Embed Size (px)
Citation preview
EMVThe Chips are Coming!
OrWhat is best?
Chips or Strips?Ken Givens, Director of Sales
U.S. Merchant Payment Solutions LLC
* EMV WAS DEVELOPED BY EUROPAY, MASTERCARD AND VISA IN THE MID 1990’S THUS THE ACRONYM “EMV”.
* IT IS AN OPEN-STANDARD SET OF SPECIFICATIONS TO FACILITATE THE INTEROPERABILITY BETWEEN CHIP CARDS AND TERMINALS FOR CREDIT AND DEBIT TRANSACTIONS.
* THE EMV SPECIFICATIONS WERE DEVELOPED TO DEFINE A SET OF REQUIREMENTS TO ENSURE SMOOTH PROCESSING BETWEEN CHIP-BASED PAYMENT CARDS AND TERMINALS.
* EMV CHIP CARDS CONTAIN EMBEDDED MICROPROCESSORS THAT PROVIDE STRONG TRANSACTION SECURITY FEATURES AND OTHER APPLICATION CAPABILITIES NOT POSSIBLE WITH TRADITIONAL MAGNETIC STRIPE CARDS.
What is EMV?
* THE BIGGEST BENEFIT OF EMV IS THE REDUCTION IN CARD FRAUD RESULTING FROM COUNTERFEIT, LOST, AND STOLEN CARDS.
* EMV ALSO PROVIDES INTEROPERABILITY WITH THE GLOBAL PAYMENTS INFRASTRUCTURE – CONSUMERS WITH EMV CHIP PAYMENT CARDS CAN USE THEIR CARD ON ANY EMV-COMPATIBLE PAYMENT TERMINAL ON THE GLOBE.
* EMV TECHNOLOGY SUPPORTS ENHANCED CARDHOLDER VERIFICATION METHODS AND, UNLIKE MAGNETIC STRIPE CARDS, EMV PAYMENT CARDS HOPEFULLY CAN ALSO BE USED TO SECURE ONLINE PAYMENT TRANSACTIONS.
What are the benefits of EMV?
* DUE TO THE GREAT EXPENSE INVOLVED, THE U.S. IS ONE OF THE LATE ARRIVALS (COUNTRIES) TO FULLY ADAPT TO THE EMV PROCESS AND REGULATIONS.
* ABOUT 80% OF THE WORLD IS NOW COMPLIANT WITH EMV SPECIFICATIONS.
* EVEN THOUGH ONLY 27% OF ALL GLOBAL CREDIT AND DEBIT CARD TRANSACTIONS TAKE PLACE IN THE U.S.A., OVER 47% OF THE WORLD’S CREDIT CARD FRAUD IS COMMITTED HER.
* AS OTHER COUNTRIES ADOPT EMV TECHNOLOGY, FRAUDSTERS MOVE TOWARDS COUNTRIES THAT HAVE YET TO ADOPT THE SAFER EMV TECHNOLOGY, THEREFORE THE U.S. MERCHANTS AND CONSUMERS HAVE BEEN TARGETS.
* BILLIONS OF DOLLARS WILL BE SAVED IN FRAUD LOSS THROUGHOUT THE UNITED STATES AS WE FULLY ADOPT AND INCORPORATE EMV TERMINALS AND PROCESSES.
Why is EMV needed in the U.S.?
* DELIVERY CHANNELS ARE ALREADY DISTRIBUTING EMV CAPABLE TERMINALS THROUGHOUT THE COUNTRY, BUT SOME ROGUE SALES ORGANIZATIONS ARE TAKING ADVANTAGE OF MERCHANT FEARS. MANY HAVE REPORTED OVERPAYING FOR HARDWARE, AND EVEN SOME STATING THAT THE HARDWARE PURCHASED IS NOT EVEN EMV READY.
* THE U.S. WILL CONTINUE THE EMV ROLLOUT THRU BANKS, CREDIT UNIONS, AND CARD PROCESSING COMPANIES.
* THE GOAL IS THAT ALL MERCHANTS WILL BE EMV COMPLIANT BEFORE EMV REGULATIONS BECOME MANDATED IN THE U.S. IN OCTOBER 2015.
Where is the U.S.A. in regards to EMV?
Chips Around The World
* CURRENTLY, AND FOR A FEW MORE YEARS ALL EMV CARDS WILL CONTINUE TO HAVE A MAGNETIC STRIPE, SO THAT THOSE CARDS CAN BE USED IN REGIONS AND COUNTRIES THAT HAVE NOT FULLY DEPLOYED EMV.
* THERE HAS BEEN SOME DISCUSSION BY THE EUROPEAN PAYMENT COUNCIL (EPC) TO ALLOW EUROPEAN FINANCIAL INSTITUTIONS THE OPTION TO ISSUE CHIP-ONLY CARDS.
* BY ALSO CONTAINING THE MAGNETIC STRIPE, EUROPEAN CARDHOLDERS WHO TRAVEL INTERNATIONALLY WOULD STILL BE ABLE TO PROCESS TRANSACTIONS THROUGH MAGNETIC STRIPE ACCEPTANCE AS NEEDED.
Will travelers with EMV cards visiting the U.S. have issues paying for purchases?
FIRST:
* THE EMV CARD INCLUDES A SECURE MICROPROCESSOR CHIP THAT CAN STORE INFORMATION SECURELYAND PERFORM CRYPTOGRAPHIC PROCESSING DURING A
PAYMENT TRANSACTION.
* EMV CARDS CARRY SECURITY CREDENTIALS THAT ARE ENCODED BY THE CARD ISSUER AT ISSUANCE.
* THESE CREDENTIALS, OR KEYS, ARE STORED SECURELY IN THE EMV CARD’S CHIP AND ARE IMPERVIOUS TO ACCESS BY UNAUTHORIZED PARTIES.
* THESE CREDENTIALS THEREFORE HELP TO PREVENT CARD SKIMMING AND CARD CLONING, ONE OF THE COMMON WAYS MAGNETIC STRIPE CARDS ARE COMPROMISED AND USED FOR FRAUDULENT ACTIVITY.
How does EMV address payments fraud?
SECOND:
- THE CARD IS INSERTED INTO A CARD SLOT OR READER. - THE CARD IS AUTHENTICATED AS BEING GENUINE,- THE CARDHOLDER IS VERIFIED, AND- THE TRANSACTION INCLUDES DYNAMIC DATA, AND IS AUTHORIZED ONLINE OR OFFLINE.- AUTHORIZATION IS BASED ON ISSUER-DETERMINED RISK
* EACH OF THESE TRANSACTION SECURITY FEATURES HELPS TO PREVENT FRAUDULENT TRANSACTIONS, AS WELL AS A P.I.N. OR CONTACTLESS DEVICE OR SMARTPHONE OR NFC CARD.
.
THIRD:
* EVEN IF FRAUDSTERS ARE ABLE TO STEAL ACCOUNT DATA FROM CHIP TRANSACTIONS, THIS DATA CANNOT BE USED TO CREATE A FRAUDULENT TRANSACTION IN AN EMV OR MAGNETIC STRIPE ENVIRONMENT, SINCE EVERY EMV TRANSACTION CARRIES DYNAMIC EVER CHANGING DATA.
* NOT DUPLICATABLE OR ABLE TO BE COPIED.
* IN THE FUTURE EMV CAN HOPEFULLY ALSO ADDRESS CARD-NOT-PRESENT (CNP) FRAUD, WITH CARDHOLDERS USING THEIR EMV CARDS AND INDIVIDUAL READERS TO AUTHENTICATE INTERNET TRANSACTIONS.
.
* ON OCTOBER 1, 2015 ALL MERCHANTS WERE EXPECTED TO HAVE EMV COMPLIANT TERMINALS OR BECOME 100% LIABLE FOR ALL FRAUDULENT TRANSACTIONS. CURRENTLY THEY ARE LIABLE FOR THE LOSS OF THE SERVICE OR PRODUCT AND AROUND $25 IN SERVICE FEES PER FRAUDULENT TRANSACTION, VS. POSSIBLY THOUSANDS IN FINES, AUDIT FEES, AND LOSS OF REPUTATION.
* THESE RULES ARE DESIGNED TO ENCOURAGE EMV CHIP CARD ACCEPTANCE, CREATING A SECURE ENVIRONMENT FOR TRANSACTIONS, WHICH HELPS TO BETTER PROTECT ALL PARTIES.
* WITH THIS LIABILITY SHIFT, THE PARTY THAT ACCEPTS A FRAUDULENT MAGNETIC STRIP TRANSACTION BEING, TYPICALLY MERCHANTS, WILL BE FINANCIALLY LIABLE FOR ALL COUNTERFEIT FRAUD LOSSES TO THE CARD ISSUER, THE CARD HOLDER, AND FINANCIAL INSTITUTION.
What are the payment brands next milestones?
* WHEN A TRANSACTION OCCURS USING EMV CHIP TECHNOLOGY, ANY LIABILITY FOR COUNTERFEIT FRAUD, THOUGH UNLIKELY, WOULD FOLLOW CURRENT ASSOCIATION OPERATING REGULATIONS. THE MERCHANT WOULD NOT BE LIABLE FOR ANYTHING BUT THE LOSS OF HIS PRODUCT OR SERVICE PROVIDED.
* THIS POLICY ASSIGNS LIABILITY FOR COUNTERFEIT FRAUD TO THE PARTY THAT HAS NOT MADE THE INVESTMENT IN EMV CHIP CARDS (ISSUERS, BANKS, CREDIT UNIONS) OR EMV CHIP READING TERMINALS (MERCHANT BUSINESS).
* IN SHORT: THE PARTY THAT HAS MADE AN INVESTMENT IN THE “MOST SECURE” OPTIONS, IS PROTECTED FROM FINANCIAL LIABILITY FOR CARD-PRESENT FRAUD LOSSES FOR BOTH COUNTERFEIT AND LOST, STOLEN AND NON-RECEIPT FRAUD. ALTERNATIVELY, THE PARTY THAT HAS NOT MADE THE INVESTMENT WILL BE 100% LIABLE FOR ALL LOSSES, FINES AND FEES.
What Are The Liability shifts for U.S. Merchants?
* COUNTRIES IMPLEMENTING EMV HAVE REPORTED A DRAMATIC DECREASE IN RETAIL CARD FRAUD. THE U.S. SUFFERS 50% OF THE WORLDS FRAUD, WHILE ONLY PROCESSING 27% OF ALL TRANSACTIONS.
* GREAT BRITAIN/UK CARDS ASSOCIATION REPORTED IN 2011: “LOSSES AT U.K. RETAILERS HAVE FALLEN BY 67 PER CENT SINCE 2004; LOST AND STOLEN CARD FRAUD FELL BY 58 PER CENT BETWEEN 2004 AND 2009; AND MAIL NON-RECEIPT FRAUD HAS FALLEN BY 91 PER CENT SINCE 2004.”
* THE NATIONAL ROLL-OUT OF EMV IN CANADA IN 2008 HAD A DRAMATIC IMPACT ON FRAUD. LOSSES FROM CARD SKIMMING IN CANADA FELL FROM $142 MILLION IN 2009 TO $38.5 MILLION IN 2012.
What is the proven impact of EMV adoption?
* TYPICALLY EMV CARDS ARE IMBEDDED WITH A CHIP, WHICH IS INSERTED INTO A TERMINAL OR CARD READER, SIMILAR TO MAGNETIC STRIP CARD SWIPING.
* CONTACTLESS CARDS WITH AN EMBEDDED CHIP WERE ACCEPTABLE RECENTLY, BUT THE TECHNOLOGY, RFID (RADIO FREQUENCY IDENTIFICATION) IS CONSIDERED NOT SECURE AS NFC (NEAR FIELD COMMUNICATION) FOUND IN A SMARTPHONE APPLICATION (APPLE PAY, GOOGLE WALLET , GO SOFTCARD, ETC.)
* THE GOAL FOR CONTACTLESS IS TO MINIMIZE THE AMOUNT OF TIME THAT THE CARD MUST BE HELD NEAR THE READER, AND REMAIN SECURE, PROVIDING FASTER SERVICE TO THE CUSTOMER.
* EMV CONTACT CHIP CARD REQUIRES THE CARD TO REMAIN IN CONTACT WITH THE READER FOR THE DURATION OF THE TRANSACTION, UP TO 5-10 SECONDS.
* NFC CONTACTLESS TRANSMISSION OF INFORMATION BETWEEN THE CARD AND TERMINAL IS MUCH FASTER, AND IS ALSO DYNAMIC FOR SECURITY.
Differences between EMV contact and contactless transactions
STEP ONE - HARDWARE:
* DO YOU CURRENTLY HAVE CONTACT EMV CHIP READER AND/OR CONTACTLESS EQUIPMENT THAT IS PCI SECURITY APPROVED?
* IS HARDWARE ACCESSIBLE TO CUSTOMERS TO INSERT THEIR EMV CHIP CARD OR CONTACTLESS SMARTPHONE APP?
* IS A TABLET BASED POS SYSTEM THAT ACCEPTS EMV CHIP CARDS BETTER THAN A COUNTER TOP TERMINAL OR VICE VERSA?
3 STEPS TO EMV COMPLIANCE
* IS THE EQUIPMENT PCI SECURITY EMV LEVEL TWO CERTIFIED ?
* IS THE EMV TERMINAL DRIVER UPDATED TO INTERFACE WITH NEWEST DATA ELEMENTS CHIP/EMV PROVIDES?
* DOES IT HAVE ELEMENTS TO INTERACT WITH CREDIT CARD HOST AND CARRY ENCRYPTED CHIP DATA FOR APPROVAL?
* DID EQUIPMENT COME FROM A TRUSTED SOURCE AND INSTALLED BY A REPUTABLE PCI CERTIFIED TECHNICIAN?
STEP TWO - SOFTWARE:
* BE PREPARED FOR CONFUSION, SINCE TRANSACTIONS WILL BE PROCESSED DIFFERENTLY.
* EMPLOYEES NEED TO KNOW THE NEW OPTIONS AND REQUIREMENTS TO MAKE YOU AND YOUR CUSTOMERS SAFE.
* YOUR STAFF WILL BE EXPECTED TO ASSIST CUSTOMERS NAVIGATE THRU THE NEW PROCESS AND EXPLAIN WHY IT IS NECESSARY.
* RESTAURANTS CAN’T ADJUST/ADD THE TIP INTO THE SALE AFTER THE CARD IS REMOVED, SO THEY MUST CHANGE THEIR PROCESSES OR OBTAIN TABLE SIDE TERMINALS TO COMPLETE THE ENTIRE TRANSACTION, INCLUDING THE TIP.
STEP THREE – EMPLOYEE TRAINING:
* ANALYZE YOUR CURRENT RETAIL SITUATION. IS IT TIME TO UPGRADE COMPLETE POS OR JUST TERMINAL.
* DON’T LET FEAR OR URGENCY FORCE A BAD DECISION! THERE ARE COMPANIES TAKING ADVANTAGE OF MERCHANTS WITH OVERPRICED HARDWARE OR SERVICE FEES.
* BECOME EMV AND PCI SECURITY COMPLIANT WITH THE HELP OF A TRUSTED CREDIBLE SOURCE.
* LEARN THE SYSTEMS BETTER THAN YOUR EMPLOYEES SO THAT YOU CAN HELP TRAIN THEM AND ALSO MAINTAIN CONTROL OF THE PROCESS AND SYSTEMS.
EMV BOTTOM LINE!
512-535-2255 / 254-863-2567 / 888-995-3995
Thank you for your time and attention!
Ken Givens, Director of Sales U.S. Merchant Payment Solutions LLC
www.CardProcessingInfo.com
