August 30, 2011

Earlier this month, Visa unveiled plans to accelerate the migration to EMV contact and contactless chip technology in the United States. EMV refers to the Europay MasterCard Visa chip-card standard widely used in Europe and elsewhere, but not to any significant degree in the U.S. The adoption of dual-interface chip technology will help prepare the U.S. payment infrastructure for the arrival of near-field-communication (NFC) mobile payments by building the necessary infrastructure to accept and process chip transactions that support either a signature or PIN at the point of sale, according to Visa.

“By encouraging investments in EMV contact and contactless chip technology, we will speed up the adoption of mobile payments as well as improve international interoperability and security,” said Jim McCarthy, Visa’s global head of product, in a statement. “As NFC mobile payments and other chip-based emerging technologies are poised to take off in the coming years, we are taking steps today to create a commercial framework that will support growth opportunities and create value for all participants in the payment chain.”

 

“The challenge in the United States for adoption of chip and PIN—I realize Visa is talking about just chip—has been making the business case,” said Nessa Feddis, ABA vice-president and senior counsel for regulatory affairs. “Other countries migrated to chip cards earlier on in part because at the time, their landline telephone systems on which mag stripe technology depends were less reliable…The United States also invested in robust neural network systems that identified likely fraud. In addition, merchants are reluctant to pay for the change—only 25% of merchants have PIN capability, for example. The reduction of fraud losses, given existing systems, simply didn’t outweigh the cost of replacing terminals and cards.

“Whether that remains the case is yet to be seen. Resistance from some merchants, who would have to replace terminals as well as lose much of the value in their recent investments in other fraud prevention systems, continues to be a factor. However, the recent interchange amendment may provide some impetus. For example, if the cap on interchange fees does not sufficiently cover card issuers’ cost of fraud and fraud prevention, they may push for shifting more of the fraud losses and fraud prevention costs to merchants. As is the case in some countries and as proposed by Visa, merchants would only get the current guaranteed payment if they adopt the new chip technology.” 

 

Not only will chip technology accelerate mobile innovations, it is also expected to secure payments into the future through the use of dynamic authentication. (Dynamic authentication uses security codes that are good only once per transaction, as opposed to the three- or four-digit codes that are reused for mag stripe transactions.) Chip technology greatly reduces a criminal’s ability to use stolen payment card data by introducing dynamic values for each transaction. Even if payment card data is compromised, a counterfeit card would be unusable at the point of sale without the presence of the card’s unique elements. Reducing static authentication diminishes the value of stolen cardholder data, benefiting all stakeholders.

“Dynamic authentication is the key to securing payments into the future,” said Ellen Richey, chief enterprise risk officer, Visa. “Adding dynamic elements to transactions makes account data less attractive to steal and takes more merchant systems out of harm’s way, shrinking the battlefield against criminals. The migration to chip technology will be an important security layer and a critical step in a comprehensive strategy to use dynamic authentication across all markets and all channels.”

Globally, Visa will continue to support a range of cardholder verification methods including signature, PIN, and no-signature for low-value, low-risk transactions. Mag stripe technology is expected to continue to be supported for the foreseeable future, although fraud liability will shift. In the longer term, however, Visa expects the use of static verification methods such as signature and PIN will be reduced or eliminated entirely as new and dynamic forms of cardholder verification are implemented.

Visa’s plan to encourage—but not mandate—the U.S. adoption of dynamic chip authentication technology includes the following three initiatives:

 

 

1. Expand the technology innovation program to merchants in the U.S.
Effective Oct. 1, 2012, Visa will expand its Technology Innovation Program to the United States. TIP will eliminate the requirement for eligible merchants to annually validate their compliance with the PCI Data Security Standard for any year in which at least 75% of the merchant’s Visa transactions originate from chip-enabled terminals. To qualify, terminals must be enabled to support both contact and contactless chip acceptance, including mobile contactless payments based on NFC technology. Contact chip-only or contactless-only terminals will not qualify for the U.S. program. Qualifying merchants must continue to protect sensitive data in their care by ensuring their systems do not store track data, security codes or PINs, and that they continue to adhere to the PCI DSS standards as applicable.

 

 

2. Build processing infrastructure for chip acceptance
Visa will require U.S. acquirer processors and subprocessor service providers to be able to support merchant acceptance of chip transactions no later than April 1, 2013. Chip acceptance will require service providers to be able to carry and process additional data that is included in chip transactions, including the cryptographic message that makes each transaction unique. Visa will provide additional guidance as part of its bi-annual Business Enhancements Release for acquirer processors to certify that their systems can support EMV contact and contactless chip transactions.

 

 

3. Establish a counterfeit fraud liability shift
Visa intends to institute a U.S. liability shift for domestic and cross-border counterfeit card-present point-of-sale transactions, effective Oct. 1, 2015. Fuel-selling merchants will have an additional two years, until Oct. 1, 2017 before a liability shift takes effect for transactions generated from automated fuel dispensers. Currently, POS counterfeit fraud is largely absorbed by card issuers. With the liability shift, if a contact chip card is presented to a merchant that has not adopted, at minimum, contact chip terminals, liability for counterfeit fraud may shift to the merchant’s acquirer. The liability shift encourages chip adoption since any chip-on-chip transaction (chip card read by a chip terminal) provides the dynamic authentication data that helps to better protect all parties. The United States is the only country in the world that has not committed to either a domestic or cross-border liability shift associated with chip payments.

Visa’s announcement builds on similar international programs to encourage the migration to EMV chip. In February 2011, Visa announced the Technology Innovation Program for international merchants. The program, which was available beginning March 31, 2011, was intended to recognize the security benefits of dynamic authentication, enabled by EMV chip, and offer tangible benefits to merchants who update their POS infrastructure to accept chip cards. Visa has now expanded this program to include U.S. merchants, but will require terminals to support both contact and contactless chip payments.

Moving forward, as the point-of-sale payment infrastructure evolves from the static magnetic stripe to intelligent devices such as EMV chip cards and NFC mobile phones, it is critical to ensure that cardholders can continue to conduct convenient, secure, and reliable payments for card-not-present transactions as well. Visa is designing its new digital wallet with “click-to-buy” functionality able to support dynamic authentication across multiple channels including the ecommerce environment. Visa will also continue to enhance intelligent network-based fraud detection tools such as Visa Advanced Authorization and cardholder transaction alerts to complement dynamic and risk-based authentication methods. As always, effective fraud prevention requires multiple layers of security.

Will the retailers support?

Analysts have said that EMV adoption in the United States has been slow so far due mainly to disincentives at the merchant level.

“The retailer myth is that EMV is not in the United States because bankers will not pay for the technology,” said Doug Johnson, senior policy analyst at ABA. “The reality is the real costs are on the retailer side so that is where the serious resistance is. Changing out POS devices is more expensive than issuing EMV cards, as the cost differential between magnetic strip and EMV cards has diminished significantly.

“And EMV comes with a liability shift to retailers that do not adopt by the card networks’ mandated date. Retailers that do not adopt eat fraud costs. Retailers that do adopt don’t.”

Still, Visa said it’s announcement supports an increasing interest in chip technologies from across the retail industry, particularly as momentum grows for NFC mobile payments. In its announcement , Visa included supporting comments from McDonalds and Nordstrom.

“As the leading global foodservice retailer, McDonald’s already has a great deal of experience with chip technology, including in the United States where we have deployed contactless chip terminals to help us serve our customers even faster,” said Dave Weick, CIO and senior vice president, Shared Services, McDonald’s Corp. “We’re pleased that Visa has provided a roadmap that will allow us to move towards the next generation of payment technology, while at the same time take advantage of the security benefits of EMV chip and dynamic authentication.”

“Visa’s plan to encourage chip adoption and lay the groundwork for mobile payments is a positive development,” said Kevin Knight, executive vice president Nordstrom. “We appreciate their efforts to promote improved technology so that our customers have more reliable and secure card use and payment for their purchases.”

Also quoted was George Peabody, director, Emerging Technologies Advisory Service, Mercator Advisory Group. “There is no security silver bullet. But smartcards and smartphones using EMV adds a strong layer for payment transaction security as well as online banking, access to medical records and more,” he said.