Are you ready for the new EMV cards?

Are you ready for the new EMV cards?

Soon, 1.1 billion magnetic stripe credit cards  will be converted to more secure EMV or chip and PIN cards, and merchants have until October 2015 to have EMV point of sale devices ready for transactions.

Right now, liability falls to the banks if credit cards are hacked. But in the future, the liability will fall to the parties involved with credit card processing with the least secure technology.

Merchants should change over their point of sale devices as soon as possible in order to find card processors that fit their needs. The closer October 2015 looms, the less selection there may be. To help merchants prepare for the change, we talked with experts and researched some of the areas of concern.

Why the change? The widely used U.S. magnetic-stripe credit cards are more easily hacked than the EMV cards. This means thieves are targeting the United States as the last easy place to steal information from credit cards. Most of Europe, Asia and Latin America use EMV cards, which carry a computer chip that reduces theft. But, the United States has been reluctant, because our banking and retail systems are so diverse.  

"We don't have five banks; we have over 5,000 banks," says Doug Johnson, vice president of risk management policy for the American Bankers Association. "We have a very large retail environment with many different types and sizes of merchants. And so it makes it a much more difficult prospect to really adopt EMV on a system-wide basis."

How does it work? EMV (which stands for Europay, MasterCard and Visa) cards have a microprocessor computer chip embedded into them, which inspires their alternate name, chip and PIN cards. When the consumer uses the card, the computer chip creates a code that corresponds to that specific transaction, and can't be reused, according to Randy Vanderhoof, director of EMV Migration Forum.

The customer feeds the card into the machine and types in the PIN. He can also use a signature for the transaction. He has the option of using the card the old-fashioned, but less secure, way by swiping it. Some cards have the option of being contactless, which can speed up transactions.

Why the interest now in EMV? U.S. bank card fraud rates have risen by 70 percent since 2004, according to the National Retail Federation. The December 2013 Target credit card security breach, which affected at least 70 million customers, brought the matter to a head.  A Senate hearing followed the Target breach in early February, and larger merchants who may have been quiet about the changeover in the past strongly voiced their approval to convert to EMV.

"I think that tone significantly changed after the [Target] data breach activity that took place in December and early January.  And what came out in the Senate hearings was a recommitment and a confirmation that major retailers -- at least those represented by the National Retail Federation -- were strongly in favor of moving to EMV chip technology," said Vanderhoof, who was present at the hearings.

How much does it actually reduce fraud? Credit card fraud for transactions in which the credit card was present has dropped 75 percent since 2004 in the United Kingdom, which was before chip and PIN technology was in place there, according to Financial Fraud Action UK, "Fraud the Facts 2013." However, fraudsters sought weak links, and it was the U.K.'s data collection system and monitoring that actually improved the fraud, one study said.

Meanwhile, global credit card fraud hiked to more than $11 billion in 2012. And although the U.S. generated only 27 percent of the total number of cards, it represented almost half of global card fraud losses,  according to The Nilson Report, August 2013. Fraud in the U.S. costs about $8.6 billion per year, and that is expected to rise to at least $10 billion per year by 2015, especially if the U.S. does not convert to chip cards.

What are its advantages to the merchant? If the merchants are set up for EMV transactions and there is a data breach of credit cards, the merchant will not be liable.

Disadvantages? Aside from the costs of the equipment conversion, merchants will need to order the EMV equipment early to avoid the rush on supplies that will likely occur closer to the deadline, according to EMV providers. There will be a small learning curve as merchants and customers learn how to use the machinery.  (For example, customers need to leave the card in the machine for the length of the transaction.) Using a PIN card could slow transactions.

What is the October 2015 deadline? You must be ready to accept EMV cards with compliant POS terminals, or you might be liable for fraudulent charges.

Who has to comply? All merchants who don't want to accept liability for fraudulent charges.  There's no cutoff in terms of size of merchant, according to Johnson.

Who is mandating the deadline? Visa, MasterCard, American Express and Discover have indicated that by October of 2015, if financial institutions issue new cards and merchants do not have EMV point-of-sale devices, there will be a liability shift.  "So it's not mandatory, but there are repercussions" if a merchant is not EMV-ready, Johnson says.

What steps do I (the merchant)  have to take to comply? How do I do it, and how much will it cost me? "Merchants should know that it is their merchant bank's responsibility to work with them through the implementation of the technology," said Johnson.  

The key element is getting at least one terminal that can process an EMV card, according to Patty Walters, senior vice president of Corporate EMV Strategy at Vantiv, a payment processor and technology provider.

Call your acquirer or the technology provider who is offering you your payment equipment.  If you're not sure who that is, usually there's a help phone number on the side of your credit card machine that can direct you. Ask whether or not your terminal can process a chip card transaction or an EMV transaction, and what solutions your acquirer has for EMV card terminals. You can lease or buy them.

Cost differs with every service provider and with every agreement.  "You can lease a brand new terminal for less than typically less than $50 a month," says Walters.   "We do recommend two pieces of equipment because we think it's important that a card never leaves the cardholder's possession," said Walters.

What kind of equipment should I buy? Some merchants are opting for the more advanced equipment, so they will be prepared for the future. EMV also has contactless and mobile payment capability. Customer interest in mobile payments is growing. Aite Group forecasts that U.S. mobile payments will reach $214 billion in gross in 2015 from $16 billion in 2010. Many POS equipment manufacturers are building both contact and contactless as well as mobile capabilities into their EMV-enabled devices; therefore the upgrade to this equipment gives customers a choice and provides a catalyst for driving mobile adoption even faster. Walters says you shouldn't buy used equipment because it may already be obsolete or embedded to enable thieves to capture card information.

Will the machine be able to accept debit transactions? The machines are ready for the transactions; the software is the issue. There has been a delay in the availability of EMV software for merchants to process debit cards because of regulatory requirements, Vanderhoof says. Some merchants are choosing to delay their implementation of any EMV until the software is available to support debit as well as credit. 

Will Merchants need Ethernet? It's not required that a merchant replace a dial phone line with an Ethernet connection, but it is recommended.  "The reason why is because the equipment of the 21^st century has been designed to work more effectively with that Ethernet connection to reduce the total transaction response time of the payment transaction," said Walters. 

To PIN or not to PIN? Experts say, other than requiring a signature, merchants should choose to make transactions even more secure by requiring a PIN (a personal password) for each card, much the same as an ATM card.

"You'll be given a choice between PIN and signature devices. I believe that a PIN is a much better method to verify a cardholder and therefore is by its nature a more secure methodology, " said Walters.

How many points of sale devices are there in the U.S.? Roughly 16 million. And roughly 5 million of those are stand-alone terminal devices for small merchants, said Walters.

EMV technology is hitting the States, it's a fact. Now, it's your job to prepare. "We've got all of the standards in our hand now," said Walters. "Have the conversation today."

Published: May 20,2023