The EMV 101 series provides go-to-resources for those who are interested in learning more about EMV payment technology and EMV migration in the U.S. This is the third entry to this series that explores who will be affected by the U.S. EMV migration, and how they can best prepare for the shift.
With the 2015 liability shift quickly approaching and the recent spike in data breaches, EMV chip cards have gained heightened attention with everyday consumers. Since the U.S. is one of the last developed countries to migrate to EMV technology, many are wondering why it has taken so long.
The original reason chip cards were first implemented in Europe was because of the unreliability of the Internet to conduct real-time verification of transactions – so much of the decision process was built into the card. At the time, the U.S. didn’t face these same challenges so the payment technology continued to be predominately magnetic stripe cards with online verification per transaction.
Now that EMV chip technology has proven to help dramatically reduce card-present fraud along with the liability shift and data breaches, the U.S. is quickly migrating. As this transition begins, it is important to understand who will be affected and how their behavior or business strategies will need to evolve. Below we have outlined the top key players in the U.S. EMV migration.
Key Player: The Cardholder
There is no doubt that after the EMV migration, the way consumers physically use their payment cards will be different. And, as consumers begin to receive their new EMV chip cards in the mail to replace their current magnetic stripe cards, it will be critical for issuers to educate their cardholders on how to use them at point-of-sale (POS) terminals.
Not all smart cards are the same; but they can be easily categorized into three main groups — contact cards, contactless cards and dual interface cards. With contact chip cards, the chip is embedded into the card, under a metallic contact plate which is physically visible. Instead of swiping, contact chip cards are inserted into the POS terminal for the duration of the transaction. The cardholder will typically be required to verify their identity one of two ways: by entering in a PIN number, which must be memorized, or by providing a signature.
With contactless chip cards, the chip is embedded into the card but is not physically visible. Contactless chip cards are tapped or waved over or near a receptor space marked on the POS terminal to complete the transaction, which only takes a moment. Cardholders might be required to verify identity by entering their signature for contactless chip transactions.
Dual interface cards include both contact and contactless technologies and can therefore be used to complete transactions through either inserting the card or waving the card over the POS terminal. Not all card programs will require that their cardholders use a PIN to verify their identity, but in terms of overall security, PIN verification is the best practice and the most secure way of using this technology.
Key Player: The Merchant
Merchants are going to need to upgrade their POS terminals to meet EMV specifications, and back-end systems must be updated and certified to be able to accept payments from the new cards. Employees will also need to be trained on how to use the new technology to ensure they are able to help customers complete their payment transaction
Key Player: The Card Issuer
Financial card issuers are vital to a smooth EMV migration. Throughout the entire migration process, educating cardholders and merchant clients about the EMV system and its standards will fall largely on issuers’ shoulders. Becoming well versed in EMV specifications and migration education strategies will be an advantage for issuers.
EMV will not only change the way we physically use cards; it will change the way card programs run behind the scenes. Each step in the payment process—from a card starting out as a plain piece of plastic, to being a list of successful transactions on a statement—will include new security features and processes. For each of those steps, issuers will need to evaluate their current technologies and infrastructures, and invest in the necessary upgrades including hardware and software to manage the chip card personalization, issuance, delivery and operational processes.
Key Player: The Industry Payment Network
The major U.S. payment networks (Visa, MasterCard, American Express and Discover) are the main drivers of the EMV migration. Europay (since acquired by MasterCard), MasterCard, and Visa jointly conceived the EMV specification, and have played major roles in EMV migrations all over the world. The payment networks partner with many players throughout the U.S. payment ecosystem, and therefore are the ultimate champions of interoperability and cooperation. Their wide influence makes them the go-to leaders in this large national migration push.
Key Players: The Acquirer & Payment Processor
The EMV migration in the U.S. means that the entire industry is taking some time to evaluate their current payment processing and authentication infrastructures in order to make plans and upgrades for meeting EMV specifications. Because the market is on the cusp of a major transition, industry leaders like Visa and MasterCard are spearheading efforts that can make the payment ecosystem even more secure, on top of the security benefits that will come with EMV implementation.
One example of this is the possible implementation of tokenization technologies alongside EMV upgrades. Tokenization is a practice that removes important cardholder data (i.e. the PAN) from the servers of retailers, while still allowing them to access it if required (for a return, or a subscription). Tokenization removes the incentive for hackers to steal card information in the thousands from retailers, because the tokenized data which the hacker might capture would be meaningless to them.
Updating the U.S. payment system infrastructure to support EMV will take time, investment, and careful planning. It involves many different players within the payments ecosystem and will require a change in behaviors, processes and business strategies. Full migration won’t happen overnight, but it is the first step in strengthening the security of payments in the U.S.
The EMV Migration Forum is a great resource for additional information and is dedicated to providing education to all ecosystem players.