U.S. consumers are receiving new debit and credit cards with embedded chip technology that better
stores and protects cardholder information. These new chip cards are part of the new card standard,
Europay®, MasterCard® and Visa® (EMV). There aren’t any immediate changes required on your part –
chip cards will continue to also have the magnetic stripe you’re used to accepting, however you need to
know how EMV will affect your business in the near future and what you can do to prepare.
What is EMV?
EMV is a set of technical specifications jointly developed by Europay, MasterCard and Visa in the early
90’s, which describes the standards for chip cards and terminals to communicate.
EMV is the global standard for credit and debit card payments. It features payment cards with
embedded chips that store and protect encrypted account user data, enhance the authentication of
both the card and the cardholder and effectively reduce fraudulent activity in the regions who have
adopted this technology. When combined with the option of a PIN as a cardholder verification method,
it can significantly reduce fraud.
What is different?
Essentially, the key difference is that chip cards are actually inserted into the chip reader, rather than
swiped through the magnetic reader, and the card must remain inserted for the entire duration of the
transaction. One significant change is that a PIN may replace traditional signature on credit transactions,
if PIN is supported by the card issuer. The entry of a PIN by cardholders will allow for a more secure
method to verify the cardholder's identity.
U.S. issued EMV cards will continue to support both chip and magnetic stripe technology for years to
come. This will allow for the processing of transactions at point of sale terminals that have yet to be
upgraded for chip technology acceptance.
Page | 1
Are business owners required to adopt EMV?
Not yet. Only acquirers and processors, like Chase Paymentech, are mandated by the major payment
brands (VISA, MC, AMEX and Discover) to have systems capable of accepting and processing chip card
technology. However payment brands have announced an upcoming liability shift for business owners,
starting in October 2015. (More information about the liability shift is below).
What are the benefits of EMV?
EMV offers enhanced security and fraud protection and reduces the cost of chargebacks. Chip card
technology is virtually impossible to copy. Combining its use with a PIN helps to mitigate lost and stolen
and counterfeit transactions – hence reducing the number of chargebacks.
Is my processor ready?
If you process credit and debit transactions with Chase, then yes. Chase Paymentech has been
processing EMV transactions in Canada for over 7 years. We were in fact, the first acquirer to
implement chip acceptance of Visa and MasterCard transactions in the Canadian market. Our network
has been processing these transactions long before the U.S. move to EMV.
In addition to our host processing capabilities, our certification teams are fully trained and are prepared
to accept requests for EMV certifications in the U.S. We have available a comprehensive EMV
supplemental guide to assist our clients and integrators with their EMV development.
We currently have an EMV terminal for U.S. chip acceptance, the Ingenico iCT250, and we will have
additional terminals available over the next few months.
Our ability to accept EMV chip card technology in both Canada and the U.S. provides our clients, who
have businesses on both sides of the border, with a single processing solution.
What is the Liability Shift?
The major payment brands are large advocates of EMV technology and have released incentives and
mandates to help drive adoption within the U.S. region. One of the motivating EMV migration factors,
for both U.S. merchants and issuers, is the payment brand announced liability shifts for this region.
Liability Shift is a change in who is responsible for the chargeback costs associated with certain
fraudulent transactions. Specifically, the EMV Liability Shift is where the liability for fraudulent card
transactions, in situations where the card is counterfeit or in some cases has been lost or stolen, will
pass to the party that supports the least secure technology. This shift in liability is expected to
commence October 1, 2015 (non-petroleum) and October 1, 2017 (petroleum) in the U.S. region.
When a fraudulent transaction occurs in a region that has migrated to the EMV chip technology, and
one of the involved parties are not chip compliant, then the liability for counterfeit fraud loss shifts to
the party using less secure (non-chip) technology. The EMV liability shift is designed to protect the
investment of the entity that has invested in chip technology.
Today with magnetic stripe card technology, a business may not be liable for the cost of disputed card
present transactions if a card is swiped through a terminal, the cardholder's signature is captured and an
Page | 2
issuer authorization is obtained. Subsequent to the introduction of the U.S. EMV liability shift, if a
merchant doesn’t have a chip card acceptance device, and the use of such a device could have
prevented the fraud from occurring, they may bear the cost of that fraudulent transaction. This will be
regardless if the card is swiped, a signature is captured and an issuer authorization is obtained.
Note that EMV is a card-present technology, as the card must be present to authenticate the technology
on the card. As such, the Liability Shift only applies to card-present counterfeit and potentially lost and
stolen fraud.
What type of fraud is expected to shift?
The Payment Brands vary with their stance on EMV liability shift. Below is an outline of how each
payment brand expects to implement EMV liability shift, commencing October 1, 2015.
•
Visa will be shifting the cost of counterfeit fraud, conducted using non-EMV certified technology,
to the party who has yet to upgrade to support EMV starting October 1, 2015 (non-petroleum
merchants) and October 1, 2017 (petroleum merchants).
•
MasterCard, Discover and American Express will be also be shifting the cost of counterfeit fraud;
however, they have also announced that they will also be shifting the cost of lost and stolen
fraud, when PIN could have been entered for the chip transaction instance. MasterCard,
Discover and American Express all plan on following the same timelines as noted by Visa with
liability shift being introduced starting October 1, 2015.
If a business doesn’t accept EMV after October 2015, what will their fraud
costs look like?
As fraud impacts each merchant differently and issuers will issue chip cards at different paces, it would
be extremely difficult to quantify what a merchant’s fraud costs would look like subsequent to October
2015. There are a number of variables that need to be accounted for, which would include:
•
How many EMV chip cards have been issued to date?
•
How many of those issued EMV chip cards have had their magnetic stripe counterfeited, or how
many of those issued EMV chip cards have been lost or stolen?
•
How many of those counterfeit or lost/stolen EMV chip cards will make it into the merchant’s
place of business and facilitate a successful transaction?
What we do know:
•
Issuers are responsible for both counterfeit and lost and stolen chargeback fraud. That will
change subsequent to October 1, 2015 if the merchant doesn’t support a chip certified device
that is capable of prompting for PIN.
•
EMV will mitigate counterfeit fraud; PIN in general is capable of mitigating lost and stolen fraud.
•
MC, Discover and Amex are shifting Counterfeit and Lost & Stolen Fraud starting Oct. 1, 2015.
•
Visa is only shifting Counterfeit fraud subsequent to October 1, 2015.
•
If the merchant has an EMV device, they won’t bear the cost of ANY counterfeit chargebacks.
Page | 3
•
If the merchant continues to support a magnetic stripe only POS solution, they will begin
bearing the cost of counterfeit chargebacks if the magnetic stripe on a chip card is counterfeit;
if a counterfeit magnetic stripe only card is presented, existing chargeback rules apply.
•
If the merchant is capable of prompting for PIN during an EMV transaction (where the issuer
has programmed their cards for PIN support), then the merchant will be protected from the
cost of lost and stolen chargeback fraud in those situations only.
•
If the merchant is not able to prompt for PIN when PIN was the preferred method of cardholder
verification, and the chip card turns out to be lost or stolen, the merchant will begin bearing the
cost of those lost and stolen chargebacks for MasterCard, Discover and Amex lost/stolen cards.
Who is liable for counterfeit fraud if the fraudulent transaction was
processed using technical fallback to magnetic stripe?
The issuer is liable for any counterfeit fraud if the transaction: (1) is authorized by the Issuer; (2) all of
the appropriate values identifying the Transaction as a Fallback Transaction are included within the
related Authorization Message; and (3) correct acceptance procedures are followed.
Will EMV be introduced for U.S. PIN Debit?
There has been much controversy surrounding the development of a technical solution to implement
EMV for U.S. PIN debit in a manner that is compliant with Regulation II of the Durbin Amendment to the
Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Reg II”). An EMV Migration
Forum (EMF) debit working group, in which Chase Paymentech participated, worked to gather facts and
consensus-based preferences from participating industry stakeholder groups and subsequently
published a U.S. regional recommendation at the end of April 2014. As part of the EMF recommended
technical solution, the concept of a U.S. common debit AID was established for U.S. domestic PIN debit
use. The geographical scope of the common debit AID would apply to all U.S. states, territories and
protectorates as recognized by Reg II. The solution requires all of the participating U.S. debit networks
to outline updates to their network in support of EMV extended data.
The U.S. debit networks are now tasked with enhancing their networks to be in line with the
recommendation. Chase Paymentech has an active project to develop the necessary infrastructure to
support U.S. domestic PIN debit EMV.
Will the U.S. PIN Debit Networks be enforcing an EMV chargeback liability
shift?
Yes, the supported U.S. PIN Debit networks plan on enforcing a counterfeit fraud chargeback liability
shift commencing October 1, 2015.
What do business owners need to consider to support EMV?
In addition to the many benefits that EMV and other emerging technologies introduced, there are many
factors that business owners need to first consider.
This may include supporting new POS solution hardware. For EMV support, that hardware needs to be
EMV chip technology certified. EMV Level 1 and EMV Level 2 means that the hardware and core
software within the device are EMVCo certified for chip card acceptance usage. A list of those EMV
Page | 4
certified devices can be found on the EMVCo.com website. EMVCo is the governing body for the global
EMV chip technology standards.
Business owners who may not use a PIN pad today will need to consider purchasing hardware with an
integrated PIN Pad or a solution that allows for a PIN Pad to be attached externally. With EMV, at the
card issuer’s discretion, cardholder’s may be required to enter a PIN not only for debit, but for credit
transactions as well.
Business owners will also need to consider software application upgrades. Speaking specifically to EMV,
any new payment application will need to be certified by both the acquirer and the payment brands for
chip card acceptance. These certifications for software solutions are a lot more involved than your
typical magnetic stripe technology certifications and do require involvement and review with all of the
relevant payment brands.
As EMV changes the interaction with the consumer at the POS, it is very important that merchants and
businesses accepting EMV chip card technology consider the necessary implementation and training
process as well. Not only will employees have questions about these changes, but so will the
cardholders at the point of sale until everyone becomes more comfortable with the change that EMV
technology introduces.
What terminals support EMV?
In terms of Class B support, any POS hardware that is EMVCo level 1 / level 2 type approved for EMV
chip card acceptance can be leveraged to accept EMV chip card transactions. Merchants and Integrators
can use any device they choose as long as the device has the proper EMVCo type approval, PCI PTS and
MasterCard TQM certifications in place.
In terms of Class A support, Chase Paymentech currently offers one EMV certified device, which is the
Ingenico iCT250 (TCS) terminal. We do have an Ingenico iCT250 HCS application and a VeriFone EMV
application planned for release over the next couple of months, which can be supported on the Vx520
and Vx680. These solutions are predominately standalone countertop POS devices.
We do also offer low end PIN Pads that support EMV; these devices are the Ingenico iPP320, VeriFone
Vx820 and Vx805 PIN Pads. They can be purchased through Chase, and we would support them from a
Class A perspective, in that we would handle the warranty and replacements.
How are EMV solutions certified?
If you are using a Class B terminal to support EMV, your solution will need to be certified by Chase to
ensure it fully supports EMV. Whoever has coded the solution, you or your integrator, is responsible for
the certification with both Chase Paymentech and the payment brands (EMV interoperability testing).
•
Vendors must first be vetted by the Integrator support / Research and Discovery team
before they can be added to the VAR EMV certification list.
•
They will be supported based on their certification readiness.
Page | 5
•
You or your integrator will need to show proof of PCI compliance and that you will be
leveraging EMVCo Level 1 and Level 2 certified POS hardware for chip card acceptance.
Note that you or your integrator can identify if the hardware is EMVCo Level 1 / Level 2 certified by
reviewing the list of certified devices on the EMVCo website (www.EMVCo.com). Or, you can obtain this
information from where you purchased your hardware.
Page | 6