolen liability shift for AFD (MasterCard, Discover & American Express) 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 30

31 EMV Around the World 80 Countries Use EMV Payments Canada, Latin America & the Caribbean: 41.1% of cards 76.7% of terminals Europe zone 1: 84.4% of cards 94.4% of terminals Africa & the Middle East: 20.6% of cards 75.9% of terminals Asia Pacific: 28.2% of cards 51.4% of terminals Europe zone 2: 14.5% of cards 68.1% of terminals Source: emvco.com Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 31

32 U.S. General Purpose Card Transactions Are Mostly Card Present Total Number of Transactions, in billions: 100% 80% % % 12% Overall Card Not Present 16% 60% 40% 76% 88% 88% Card not present Card present 84% 20% Overall Card Present 0% Credit Debit Prepaid Source: 2013 Federal Reserve Payments Study. Fraud findings: card-not-present transactions are 3 times more likely to be unauthorized than card-present transactions 2015 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 32