EMV Is Coming: Are You Prepared?
It is widely acknowledged within the payments industry that chip-based payment standards can help significantly reduce credit and debit card payment fraud.1 Until recently, however, there was little interest among most stakeholders in the U.S. in converting our payment system to a chip-based standard.
But that is now changing, as the first steps are being taken to covert the U.S. payments infrastructure to EMV. In April 2013, merchant acquirers and payment processors faced the first EMV deadline: They now must be capable of processing EMV payments.
The U.S. is the last major world economy to migrate to EMV, and converting our entire payments system will undoubtedly be a complex and time-consuming process that will take years. However, that process is now underway -- which means merchants that accept credit and debit cards for payment should begin learning about exactly what EMV is and how it will affect their businesses.
What Is EMV?
EMV stands for Europay, MasterCard® and Visa®, which is a technical standard designed to ensure that microchip-embedded payment cards are compatible with merchant terminals. Chip-embedded payment cards are very difficult, if not almost impossible, to duplicate. When combined with encryption, tokenization and other additional layers of security, EMV significantly reduces opportunities for card payment fraud.2
EMV is often equated with "Chip and PIN" verification -- card validation via chip and cardholder authentication via PIN -- but the terms are not interchangeable. EMV technical specifications do not require that merchants use any particular form of identity verification. Rather, the issuing bank will place specific rules on the chip that specify which verification services are required, and card processors will be prepared to support all verification methods.
However, many in the payments industry, led by the Card Associations, strongly believe that Chip and PIN verification provides the greatest protection against payment fraud, including fraudulent use of lost or stolen cards, counterfeit cards and skimming. Chip and PIN is also compatible with security standards that exist in most other countries.
Payments can be authorized for chip-based transactions using either an online or offline process. The verification method is generally determined by the issuer. With online authorizations, transaction information is sent to the card issuer for approval; with offline authorizations, the transaction is authorized or declined using issuer-defined risk parameters stored on the chip. Or, a hybrid process can be used that verifies the cardholder via offline PIN and authorizes the transaction online via the issuer.
The primary benefit of online authorization is an additional layer of security and fraud protection, and simplified chip production and encryption key management. The primary benefit of offline authorization is speed: with no need for back and forth messages to the issuer, the transaction can be completed very quickly.
Contact and Contactless Transactions
Many merchants today are eager to benefit from the various kinds of new payment options supported by chip-enabled payments. This includes both contact and contactless transactions, like tapping or waving the card instead of inserting it. To do so, however, merchants may need to upgrade their point-of-sale (POS) terminals to new dual-interface, EMV-capable terminals to meet EMV requirements. The benefits of upgrading to these terminals are many:
- Meets Visa's merchant requirement for Technology Innovation Program (TIP) relief from PCI compliance reporting to Visa.
- Could aid in the adoption among U.S. consumers of mobile payments.
- Ensures global interoperability.
Upcoming Shift in Fraud Liability
It's important to note that fraud liability will eventually shift to merchants that have not implemented an EMV structure. Beginning in October 2015, the merchant, not the issuing bank, will be liable for counterfeit card transactions if the merchant receives a fraudulent Visa chip card but has not installed an EMV-capable terminal.
This liability shift will apply to all merchants, regardless of their size. So it's not too early to begin making plans to upgrade to new EMV-capable terminals that are capable of meeting the card associations' EMV requirements.
Please contact PNC Merchant Services® Customer Service at 800-742-5030 if you have further questions about EMV and how it might affect your business.