The ABC of EMV. There s a chip on my Barclaycard

The ABC of EMV There s a chip on my Barclaycard by Dave Birch <mailto:daveb@hyperion.co.uk> Consult Hyperion <http://www.hyperion.co.uk> No Change My new Barclaycard has a chip on it. So do lots of others, since Barclaycard have already issued their first 500,000 smart cards (with another 2.5 million to follow over the next couple of years). The chip on my Barclaycard is rather a clever one, with two applications on it: a smart credit card application and an electronic purse application. Not much to get excited about on the surface (unless you live in Northampton, for example, where the smart payment card pilot was running), but it has some very important implications for online financial services and commerce. Not right now I ve used it at home and overseas, and can testify that it works exactly the same as my old one with no chip on it but in the very near future. The move to smart cards started a few years ago. The finance sector requirements for a Card Authentication Method (CAM) to address the growth in magnetic stripe card fraud led to investigations by the card associations to review emerging card technologies. Several technologies were evaluated and the smart card was selected as the best and most cost effective available. This led to several initiatives by the card associations. In one of these, Mastercard International, Europay International and Visa International have been co operating in a working group on smart payment cards, generally known as EMV, since 1993. The purpose of this group was to develop standard specifications for payments businesses founded on ISO 7816, the standard for contact smart cards. Broadly speaking, the group s goals were to: Establish standards for global interoperability for financial institution smart card transactions at POS and ATMs. To reduce the amount of online authorisations, passing on reduced acquiring costs for merchants. To reduce the fraud costs associated with counterfeit cards. To provide a secure platform to enable offline cardholder verification at point of interaction for smart card transactions. In other words, to provide a way to make customers in shops prove that they are entitled to use the card they have presented, without having to go online to a database somewhere. The first release of the resulting EMV standard was in May 1994. It presented an implementation of the ISO 7816 specification to: Hyperion Systems Limited (1999) Page 1/8 (This reprint 26 th June 1999)

» Provide a process whereby an offline payment transaction could be authorised in a controlled environment.» Provide a process to mutually authenticate the card and the issuer in an online transaction over insecure data links (public networks). EMV is a three part specification: the first part deals with the cards, the second with the terminals and the third with applications. Since 1994, the specifications have been reissued a number of times, with each version being controlled through a committee process. Due the length of time involved, a number of large scale smart card developments and implementations went ahead during the review process and were therefore based on different shapshots of the EMV specifications. The current version is EMV 96 3.1.1 (published 31 st May 1998), and the payment associations have said that it will be stable until 2001. Most European schemes for moving existing magnetic stripe credit, debit and charge cards over to smart cards have declared EMV compliance to be one of their goals, although their timescales for EMV implementation naturally vary wildly (see Table 1). Note that the EMV specifications do not cover electronic purse. EMV Readiness High Average Low Countries UK, France, Sweden Belgium, Denmark, Finland, Germany, Ireland, Netherlands, Portugal, Spain Greece, Italy Source: Payment Systems Europe (3/99). Table 1. EMV Readiness in Europe. Table 2. Smart Card Infrastructure, Readiness for EMV.Against a similar background of concern over increasing counterfeit and fraud losses in the early 1990s, APACS members formed an ICC (Integrated Chip Card) project to provide an infrastructure to replace all magnetic stripe based debit, credit and ATM cards with smart cards. APACS, together with retailers, ran a pilot project based on the UK ICC Specification (UKIS, a subset of the wider EMV standard) in Northampton and Dunfermline from from October 1997 to February 1998. In the pilot the technology appeared to work well. The cards were more reliable than existing magnetic stripe cards, there were no frauds or security problems, nor any serious complaints from most retailers or cardholders [1]. All Ahead Stop While a decision was taken to roll out EMV (UKIS) technology in June 1998, this is not to say that everything is fine. There are two (as yet) unresolved problems: Hyperion Systems Limited (1999) Page 2/8 (This reprint 26 th June 1999)

» Some retailers are not happy with the transaction times, which were more than 20 seconds longer than with magnetic stripe cards. Although the banks, terminal manufacturers and retailers know that the transaction times can be reduced it is not clear how much they can be cut by nor how much that might cost.» The issue of Cardholder Verification Method (CVM) has yet to be addressed. The CVM is the mechanism for proving, at point of sale, that the person using the card is authorised to do so. This is a problem with two components:» should there be a CVM at all, and if so,» should it be Personal Identification Number (PIN), fingerprint, retinal scan, DNA analysis or whatever? APACS is currently studying the issue and expected to come out with a recommendation soon. The nature of the CVM clearly has a major impact on the type and configuration of point of sale (POS) equipment, so APACS recommendation is awaited by banks, retailers and equipment manufacturers alike. Not having a CVM at all is no significant advance over the current situation and cannot be sensible in the coming Net environment, so there must be one. It seems to me that PIN is the obvious cheap, simple, familiar CVM to use (besides, you can always revoke PINs that are compromised, a more complex proposition with retinas). The arguments against PINs that they are not secure enough, that people forget them and so on seem weak, especially when the French experience is factored in. Since all payment cards in France have been smart for years, and since their card fraud (at 0.02% by value) is about one quarter of the UK s card fraud [2], the approach seems to have worked. Still, even with the transaction time and CVM issues, the UK will be the first EU country to roll out EMV compliant chips on a national scale. The roll out began earlier this year, with a view to replacing the more than 100m cards already in issue over the next 3 years as well as upgrading nearly 24,000 ATMs. Progress has been good and over 12,000 ATMs will be capable of reading chips by this summer. Upgrading the UK s 530,000 electronic POS (epos) terminals to accept chip cards has also commenced and all of the bank owned terminals (about half) will be converted over the next three years. Note that it s only bank owned terminals being converted. Retailers continue express concerns, not only with regard to the issues noted above and but also the costs of upgrading their own terminals in the light of the costs already anticipated from the introduction of the euro. The powerful British Retail Consortium (BRC), which covers about 90% of the sector, has effectively boycotted the roll out and not one of their members has agreed to be involved [3]. Retailer concerns aside, Western Europe will be following the UK (as shown in Table 3). The international card schemes have mandated EMV chips for all European credit and debit cards by 2005 [4]. The shift to chip will take place in stages. Visa, for example, is starting a three phase programme to ensure a smooth migration cards and terminals to EMV compliance [5]. Phase one (effective immediately) requires all new Visa chip programmes to include EMV functionality and Visa recommends that all acceptance Hyperion Systems Limited (1999) Page 3/8 (This reprint 26 th June 1999)

devices be EMV compliant. By October 2001, when phase two starts, all systems and networks must be re certified as capable of carrying EMV chip data in authorisation and clearing messages. Existing chip card programmes are to be converted to EMV as quickly as possible. All chip issuers must have developed EMV compliant solutions and deployment of these must be underway. At the end of phase three in 2005, changes to the Visa operating regulations will become effective such that those Visa members who have not implemented a chip infrastructure will be liable for all fraud that could have been prevented through its use. Eastern Europe is following a similar path (see Table 4) to Western Europe and there are other EMV activities planned around the world (see Table 5) except, of course, in the US where the low cost of authorisation calls continue to mitigate against roll out. Country EMV Migration Progress Notes UK Underway Mass issuance to general public has started, 5m cards to issued by end of 1999. Counterfeit Fraud is main driver Over half of total card base to have chip by 2001. Target is 50% acceptance of chip and 65% of turnover in 3 years Costs of on-line authorisations rising France Committed with time scales yet to be agreed Card specifications expected summer 1999, migration expected as from mid- 2001. Driven by need to comply with international standards. Terminals first strategy. All new bank owned terminals to be EMV type approved from mid 1999, installations to begin mid 1999. Migration is from one chip (B0 ) to another, rather than from magnetic stripe. Belgium Committed with time scales yet to be agreed Card issuance decisions and dates to be announced mid 1999. Leverage Proton purse platform. ATM migration process already started, completion target end 1999. Debit and purse on same chip Terminal migration dates expected this summer Switzerland Committed with time scales yet to be agreed Banks to add EMV functionality to all Maestro/Eurocheque cards by 2001. Existing Purse platform ATM and POS upgrade planned to begin 2001 Italy Committed with time scales yet to be agreed EMV migration project launched July 1998 Card functional requirements in draft. Hyperion Systems Limited (1999) Page 4/8 (This reprint 26 th June 1999)

Sweden Decisions taking place Decision and project plan expected July 1999. Convergence of debit and CEPS purse on same chip platform Germany Decisions taking place GeltKarte Platform Spain Decisions taking place Large Visa Cash Implementation and work on CEPS Denmark Decisions taking place Holland Decisions taking place Chipper/ChipKnip Table 3. EMV Migration, Western Europe. Country EMV Migration Progress Notes Slovakia EMV Migration Underway Pilot began November 1999. (2000 cards, 5 ATMs, 20 POS) Roll out began in June 1999 with a target of 300,000+ cards by mid 2000 High levels of fraud and poor telecomms for authorisations. Croatia Decisions taking place Decision has been taken to upgrade acquiring network first. Czech Republic Decisions taking place Now making progress after 2 years stagnation. Actively preparing for upgrade of issuing and acquiring infrastructure Hungary Decisions taking place Actively preparing, starting with acquiring network Hungary has high levels of fraud. Issue of cards expected in 2000 Russia Decisions taking place Actively preparing both issuing and acquring infrastructure Poor telecomms Poland Decisions taking place Issue of cards expected in 2000 Table 4. EMV Migration, Eastern Europe. Country EMV Migration Progress Key Issues South Africa Committed time scales yet to be agreed Roll out expected 2001 Lesotho, Mozambique and other neighbouring countries expected to Hyperion Systems Limited (1999) Page 5/8 (This reprint 26 th June 1999)

follow suit Ghana, Niger, Lebanon, Egypt, Kuwait, UAE & Saudi Arabia Decisions taking place Israel Committed with time scales yet to be agreed Pilot underway Roll out expected Q3 1999. High levels of counterfeit fraud Terminals, ATMs being upgraded Korea and Japan Committed with time scales yet to be agreed Australia, New Zealand, India, China, Hong Kong,, Philipines, Malaysia, Singapore, Taiwan Decisions taking place Large scale implementations expected by 2001/2002 Many smart purse schemes to be considered Canada Decisions taking place Roll outs expected by 2001 USA None Argentina Committed with time scales yet to be agreed Domestic purse scheme Brazil, Chile, Venezuela, Colombia, Mexico, Uraguay Decisions taking place Roll outs expected by 2001 Table 5. EMV Migration, Rest of World. The Numbers Argument A few hundred thousand epos terminals in the UK will be converted to chip over the next three years. Right now there are already 14.5 million mobile phones and half a million digital TV subscribers in the UK and with the recent price reduction in digital TV boxes (to zero) the numbers are going to go up pretty fast [6]. Remember that every digital set top box (STB) has a smart card slot in it and many (e.g. BskyB) have two. By the time the EMV migration is complete, there will be ten times as many televisions able to accept EMV cards as shop terminals and the two slot mobile phone able to accept a full size smart card will be in the hands of consumers. At the end of last year there were around 3.5 million STBs equipped with smart card interfaces in Europe. Although few of them were being used for e commerce this will be a significant use of the 29 million STBs that will be in place in Europe in 2003. Even in the smart card third world (the US), General Instrument have announced that they will develop STBs for digital cable operators capable of accepting smart cards complying with Visa s Open Platform specifications. This represents a huge expansion in smart Hyperion Systems Limited (1999) Page 6/8 (This reprint 26 th June 1999)

card enabled POS locations: almost all digital set top boxes in Europe and Asia Pacific will come equipped with a second slot that could be used for EMV and electronic purse cards. Canal Plus already has 11 merchants up and running on their e commerce service in France, where 1.2 million set top boxes accept Carte Bancaire cards in their second slot (France will be migrating from their current B0 to EMV over the three or four years). The original reason for the transition to chip was essentially negative: not to deliver benefits but to cut fraud. Yet Visa and Mastercard between them accounted for some something over 165 billion in payments in 1998 and APACS own figures put card fraud at only 135 million, of which counterfeiting fraud (the prime target of EMV issuers) was only 27 million. Asking banks and retailers between them to spend some 300 million [7] to attack this level of fraud is not a transparently clear business case. Therefore the major reason behind APACS decision was strategic [8]: the imperative need for UK financial institutions to master one of the key payment technologies of the future and to develop an infrastructure and a platform that would allow financial institutions to develop other services (such as loyalty). The addition of these new services should strengthen and extend banks relationships with their clients and to strengthen their competitive position relative to aggressive newcomers, such as retailers, who have begun move on a large scale into financial services. From the original negative reason, then, a change to a more positive approach is underway. For banks, retailers and others the real impact of EMV will be less to do with retail POS, reduced counterfeiting costs and less card fraud than it will be to do with The introduction of remote POS (rpos) services through PCs, digital TV, mobile phones and so on. This creates a whole new payments sector and should stimulate significant innovation and new services. The addition of loyalty, e purse and other applications on multi application smart cards. With JavaCard, Multos and Windows Card competing to provide the multi application platform, this is an interesting area to watch. The internet is already the scene of much activity. Having accepted that the Secure Electronic Transaction (SET) standard for using payment cards on the internet is going nowhere, the card associations have begun to re position SET as an interim solution ahead of a new smart card based internet payment standards [9]. Europay and Barclaycard are working on SCPP (Smart Card Payment Protocol), which will enable consumers with a smart card interface in their PC to use their EMV debit or credit cards to pay for goods and services securely on the internet. Later this year, French banks will roll out smart card interfaces (probably Bull SafePads) to customers to allow them to use (non EMV) smart cards to buy online via server side SET wallets. These kinds of initiatives show where the sector is going in the medium term and developing common rpos standards for the use of EMV over the Net (e.g. SCPP), EMV over GSM and EMV in STBs should be something of a priority. There s no need for a big bang and the BRC s position need not hold up the development of new services. Since the EMV cards issued in the UK will continue to Hyperion Systems Limited (1999) Page 7/8 (This reprint 26 th June 1999)

have a standard magnetic stripe on the back, retailers may as well continue to use the stripe until they replace their POS terminals as part of normal upgrade and replacement cycles. I m not that bothered whether Tesco read the stripe or chip on my smart new Barclaycard. It s much more important to me that I ll be able to use it in the ticket machine at the car park, to buy stuff on the Net with my PC and to pay for the next F.A. Cup final on Sky Digital! Note. An edited version of this article first appeared in the Financial Times Virtual Finance Report, June 1999. References 1. Hendry, M. What s in it for us? at "whatsinit.pdf" on <http://dialspace.dial.pipex.com/town/close/nw52/> (February 1999). 2. Annual Review for 1998. Association for Payment and Clearing Services, report (London). 3. UK chip rollout grinding to halt in Cards International (214) (5th March 1999). 4. Jones, P. End Games in European Card Review 6(2): p.30 32 (April 1999). 5. Visa EU board sets EMV compliance deadline in Electronic Payments International (23rd February 1999). 6. White, J. UK Digital Platforms in Price War in TV Express 2(9): p.1 ( 7th May 1999). 7. UK Rolls out Bank Chip Cards in Smart Card News 8(4): p.65 (April 1999). 8. Goldfinger, C. Economics of Financial Applications of the Smart Card. Financial Industry Working Group, report (Brussels: March 1999). 9. Bovaird, A. Chip drives online payments protocols in Electronic Payments International (137) (19th November 1998). Hyperion Systems Limited (1999) Page 8/8 (This reprint 26 th June 1999)