Eight things retailers need to know about EMV
Through a special arrangement, presented here for discussion is an excerpt of a current article from Commerce Anywhere Blog.
If you’ve received a new card from your bank in the last six months, it is likely an EMV card with a chip. Banks are issuing EMV cards and retailers are installing EMV-capable terminals. Both are working toward the October 2015 deadline whereby a liability shift occurs.
Today, when a counterfeit card is used in a store, the bank takes the loss. In October, if the bank has issued an EMV card but the retailer has not upgraded to an EMV terminal, the retailer takes the loss resulting from counterfeit cards.
But there are many other nuances with the EMV migration. Below are eight aspects every retailer should know:
1. If you’re not already testing EMV-capable terminals, you’re behind. But you’re not alone as many retailers are questioning the cost of upgrading terminals. The rollout in the UK and Canada took several years.
2. The EMV specifications allow several methods for cardholder validation: online PIN, offline PIN, signature, and none (for low value transactions like vending machines). The issuing bank decides which method to use. The card brands are recommending online PIN, but many banks have chosen signature which is much less secure. Only Mexico and Brazil continue to use signatures.
3. The chip in the EMV cards is really aimed at preventing counterfeit cards but it does nothing to help with other types of fraud. Retailers are still not responsible for stolen card usage.
4. The EMV specification supports both contact and contactless (NFC) cards with some cards supporting both. As mobile payments mature, it’s likely that contactless gains popularity so it’s probably worth the investment in terminals that support NFC.
5. New EMV cards will continue to have a mag-stripe for several years as terminals are upgraded. If a consumer tries to swipe an EMV card in an EMV-capable terminal, the terminal will ask them to insert instead. Expects slower lines as consumers learn this.
6. When a card is inserted, it must be left until the transaction completes. Cashiers must educate consumers to leave the card during the transaction, but not forget the card when complete.
7. Initially fraud won’t decrease. Instead, card-present fraud in stores will migrate to card-not-present fraud online.
8. Account numbers are not encrypted. Each transaction gets a unique cryptogram that ensures the card is not counterfeit, but otherwise the account number and associated data travel the same path we’re used to. Put another way, EMV cards and terminals would not have prevented recent thefts at large retailers. But it does make it harder to use the stolen account numbers, because EMV cards can’t be counterfeited and used in stores.
Discussion Questions
What challenges do you see with the rollout of EMV-capable terminals? What may go wrong? How should store operations be preparing?
Anything that you have to “teach” the consumer that the consumer doesn’t already want to learn will be painful to execute in the market. We never learned how to set the time function on our VCRs (LOL). However, we can do everything social on our smartphones that requires more training than landing on the moon. The EMV implementation will take some time, and it will slow down the checkout process for the foreseeable future.
The biggest challenge for the EMV rollout is consumers. Consumers will need to be educated on how to use the new cards. This will slow lines and cause frustration as consumers forget to leave their cards in the machines until transactions are complete and/or forget their pin codes. Retailers need to prep their employees to help guide transactions.
While they are upgrading their terminals, retailers should be preparing for full NFC. Look for Apple to lead the way with Apple Pay.
It’s a new payment world out there and retailers need to lead, not follow.
I am always surprised to see U.S. retailers in Canada still not on the EMV system. Frankly, it is far more convenient for me as a consumer because I don’t need to pick up a pen and sign something, never mind the tap and pay which is super awesome.
Security and fraud are evolutionary. We need to keep improving security before fraud increases to cause significant damage.
I like the banks’ strategy on pressuring the retailers to switch. If they don’t, it will probably take 20 years before they do.
I have run into a couple of these already and they still produce a piece of paper I have to sign. Perhaps as it rolls out the European system will be available. But why is it taking so long? The European system has been in effect 10 or more years.
One of the challenges is simply money, as the retailers must upgrade or risk losing more business. I just spent thousands a few years back on new terminals, and now we have to do it again. Small business will have to comply, so there isn’t much we can do about it. The other is what do we go with, as more companies including Samsung Pay now want in. These systems must have the ability to upgrade smoothly and be able to add on new payment systems without adding even more expense. I honestly know very little about all of this, but the banks that issue the new cards need to help out in making sure the customers can go through a simple online tutorial on how to use the new chip card transaction when they go shopping, and we will do our part as well.
The view from Canada … relax! This was rolled out here a couple of years ago and the feared slowdowns and frustrations never materialized. In the end, this is better for both consumers and retailers. You never know, maybe when the U.S. sees this goes smoothly, they’ll finally adopt the metric system too. 🙂
Fine and dandy. I’ve got a couple EMV cards (chip-and-sig) already. But will I ever be able to get a chip-and-pin, for crying out loud? Self-serve gas stations and other kiosk transactions outside the US are rather complicated.
“Cashiers must educate consumers…” This.
The EMV chipped credit and debit cards offer improved security for in-store transactions, especially where the terminals and payment system employ end-to-end PCI encryption.
Retailers will need to invest in the terminals along with new software, testing, rollout and employee training to get this right. I’ve heard estimates that up to half won’t be ready in time for the Oct. 1 soft deadline. That’s why the latest cards need both the new chip and the old mag-stripe.
EMV-ready cards offer no security improvement for online transactions, however. Payments using wireless devices and card readers like Square may remain points of vulnerability too. And card numbers and shopper information stored in corporate databases remain no less vulnerable to hackers.
EMV is a step in the right direction, however, and it will require determined effort to make it happen on time. Shoppers may be slightly slowed at the checkout, but most will recognize it as a tangible effort by retailers to protect their credit card numbers from the bad guys.
This technology is not getting the attention it needs from retailers to survive for the long term. The different methodologies and user requirements make it clumsy annoying from the consumer perspective. Security is a combination of hardware, software and file structure working together to keep others out. The best security for the future is in the rollout of IP 8 or higher. Our military is holding back IP 6 for their own “security” needs. This is a case of more is better for everyone and our government knows this but won’t let go.
I’m really disappointed the U.S. banking system is not going for the pin-based system used elsewhere. It is easier and safer than signatures. I know retailers are in support of pins: Maybe that would make all of them a bit more eager to make the switch to EMV (which nobody but Walmart has turned on as far as chains go).
I am also disappointed the U.S. banks are, as chip cards are being rolled out, discontinuing the contactless option that was previously on their cards. I have had my contactless feature taken from my Chase Freedom Cards and my Citi Dividend Cards as the new chip cards have been sent. Why is this happening? Part of the requirement as part of the EMV switch is contactless terminals at retailers. Why are U.S. banks discontinuing the contactless cards now when more contactless terminals are being installed?
Also this increased push on signatures is forcing U.S. retailers to have to waste a lot more money on new pinpads than retailers elsewhere who have made this switch to EMV. The pinpads in use up in Canada are about three inches by five inches with a tiny screen, tiny keyboard, etc. They allow you to “tap, swipe, or insert” your card. No fancy graphics and nowhere to “sign the screen” but they are durable, cheap, don’t take much space on the counter and get the job done.
I feel like the card-issuing banks, by not doing the PIN system, are taking away key benefits to the EMV system to a major stakeholder in all this: the retailer.