EMV Chip Cards
Agenda What is EMV Chip vs Mag Stripe Benefits of EMV Timeframes & Liability Shift Costs Things to consider Questions 2
What is EMV EMV was named for the developers Europay, MasterCard and Visa. Embedded microprocessor chip that encrypts transaction data. Dynamic chip that changes verification values for each transaction. This is static on the magstripe. A set of specifications developed to define requirements to ensure interoperability between chip-based Credit, Debit and Prepaid cards and POS and ATM terminals. 3
EMV Chip Cards 1. Card Type: Contact (chip) contactless (tap or wave), Dual interface (both contact and contactless) 2. Card Authentication Method (CAM) Protects against counterfeit cards. EMV supports two methods Online authentication takes place between the chip and issuer host using dynamic cryptogram Offline authentication takes place between chip and terminal using static data 3. Cardholder Verification Method (CVM) Authenticates the cardholder. EMV supports four methods Online PIN- The PIN is stored at the issuer s processor, it is encrypted in POS terminal and sent to issuer s processor to verify Offline PIN- The PIN is stored in the chip and is sent from the POS terminal back to the card to validate Signature-Cardholders signature on the receipt is compared to signature on the card No CVM-No verification method is used. Typically low value transactions at unattended terminals 4. Authorization Transaction authorization Online-Transaction information is sent to issuer processor along with a transaction specific cryptogram and issuer processor authorizes or declines Offline-Card and terminal communicate and use issuer defined risk parameter 4
Swipe vs Chip- How are they different? Magnetic Stripe EMV Chip Cards are swiped and read at POS terminal Authentication takes place between POS terminal & merchant acquirer Verification takes place through PIN or signature Authorization comes from processor or host processor Cards are Dipped (Contact) or waved (Contactless) or swiped if terminal is not chip enabled Authentication can be offline or online enabled by computer chip in the card Issuer can choose verification methods offline or online PIN, signature, no CVM Authorization comes from processor or host processor 5
What are the benefits of EMV? Increase security Liability shift Reduction in Card Present fraud, resulting from counterfeit transactions. Provides interoperability with the global payments infrastructure consumers with EMV chip payment cards can use their card on any EMV-compatible payment terminal anywhere inside or outside the U.S. 6
What are the timeframes? October 1, 2015 U.S. liability shift becomes effective for all card associations. The participant that does not support chip transactions will be held financially liable for any card present counterfeit fraud losses. Automated fuel dispensers (AFD) receive a two year grace period before the liability shift becomes effective for all card associations. (October 1, 2017) October 1, 2016 MasterCard ATM owners and operators will be financially liable for fraud that takes place at a non-emv enabled ATM, if the card is EMVcapable October 1, 2017 VISA ATM owners and operators will be financially liable for fraud that takes place at a non-emv enabled ATM if the card is EMVcapable. 7
What are the timeframes? Credit The TBS credit platform is chip capable today. VISA recommends implementation closer to the Liability shift which is October 1, 2015. The implementation process can be as little as 6 months or up to 8 months depending on standard vs custom programs. Debit Today the debit networks are working together toward a solution to the Durbin Amendment. Until the details and technical requirements to support EMV and the U.S. common AIDs (Application Identifier) is resolved, debit EMV does not have an implementation date yet. 8
What does all this mean? There is no mandate that says your credit union must use chip enabled cards; however, there is a liability shift that will take place starting October 1, 2015 The liability shift is on card present counterfeit fraud transactions. A non enabled merchant will be liable for fraud that occurs on a chip card used on a terminal that is not chip enabled. Magnetic stripes will continue to be on all cards for merchants & issuers to use if one or the other is not chip enabled. Card Present fraud will decrease as EMV is implemented. Card Not Present (CNP) fraud will likely increase 9
Fraud After Adoption 10
Global Adoption 11
Things to consider Goals Costs Increase Acceptance Worldwide Prepare for the Liability Shift An Emerging Technology Leader Implementation Fees Set Up Fees Monthly Recurring Fees Roll Out Plastic Education 12
13
14
15
16
Merchant and Card Issuer Readiness EMV in USA: Assessment of Merchant and Card Issuer Readiness 17
Merchant and Card Issuer Readiness U.S. to reach global parity in EMV by 2018 Industry ready to convert 1.2 Billion EMV Payment Cards and 8 Million POS terminals for EMV transition. By the end of 2015, it is forecasted that 166 million EMV credit cards will be in circulation in the U.S. (29% of the total), and 105 million EMV debit and prepaid cards (17% of the total). 18
The U.S. migration to secure chip-based EMV payments requires new activities and collaboration 19
Multiple Form Factors, Multiple Communications Links 20
21
Visa, MasterCard Agree on Common AID for EMV Debit Routing BY DAVID HEUN JUL 1, 2013 4:15pm ET EMV Migration Forum: Use Single Code for Debit Transactions Visa and MasterCard have agreed to share their common application identifier technology, enabling EMV-chip based debit transactions to originate from a single application while allowing merchants a choice of networks for routing. The agreement is a major step toward resolving a longstanding dispute within the payments industry over how to adapt EMV payment technology to U.S. regulation. The licensing agreement between the two major card brands provides for "a multi-access common AID that all others can adopt" and supports the single-code recommendation of the EMV Migration Forum, says Stephanie Ericksen, Visa's head of authentication product integration. The agreement comes less than a week after the Secure Remote Payments Council, representing independent debit networks, announced what it considered a major concession in agreeing to allow Visa and MasterCard applications on their debit cards after earlier committing to Discover's common AID. The debate over EMV debit routing has raged for more than a year as debit networks preparing for EMV smart cards in the U.S. deal with Durbin amendment requirements that call for at least two network options. The U.S. is the only country with multiple debit networks and federal mandates for routing. "We are pleased to be able to offer a cost-effective option for acquirers and issuers for merchant routing choice through a single common AID," says Carolyn Balfany, MasterCard's senior vice president and group head of U.S. product delivery. 22
Visa s Counterfeit Liability Shift Policies Visa s Counterfeit Liability Shift Policies VISA BULLETIN 9 August 2011 Visa intends to institute a liability shift in the U.S. for domestic and cross-border counterfeit transactions effective 1 October 2015. Visa s global POS counterfeit liability shift policies are designed to encourage EMV chip card issuance and acceptance in participating geographical regions, effectively creating a more secure environment for transactions within and between each participating Visa region. Note: The liability shift encourages chip transactions because any chip-on-chip transaction (i.e., a chip card read by a chip terminal) provides dynamic authentication data, which helps to better protect all parties. With this type of liability shift, the party that is the cause of a chip-onchip transaction not occurring (i.e., either the issuer or the merchant s acquirer) will be financially liable for any resulting card-present counterfeit fraud losses. When a transaction occurs using chip technology, any liability for counterfeit fraud, though unlikely, would follow current Visa Operating Regulations. The policy assigns liability for counterfeit fraud to the party that has not made the investment in EMV chip cards (issuers) or terminals (merchants acquirers). The policy encourages wider deployment of EMV cards and terminals. EMV chip implementation is accelerating globally. Today, excluding the U.S., 44 percent of all cards are EMV chip cards, and 74 percent of all terminals are EMV chip-capable, with 62 percent of cross-border trans October, 2015 Fraud Liability Shift. MasterCard liability hierarchy takes effect. The party that has made investment in the most secure EMV options is protected from financial liability for card-present fraud losses for both counterfeit and lost, stolen and non-receipt fraud on this date. October, 2015 Account Data Compromise Relief: On this date, if at least 95% of MasterCard transactions originate from EMV-compliant POS terminals, the merchant is relieved of 100% of account data compromise penalties. 23
Specification Bulletins EMVCo technology Publicati on Date Septemb er 2014 Septemb er 2014 Septemb er 2014 Septemb er 2014 August 2014 August 2014 Versi on 1st Editi on 1st Editi on 1st Editi on 1st Editi on 1st Editi on 2nd Editi on Description SB-148: Clarification on Terminal Support of Multiple Application Version Numbers per AID (Spec Change) SB-147: Clarification on the Format of Exponent Data Elements (Spec Change) SB-146: Entry Point Final Combination Selection (Spec Change) SB-145: Clarification on the Format of ICC Public Key Exponent (Spec Change) SB-142: User Interaction Parameters for Installation of Contactless Mobile Payment Applications (Spec Change) SB-119: Clarifies Group Member CREL & FCI contactless characteristic declarations, clarifies length of Base AID (Spec Change) Download Download Download Download Download Download Download 24
Worldwide EMV Card and Terminal Deployment The statistics below show worldwide EMV deployment figures as of Q4 2013. The figures represent the latest statistics from American Express, Discover, JCB, MasterCard, UnionPay, and Visa, as reported by their member financial institutions globally. 25
26
27
Questions???? Please contact emv@lsc.net 28
Thank You 29