You’ve probably been hearing about EMV, or the transition to payment cards embedded with electronic chips, for a long time. In October 2015, the rollout of EMV in the U.S. reached a major milestone. This is when liability for fraudulent payments shifted to non-EMV merchants who are unable to process transactions when a chip card is presented for payment. This liability shift could have a major impact on businesses (both large and small) that are unprepared.
What is EMV?
EMV is one of the biggest changes to happen in the payments world in a long time. EMV, commonly referred to as “chip cards,” is a series of specifications that define a more secure method of payment. It was developed jointly by Europay, MasterCard and Visa in the mid-1990s, companies that also contributed to the name: E (Europay), M (MasterCard) and V (Visa).
EMV is a standard used worldwide to combat massive data breaches and widespread fraud. For merchants to utilize chip cards, new internal processing systems and credit card readers must be installed in-store. Additionally, all rules surrounding the October 2015 liability shift must be complied with.
How does EMV work?
EMV introduces a small computer or "chip" to every payments device. This chip stores information, performs processing and contains secure keys that generate cryptographic data. Dynamic data is generated with each transaction, making it nearly impossible to create counterfeit cards or replay intercepted transactions. This is in contrast to traditional swipe cards, which contain unchanging data in their magnetic stripes.
When an individual steals data on a magnetic stripe on a traditional swipe card, they are able to re-use it again and again because it contains the same information. However, with chip cards, the data is different every time it is used, meaning it cannot be replicated. While EMV cannot completely do away with data breaches, it can stop thieves from running off with and profiting from sensitive customer data.
What are the benefits of chip cards?
Chip cards are designed to protect against counterfeit fraud through authentication of dynamic data generated by chip cards, smart phones, and other EMV-compliant devices. They also provide risk management parameters at the card level and when used with PIN, can offer protection against lost and stolen card fraud.
Since the widespread adoption of EMV in the United States, counterfeit fraud rates have decreased, according to MasterCard and Visa. In September 2016, MasterCard reported a 54 percent decrease in counterfeit fraud costs during the period of April 2015 to April 2016 for U.S. merchants who have adopted EMV technology in their stores. In comparison, U.S. merchants that had not or had just adopted chip card processing, counterfeit fraud costs had increased 77 percent year-over-year.
Similarly, in a study by Visa published in June 2016, the company reported that counterfeit fraud had decreased by 35 percent for chip-enabled merchants during the period of June 2015 to June 2016.
How does this affect my business?
As of October 1, 2015, if a customer presents a chip card for payment to a non-EMV merchant and is unable to process that transaction using EMV, that merchant may be liable for any fraud that occurs that merchant may be liable for any fraud that occurs that could have been prevented through a chip-enabled point-of-sale. This is done to encourage the quick adoption of EMV technology in stores.
Following the shift, liability for fraudulent payments has been muddied a bit, especially when it comes to fallback transactions. When a customer attempts to use a chip card at a chip-enabled POS but is unable to due to a malfunctioning reader or card, they must “fallback” to the magnetic stripe on their card. If the fallback is properly authorized and identified online, the issuer will assume liability. Otherwise, the merchant may be held responsible. Understanding fraud liability can be confusing, but you can shine a light on the subject through our Navigating the EMV Liability Shift flowchart.
Additionally, your business may will be affected through the installation of new technology.B Because chip cards require dynamic authentication, an EMV capable terminal is required with a special reader designed for chip cards. Vantiv offers a variety of POS terminals with EMV chip cards in mind.
What changes during checkout with an EMV terminal?
Using a chip card at check-out isn’t that much different than a traditional magnetic swipe card. At the point of sale, there are two main changes:
Instead of swiping the card, the customer will insert the card into the reader
The card will remain in the reader for the duration of the transaction
The process is called “card dipping.” During the dip, data is transferred from the card chip to the issuer in order to both verify the legitimacy of the card and generate unique transaction information. The process takes a bit more time than simple swiping, and the customer will be prompted to remove their card when the process has completed.
While EMV transactions may be more time-consuming than swipe cards, as the technology improves, the duration of transactions will likely decrease.
So there’s no more swiping?
Instead of a quick swipe, chip cards will remain in the EMV reader for the entire length of the transaction. Customers who are unfamiliar with the new process may insert the card and then immediately try to remove it from the reader, or they may forget that their card is in the reader and leave it behind. Merchants should be prepared for a potential jump in the number of cards left behind by customers.
Can EMV cards only be “dipped”?
Not necessarily. Some chip cards come equipped with near-field communication (NFC) compatibility, which is the same technology used for mobile payment systems like Apple Pay and Android Pay. Instead of dipping, these cards can be tapped onto POS terminals to complete purchases.
EMV cards that support both dipping and tapping are referred to as “dual interface cards.” Internationally, there is a push to create more dual interface cards, but in the United States, the move has been much slower. Currently, not many American issuers are providing cardholders with dual interface cards, but given the speed at which individuals can make purchases by tapping, both merchants and customers can expect to see a bigger push for NFC-enabled cards in the future.
How can I reduce the number of cards forgotten in the terminal?
Consider techniques such as not printing the cardholder’s receipt until after the card has been removed from the card reader. Another option is to program the terminal to produce an audible beep when the card should be removed. Training your employees on this new process is perhaps the most critical element for reducing the number of forgotten cards.
Will customers with magnetic stripe cards be able to use EMV terminals?
Yes, EMV terminals also have a magnetic stripe card reader. For now, credit and debit cards will be issued with a chip on the front of the card and the familiar magnetic stripe on the back of the card so that chip cards can be backwards compatible with non-EMV capable devices.
Will the magnetic stripe reader eventually be removed from EMV terminals?
For the foreseeable future, magnetic stripe readers will continue to be a feature on EMV terminals. This will allow EMV terminals to process transactions from the large base of magnetic stripe cards in the market and support fallback transactions.
Do EMV transactions take longer to authorize than magnetic stripe transactions?
As mentioned above, customers and merchants may perceive EMV transactions as more time-consuming than traditional swipe cards. However, EMV transaction times are dependent on how the issuer personalized the card and how your business configured your terminal. If the card and terminal are properly “tuned," the transaction time should be close to what you experience today.
Does EMV require a PIN be entered on credit as well as debit transactions?
There is no PIN requirement with the U.S. implementation of the chip on credit transactions. The issuer will determine if a PIN is required.
How does EMV affect the price I pay for accepting card payments?
Interchange, which represents the biggest bulk of fees you pay for accepting card payments, is not affected by EMV.
Does the adoption of EMV eliminate the need for end-to-end encryption or tokenization?
No. EMV does not encrypt all of the transaction data (including the personal account number), so end-to-end encryption and tokenization are still valuable tools in securing payment data.
Does EMV apply to online payments as well?
Online payments are currently not in the scope of EMV because there is no card-terminal interaction, so no cryptogram is created. However, the industry is exploring options for using EMV features in online payment environments. Customers will be able to use their chip cards for online payments as they do now.
How do chip cards work with tablet-based POS systems?
To make chip cards work on tablet-based POS systems, a wired or wireless PIN pad (WPP) that can read chip cards is required. Additionally, NFC (Near Field Communication) for wireless will need to be activated on the tablet.