What you need to know about EMV

image175

Is EMV a new LAW?

Is EMV a new law? NO 


Does EMV have anything to do with PCI Compliance? NO 

By now, you’ve certainly heard about the Europay/MasterCard/Visa (EMV) standard and a liability shift that’s slated for October 2015. 

However, there’s a lot of information out  there - much of it is just plain confusing. 

Let’s take a look at some of  the questions you may have about EMV, and separate the truth from the  misconceptions.

Q: What is EMV? 


A: EMV is a payment method in which an integrated  circuit chip (ICC) is embedded into a plastic card. The ICC replaces the  magnetic stripe on the card, holding the account number and other  sensitive data. It also contains the logic needed for transaction  processing and risk management. Point of sale equipment that  accommodates EMV payments has been gradually deployed in other parts of  the word over the past few years. 


Q: Why is EMV coming to the U.S. now, and what is the liability shift?


 A: The incidence of credit card fraud in the U.S. is  increasing and is far higher than in other parts of the world where EMV  has already taken hold. EMV supports enhanced identity verification  methods—either chip-and-PIN or chip-and-signature. Additionally, the  presence of the ICC within a credit or debit card makes it impossible to  duplicate. This year, U.S. card issuers began to step up the  distribution of cards with EMV chips in them. As for the liability shift, as of this coming October, the liability  for fraudulent transactions will be transferred from the card issuer to  the merchant if the merchant isn’t utilizing EMV technology. The  liability shift doesn’t apply to card-not-present (CNP) transactions,  and EMV doesn’t prevent fraudulent use of credit cards for these  transactions. 


Q: Must I implement EMV-compliant equipment, and will I be forced to pay higher interchange rates if I don’t do so?
 

A: Contrary to what some people believe, there’s no mandate,  and card networks will continue to charge the same interchange rates for  EMV and non-EMV transactions.  Merchants can deploy EMV-compliant  equipment at their own pace, if they follow that route at all. 


Q: Will EMV have any effect on credit card pre-authorization procedure?
 

A: Yes, the transaction flow of pre-authorization followed by a completion, for example restaurant addition of tip, may not work in its current form with EMV (Credit Card Platform Dependent). The reason for this is that the amount of the authorization must be known at the time the EMV transaction is  conducted, because the authorization amount is one of the data elements  used to generate the transaction cryptogram. We are exploring ways to  create a similar transaction experience, by completing a sale  transaction followed by an adjustment, to add things like tips. Contact your sales rep to see if your processor allows for a pre-authorization - then post authorization of a different amount.


Q: I already have end-to-end (E2E) encryption, so is it okay to skip EMV? 


A: Again, EMV is not a requirement. However, it can  play a key role in card security. Combining EMV with E2E encryption lets merchants avoid the liability shift and could possibly reduce their scope of  compliance with the Payment Card Industry Data Security Standard (PCI  DSS). 


Q: Doesn’t the liability shift mean cards with magnetic  stripes will no longer be issued and my existing POS equipment won’t  work once it takes effect? 


A: While it’s unclear how long cards with magnetic  stripes will continue to be issued, they aren’t going anywhere for the  foreseeable future. Canadian banks are still issuing magnetic stripe  cards—and Canada switched to EMV five years ago. What’s more, card  brands and issuers will almost certainly give merchants sufficient  notice if they decide to stop issuing cards with magnetic stripe  capabilities. So yes, your existing POS equipment will still work  following the liability shift. 


Q: Shouldn’t I just get an EMV-ready terminal that is separate from my point of sale hardware? 


A: No. This will invalidate the functionality of  your point of sale system. And remember—there are two types of EMV  equipment: “EMV-ready” and “EMV-certified.” “EMV-ready” equipment simply has a slot into which consumers insert their chip cards to make  payments. “EMV-certified” indicates that the hardware, payment application and device software have been certified to work best with  specific payment processors and point of sale solutions. Contact our sales office to determine which devices will work best with your system and satisfy your business needs. 


Q: What types of business have the highest risk? 


A:  History has shown that thieves target large ticket items. These items are easily resold and usually harder to trace. Typically they are not going to sit in a restaurant risking that a card will be declined drawing attention. Also cards  usually get flagged after a couple of transactions so they look to maximize the amount stolen on the first transaction. The idea of grappling with EMV and the liability shift may be  daunting, but it doesn’t have to be. Consider all sides of the issue before making any EMV-related decisions, and call on our experts to point you in the right direction..
 


More and more people are receiving new credit cards with microchips in them. Here’s everything you need to know.  


Thursday October, 1st, 2015 marks a milestone in the effort to shift  the U.S. to the use of microchip-embedded credit cards, a more secure  alternative to traditional cards that require the swipe of a magnetic  stripe. But not to worry if your new chip-enabled card has yet to arrive in  the mail. The October deadline is more a call to action for retailers  than a cutoff, electronic payment experts say. “That’s the date by which if a merchant doesn’t have a chip terminal,  and a counterfeit card is used at that location, they may be liable for  that fraud on that transaction,” says Stephanie Ericksen, vice  president risk products, for Visa. But “we know, based on experience in  other countries, it takes several years to get to critical mass. So  we’re seeing Oct. 1 as more of a kickoff toward increasing the momentum  toward chip. People will still be able to use their (cards with)  magnetic stripes.” Chip, or “EMV,” cards are more secure than those with just a magnetic  stripe because they produce a unique code for each transaction, making  them harder to counterfeit and preventing the card from being used for  future fraudulent purchases. 


A huge job to switch The electronic payment industry has long called for adoption of such technology, but a series of high-profile data breaches at companies such as Target and others have underscored the need for more consumer protections.         

Still, getting tens of millions of new cards in the hands of  consumers, and then making sure millions of merchants can process them  is a mammoth undertaking. Ericksen says that for nations like Australia,  Brazil and Canada, it took two to three years to get to the point that  more than 60% to 70% of the transaction volume was being made with chip  cards, and four to five years to bump that up to more than 90%. “The  U.S. is a much larger market,” she says. The Strawhecker Group (TSG), a management consulting company for the  payments industry, found in a recent survey that just 27% of merchants  in the U.S. will be able to process chip-enabled cards by Oct. 1, down  from the 34% that was predicted in March. “EMV adoption has been slower relative to other countries due to the  number of moving parts involved in making this transition,” Mike  Strawhecker, principal at TSG, said in an emailed statement. “For  example, there are thousands of banks that need to issue new cards to  millions of consumers, millions of merchants that need to get their  technology upgraded and staffs trained, as well as thousands of  technology providers making changes to their infrastructures and  offerings.” 


Retailers are not happy 


But Mallory Duncan, general counsel and senior vice president of the  National Retail Federation, says that many of the group’s members are  “disappointed” that they are being required to spend what will amount to  a cumulative $30 billion to $35 billion on the implementation of new  chip readers, though banks and card companies generally have opted for  the less-secure option of chip cards that require a signature, rather  than a pin. In the U.S., many of the new chip-enabled credit cards  require a signature only, and not a PIN. “We’re a little bit between a rock and a hard place,” Duncan says of  the Oct. 1 liability shift. “We’re taking a baby step in order for the  banks to save money, so that’s the concern. … If you’re really serious  about reducing fraud, we’ve known for years that pins greatly reduce  fraud.” Many retailers are instead implementing other systems that they feel  will be more effective in blocking hacking. “They will install the  chip-reading equipment,” Duncan says, “but it’s less of a priority.” Still, Ericksen says there’s been a great deal of progress. “We’re  very encouraged by what we’re seeing so far,” she says. “We’re exactly  where we expected to be. … It’s a lot of infrastructure to upgrade.” As of Sept 15, more than 314,000 merchant locations in the U.S. were  enabled to process chip cards, vs. 55,000 as of last September, Ericksen  said in a briefing on the eve of the liability shift. Visa has also  dramatically increased the number of chip-enabled cards that it has in  the market, going from roughly 20 million at the end of August 2014, to  151.8 million as of mid-September. That represents roughly 21% of all  Visa credit and debit cards in the U.S. Also, the Payments Security Task Force says that roughly 60% of all  cards from top issuers will be converted to chip by the end of this  year, going to 98% by the end of 2017. Meanwhile, 40% of terminals are  expected to be chip enabled by the end of 2015, according to the task  force.         


Effect on consumers As chip cards, and retailers that can accept them, become ubiquitous,  consumers will need to get used to changes at the cash register. “I think there will be a learning curve for consumers … because it’s a  big change in using something that we’ve been using the same way for  decades,” says Matt Schulz, senior industry analyst for CreditCards.com.  “It’s not hard. It’s just different. … Instead of swiping the card, you  insert the card into the terminal and the card stays in there while you  complete the transaction, whether it’s signing or entering in a pin.  And when the transaction is done, you take the card out of the terminal  and go about your business.” That change, Schulz says, is of concern to some retailers. “Confusion  about the use of the new cards is going to make lines longer during the  holiday shopping season because the customer might be confused about  how it works,” he says of what some merchants fear. “The employee at the  checkout counter might be confused. And you add it all up and you could  end up with some frustrated customers.” 


Big retailers lead the way 


Big retailers have been on the leading edge of the transition.  Walmart, for instance, was able to accept chip-enabled cards at all of  its locations as of Nov. 1, 2014. “We’ve been a leader in pushing for payments that offer more security  … and EMV technology does that,” says Walmart spokesman Randy Hargrove.  Merchants need special credit card machines capable of reading a micro chip credit card. (Photo: Visa)  But among smaller businesses, there’s more urgency for certain  retailers, like jewelry shops, to have updated their technology in time  for the October liability shift, than, say, a neighborhood deli that has  low-value transactions and repeat customers. “We want all merchants to move to EMV as quickly as possible because  it adds to security … but most card fraud occurs at electronic stores,  (and) high-end luxury retailers where criminals want to use counterfeit  cards,” Ericksen says. “If you’re a local coffee shop or nail salon,  that’s not typically the place we see a lot of counterfeit fraud.” Major retailers like Target, Walgreens and Costco have begun  accepting microchip-enabled cards, also known as EMV cards — short for  Europay, MasterCard and Visa, the companies ushering in the change. But  many independent merchants and smaller chains including have been slow  to implement the change because of the cost and volume of machines that  need updating.   “Despite our significant effort and planning,  the state of the industry is such that many software vendors are not  ready for the transition. Many retailers across the country are like  us.” Tara Deering-Hansen, Hy-Vee supermarkets   “We began readying our stores to accept chip-enabled credit cards a  couple of years ago when we replaced PIN pads with EMV-capable terminals  at checkout lanes,” said Tara Deering-Hansen, Hy-Vee spokeswoman. The  supermarket chain has more than 230 stores in eight states, including  Iowa. “Despite our significant effort and planning, the state of the  industry is such that many software vendors are not ready for the  transition,” she said. “Many retailers across the country are like us  and they’re waiting for their vendor partners to provide the software  needed to communicate with already installed EMV card readers.” Hy-Vee had hoped to make the transition by Oct. 1, but the company  now predicts the technology will be available in its stores shortly  after the first of the year. Banks also have been slow to replace customers’ magnetic stripe cards  with the new microchip-enabled cards. A CreditCard.com survey completed  in early September found that 60% of Americans had yet to receive the  new chip cards. The deadline doesn’t change much for credit-card users, who still are not liable for credit-card fraud. And don’t worry if you don’t have one of the new cards. Even  retailers with updated technology will continue to accept both versions  of credit and debit cards for the foreseeable future. “There’s no demand that a consumer or a merchant would need to have a  chip card or the chip technology on Oct. 1,” said Patrick Dix,  spokesman for payment-processor Shazam. “For the consumer card holder,  there’s really no change.” The cards are an important move toward better credit card security,  said Doug Jacobson, director of Iowa State University’s Information  Assurance Center. But the current change is only the beginning. “The first step is kind of a baby step and doesn’t buy us a lot,”  said Jacobson, who is also a professor in the university’s electrical  and computer engineering department.   That’s because most chip credit card users still will sign for  purchases. The ultimate goal is to move toward widespread use of  chip-and-PIN credit and debit cards as is the case in much of Europe. The chip cards have better built-in defenses against fraud that make  them much more difficult to duplicate than the ubiquitous magnetic  stripe cards, Jacobson said. “Today, with about $50 worth of equipment, I could copy your magnetic stripe and start replicating cards,” he said. With chip cards, account numbers and expiration dates aren’t actually  transmitted between customer and merchant. The chips create a one-time  code to fund transactions — information that would be useless to a thief  trying to replicate cards. Jacobson expects that American consumers and businesses will need years to fully migrate to the new cards. “We’re a giant credit-card market, and there are a lot of cards that  have to be replaced,” he said. “I don’t know how many credit cards the  average American has, but it isn’t one.” Many credit-card issuers are like Des Moines-based Bankers Trust, which started a slow roll-out of chip credit cards in August. Existing credit customers will receive chip cards as their old  magnetic stripe cards expire or upon request. Debit cards won’t be  updated until next year, said Stephen Sladek, the bank’s commercial  banking product manager. Sladek says massive data breaches have made customers pay more  attention to account security issues. And even after adoption of EMV  technology, customers still will need to monitor their accounts closely.   “It’s not 100% foolproof. It’s not going to stop 100% of fraud.”Stephen Sladek, Bankers Trust, Des Moines   Online purchases won’t rely on the technology, for instance. The new cards cost at least twice as much as the magnetic stripe  cards, said Doug Gulling, chief financial officer of West Des Moines,  Iowa-based West Bank. And less than 20% of small retailers have adopted the new technology, said Jim Henter, president of the Iowa Retail Federation. “Many of the larger retailers are up and running, but some of the  smaller ones have a lot of integration issues to deal with,” he said.  “It’s a work in progress.” Ellen Martinson, who owns jewelry boutique Leona Ruby in Des Moines’  East Village neighborhood, got her new payment terminal last week and  started using it right away. She said the transition was painless  because it is not integrated into a POS system. It’s a completely  standalone unit that just plugs into a phone line. “There was not a cost for us. Our payment process company called and  said they needed to swap out our terminal or we could be liable for  fraudulent charges,” she said. “It took about 30 minutes, and we were up  and running.” Casey’s, the Ankeny, Iowa-based convenience store chain with about  1,850 stores in 14 states, has equipped all of its stores with the  equipment needed to handle the new technology. “But it’s not up and running,” said Bill Walljasper, senior vice  president and chief financial officer. Terminals inside the stores will  become functional next year, and the ones at the fuel pumps will be  activated in 2017, he said. “The benefit is to customers who can be more confident in using their cards,” he said. 

How the chip cards work

As U.S. merchants begin transitioning to chip-card readers, consumers will notice the payment process works a little differently. Not all  devices will look the same, but the steps are nearly identical. 1. Insert your credit card into the front of the card reader with the chip facing up rather than swiping it. 2. Keep it in the card reader and follow the prompts on the screen until your transaction is complete. 3. Remove the card. If a signature is required, just sign the receipt and you are done. The chip card still will have a magnetic stripe for use at  traditional machines. The new cards allow the transfer of card  information over a small chip, rather than the magnetic strip. The chips  are considered safer because they don’t pass out account information.  Instead, they transmit a one-time encrypted code to finance transaction.

Does my Business NEED EMV?

Specialty Retail Stores

image176

All Specialty Retail and Restaurant businesses are susceptible to fraudsters. More often, these businesses become the "test bed" for a fraudster to test a stolen credit card. 

High End Retail

image177

If your average sales are "High Dollar" items and you are not EMV compliant - you are a dream come true for a fraudster. Your business type could be an easy target!

Designer Stores

image178

You are exactly like the High End Retailers. If your average sales are "Large Ticket Items" and you are not EMV compliant - you are a dream come true for a fraudster. 

Quick-Service Restaurants

image179

Your business type is probably the highest at risk for fraudsters next to purely 100% online sales type of businesses. 


Here's why! 


Most QSR Restaurants do not typically check ID, and it's such a small line item on someone's monthly statement - they most likely won't even catch it unless that consumer is really tracking every single transaction - every single day. Probably like you and I. And one unfightable chargeback could lead to 100's. FAST!


Not having an EMV solution leaves your business WIDE OPEN for an easy chargeback and again - a perfect test bed for fraudster. 

Dine-In Restaurants of ALL Sizes

image180

Over the past few years - since the "shift in liability" (October 1, 2015) by EMVCo. Your business has most likely seen an increase in bank initiated chargebacks as well as fraudster activity. We get calls from clients that have not yet upgraded, that didn't even know what a chargeback was... Well, unfortunately - they do now and they have now since upgraded to an EMV solution. 


Your business type is perfect for a "night on the town" with a large ticket and probably a very generous tip as well. 


Only to find out that you swiped the credit card instead of "dipped it" - or inserted it into an EMV - chip reader and you are looking at multiple chargebacks - that you will most definitely - not win.