From stripe to chip: EMV
(January 2004 version)
This introduction to the implementation of the EMV standard for Dutch payments has
been produced by the Technology Study Group of the Social Forum on the Payments
System (Maatschappelijk Overleg Betalingsverkeer/MOB) to address the demand from
market participants and other interested parties for accessible information on this
subject.
In 2003, the Dutch swiped the magnetic stripes of their debit cards through ATMs or payment
terminal readers and keyed in their pin-codes approximately 1.7 billion times. This everyday action
may look rather different a few years from now. Around the world, the familiar magnetic stripe will
gradually make way for a chip. The card will then be inserted with its chip into the terminal’s
reader. From swipe to chip seems a small change for the card-holder, but is a huge operation for
banks, credit card companies and merchants. An important impulse for the transition to chip
technology is the global increase in fraud involving existing magnetic cards, particularly credit
cards. Standardisation of chip technology will ensure that chip-cards can be used anywhere.
EMV: a world standard
Several years ago (the former) Europay, MasterCard and Visa took the initiative to develop a
worldwide standard for chip technology for their payment products: Maestro (cross-border debit)
and MasterCard and Visa (credit cards). This standard was referred to, for short, as EMV, after its
initiators. The EMV standard is a set of specifications which defines the processing of a transaction
using a chip and a terminal. Although EMV is a general world standard for chip-cards in electronic
payments, it has many degrees of freedom. Providers of the various national and international
payment products still have to design many of the functional and technical specifications for card,
terminal and network communication. As a result, every country has its own standards at present
for enabling terminals to communicate with the hosting bank computers, and the EMV standard
does not include specifications for the Dutch PIN (debit cards) and Chipknip (e-purse) payment
products.
Why EMV?
Enhanced security and efficiency are the principal reasons for the transition to EMV. The most
important reason was, and is, the significant rise in fraud involving magnetic cards, especially
credit cards. Instances of magnetic card fraud, also primarily involving credit cards, have also been
noted in the Netherlands over the past few years. Replacement of the magnetic stripe with a chip
will create a much higher level of protection. A chip cannot profitably be copied, and this enhances
the security of the authorisation process. Dutch banks and merchants wish to avoid a situation in
which a heightened feeling of insecurity when using cards, combined with an actual increase in
fraud, makes users switch to less efficient and less safe payment products such as cash. EMV will
not immediately eliminate magnetic stripe fraud as EMV cards will still have a stripe during the
transition period for use in countries that have not converted to EMV. Holders of magnetic cards
from non-EMV countries must also still be able to pay using EMV terminals.
As well as increasing the reliability of electronic payments, chip technology gives opportunities for
raising service levels to customers and the introduction of new functionality. As well as reducing
the cost of fraud and achieving economies of scale by worldwide standardisation, the conversion to
EMV may also lead to a reduction in telecom and processing costs due to the possibility of off-line
transaction processing. There are important benefits to be gained, even though it is currently very
difficult to make a hard-and-fast estimate of them worldwide and for the Netherlands. This is
because there are still too many uncertainties surrounding matters such as the extent and speed in
which EMV becomes an accepted world standard, the actual trend in magnetic card fraud and the
average speed of EMV transactions.
A major operation
Migration to the chip will affect virtually every link in the national and international electronic
payments infrastructure. It will require careful preparation and implementation, with attention to
quality, continuity of service and the security of electronic payments. It is a huge project with farreaching consequences for all concerned: banks, credit card companies, card-accepting merchants,
card-holders, terminal suppliers and processors. The migration will entail high investment and
adaptation costs. This will involve modification of, and investment in, cards, cash dispensers and
point-of-sale terminals, and front- and back-office processing systems, together with the
management of cards, card-holders and merchants. In addition, the transition period is expected to
be lengthy, since not all countries will make the transition at the same time, leading to an overlap
of traditional magnetic stripe transactions and EMV chip transactions. This will result in a
duplication of procedures and operational processes which will not only require greater attention by
those involved, but will also generate additional costs. Besides this, it will also be necessary to
invest in communications to staff, card-holders and merchants. Finally, the transition to EMV may
have legal and financial consequences for banks as a result of ‘liability shift’.
Liability shift
An additional financial incentive for banks to introduce EMV is the lifting of their liability for
magnetic card fraud which, under regulations issued by MasterCard and Visa in Europe, shifts on 1
January 2005 to the party that has not migrated to EMV. One consequence of this liability shift is
that in the event of fraud with an EMV card on a non-EMV terminal (relying on the magnetic
stripe), liability will rest with the contract party (bank or credit card company) of the merchant of
Maestro, MasterCard and Visa cards. It has also not been ruled out that the liability shift will have
financial consequences for some merchants once the infrastructure has been adapted for EMV. This
will depend upon the outcome of commercial negotiations between merchants and individual
providers. The liability shift only applies for MasterCard, Maestro and Visa and not for PIN and
Chipknip.
EMV in the Netherlands
Dutch banks have opted for a gradual migration, as a ‘big bang’ transition would not justify the
high additional costs. Dutch merchants have also chosen a gradual and controlled transition, partly
2
given major store chains’ lengthy migration projects and co-ordination of investment decisions by
companies operating internationally. The Netherlands will therefore migrate to EMV in phases.
From experience gained with this technology in pilots during 2003 (phase 1), the banks will
probably begin to adapt the Dutch infrastructure in 2004. Interpay is expected to have the
definitive EMV specifications for point-of-sale terminals available in the first quarter of 2004, so
that the development of EMV terminals can begin. The second phase involves modifying point-ofsale and Automated Teller Machines and networks to be able to read chip-cards and process
payment data. Merchants will begin to adapt and install terminals that can accept EMV cards. In
the third phase, Dutch credit cards will be fitted with the EMV chip, followed by the cross-border
payment product Maestro, in phase 4. This will mean that bank cards will also be fitted with an
EMV chip. Although the domestic PIN and Chipknip products are not covered by the international
liability rules referred to above, the banks are considering the migration of these products too in
the final phase. Dutch card-holders will then no longer have to swipe their magnetic stripes
through a Dutch terminal, but merely have to insert their chip-card in the terminal’s slot. Each
decision to move to a further phase will be taken on the basis of a ‘business case’. A definitive
timetable for the phased introduction process cannot yet be given.
Banks and merchants are of the opinion that migration should not be at the expense of the social
efficiency of the payments system. Just as merchants were closely involved in the development,
roll-out and further improvements surrounding the introduction of electronic funds transfer at the
point-of-sale, their expertise will also be put to use during the migration to the chip. Banks and
merchants place great weight upon structured consultation for EMV migration, and they also stress
the importance of timely information and communication.
EMV in other countries
The Netherlands is not a front-runner when it comes to EMV migration. In comparing countries it is
important to bear in mind the significant local differences in the nature, organisation and degree of
automation of their payments systems. In the Netherlands, the debit card (PIN) is much more
popular than the credit card. By European standards, the proportion of the use of debit cards is
high and that of credit card low. In the Netherlands, a debit card payment is only effected after a
pin-code has been keyed in, and so the level of fraud is particularly low, certainly in comparison to
originally signature based countries like Britain. Britain, France and Belgium are the European
countries furthest ahead in adapting their infrastructures. Their initial experience revealed
worldwide interoperability problems, such as cards from one country being unreadable by terminals
in other countries. Consequently there is no firm guarantee yet that every EMV card will be able to
communicate with every EMV terminal. The cautious approach adopted so far by the Dutch banks
has the advantage that lessons can be learned from the experience of the front-runners. It is
important for Dutch banks and their customers that the interoperability of EMV cards is fully
guaranteed.
3