The summer news was hot: Visa announced initiatives to hasten EMV migration in the United States. Interestingly, while the U.S has been one of the last EMV holdouts in the Western world, Visa’s announcement seems to have been driven as much by the need for a suitable mobile payments infrastructure as by security concerns. The costs associated with EMV migration will, to some extent, be offset by NFC-based mobile communications opportunities, which will require the same EMV-compatible infrastructure.
Though the U.S is unique in its card carrying population, size and retail payments players, there are some lessons learned in Canada, Europe and other countries that can be useful to ISOs and merchants in the U.S.
Visa’s announcement introduced new directives carving a clear path to full EMV adoption by 2015. Three initiatives were announced:
Visa will require U.S. acquirer processors and sub-processor service providers to support merchant acceptance of chip transactions by April 1, 2013.
Beginning October 1, 2012, Visa will expand its Technology Innovation Program (TIP), eliminating the requirement for merchants to validate compliance with PCI DSS for any year in which at least 75% of its Visa transactions are processed on chip-enabled terminals. To qualify, terminals must support both contact and contactless chip acceptance, as well as NFC-based mobile contactless payments.
A liability shift will gradually take place starting on October 1, 2015. As Visa’s announcement states, “Currently, POS counterfeit fraud is largely absorbed by card issuers. With the liability shift, if a contact chip card is presented to a merchant that has not adopted, at minimum, contact chip terminals, l ability for counterfeit fraud may shift to the merchant's acquirer.”
The Case for EMV in the U.S.
The EMV or ‘chip and PIN’ standard has been adopted in parts of Europe, Canada, the U.K., the Carribean and Asia-Pacific. Worldwide, chip cards represent 36% of all cards in use, and 65% of terminals are EMV-enabled. EMV-enabled cards rely on an embedded chip and PIN number, rather than the traditional magnetic stripe and signature. This strategy reduces the vulnerability of cardholder data when making purchases, preventing ‘skimming’ or copying card data embedded in a card’s magstripe. EMV provides a secure, common platform for debit and credit card processing, ensuring global interoperability.
How successful is EMV in reducing fraud? In Canada, processor Moneris Solutions released data in 2009 that confirmed a reduction in fraud with chip card use. Among its findings: “merchants who processed greater than 40 per cent of total transactions using chip technology experience on average, up to four times fewer chargebacks than those who processed less than 40 per cent of total transactions using chip technology.” In France, total fraud losses dropped by 50 percent and card counterfeiting by 78 percent in the first year after EMV smart cards were introduced. Public perception of chip cards as a more secure alternative has strengthened, with 80% of Canadian credit card holders preferring chip technology to magnetic stripe. In the U.K., EMV has been successful enough that 96% of merchants that have implemented chip and PIN payments would recommend it to other retailers.
Given the success of EMV in reducing global fraud costs, why did the U.S. resist migration until 2011? The reluctance to adopt EMV has been mostly due to cost – replacing cards is pegged at nearly $3 billion, and replacing payment terminals will cost merchants more than $2.5 billion collectively. For an industry severely impacted by economic downturns in recent years, these are difficult costs for merchants. However, fraud losses in the U.S. have grown to more than $2.5 billion for issuers alone, with additional losses borne by merchants. As one of the last remaining non-EMV markets, the U.S. has been increasingly vulnerable to fraudsters, driving up losses and improving the business case for EMV adoption.
As Visa’s summer announcement makes clear, reducing fraud was not the only motive for EMV adoption in the U.S. As a late adopter with a unique retail payments market and large population, motives for EMV adoption may have been slightly different for the U.S. Key among these is mobile payments. Demand for NFC-based mobile payments is growing, and EMV’s secure infrastructure is a requirement. As a later adopter, interoperability also became a growing concern for the U.S., as the rest of the world gradually abandons the magstripe. U.S. travelers have been increasingly frustrated as their cards are no longer accepted in many countries – in Europe for example, 81 percent of cards, 89 percent of POS terminals and 96 percent of automatic teller machines (ATMs) are EMV-compliant, and the European Central Bank has signaled that magstripe cards will be eliminated after 2012.
EMV in the U.S. Market
While the U.S. retail payments is unique in many respects, the experience of countries such as Canada, France, and the UK may provide some clues as to the way forward for the U.S. While decreased fraud is a key expected result, there are other lessons learned that may help ISOs in the U.S. to prepare for this transition. Key considerations for ISOs as EMV migration begins include:
Show Merchants the Business Case
The potential elimination of yearly PCI DSS audits and validation can in many cases offset the cost of upgrading to new terminals. For ATM operators, many existing ATMs can be retrofitted with the new card reader and a software upgrade, making the transition less costly than complete replacement. With merchants bearing a multibillion dollar share of fraud losses in the U.S.., the prospect of lower fraud should be a key driver for merchants to do their part.
Work with EMV Experienced Vendors
ISOs should start reviewing the offerings of terminal vendors in preparation for EMV migration. Review Visa’s terminal requirements to ensure that the vendor’s offerings will position the merchant for future elimination of PCI DSS requirements, including NFC-based mobile contactless payments. Look for transaction processors with an EMV solution offering which includes and EMV compliant terminal.
Watch Developments in Mobile Payments
Visa’s announcement will spur a dual drive towards EMV and NFC-based mobile payments. Mobile payments include transactions conducted from a mobile phone, but also from other mobile devices, such as tablets. It includes using the device as a consumer to enhance or conduct a transaction at the point-of-sale, or as a merchant to replace a traditional POS device. All of these possibilities will move closer to mainstream reality as Visa’s initiatives take hold, and your role, as the merchant’s trusted advisor, will be to stay abreast of these developments and of the vendors working on solutions.
Expect Bumps in the Road
Migrating to a new payment infrastructure will not be without its trials. Merchants and their service providers will face technical challenges as they roll out and test new payment terminals and ATMs. The EMV specification will require the POS device/applications and host system to undergo more intensive end-to-end testing to accommodate a wider range of possible processing scenarios. In this, too, ISOs should look to find counterparts in EMV experienced countries like Canada, to share their knowledge.