|
Advice
for Retailers Installing EMV Compatible Hardware
If you have traveled to to Europe within the last 10
years you've probably noticed that credit card purchases
are handled differently for Europeans than for
Americans.
Specifically, most
Europeans insert their cards into a card reader and
input a PIN number on a PIN pad - even with credit
cards. The Chip and PIN technology (termed EMV Europay,
MasterCard and VISA) has helped to significantly reduce
fraud in retail environments in Europe.
Due to the cost and complexity of implementing EMV as
well as the extensive mag-stripe infrastructure, it has
not made inroads in America. Many experts warn that this
is about to change and smart retailers are now preparing
for Chip and PIN. Here's some advice to help retailers
prepare:
What Is Chip and PIN?
Chip and PIN was devised to combat face-to-face retail
fraud. With a traditional magnetic stripe, there is no
mechanism for a card to be restricted to usage by only
the cardholder - or any mechanism to prevent re-encoding
of the card with a different card number. Chip and PIN
capable cards not only have the magnetic stripe on the
card, but also have a secured, encrypted, computer chip.
This chip stores not only the cardholder account
information, but also a unique PIN number assigned to
the card. When the card is inserted into a smart card
reader, the cardholder is required to enter in a PIN
number to a secure PIN entry device. This PIN number is
then transmitted to the chip on the card and validated.
If the PIN number matches the encrypted number on the
card, the chip responds with a secure cryptogram as well
as the card account information and the transaction is
processed. If the PIN validation fails, the card is
unable to be used for the purchase transaction. As the
cardholders have to authenticate themselves for every
transaction (similar to PIN debit), lost cards cannot be
used for purchases by individuals who don't know the
unique PIN number. Additionally, as the chip on the card
is cryptographically secured, there is no way for a
fraudster to change the account information encoded in
the chip.
Implementation of this technology has greatly reduced
the incidence of retail fraud in the United Kingdom,
Europe, and Canada, and merchants have benefited from
greatly reduced chargebacks as cardholders cannot claim
they did not authorize the transaction.
What is Required to Accept Chip and PIN?
There are two tech components required to implement this
new technology: cards issued with the electronic chips
embedded in them, and deployment of chip card readers to
retail locations. Issuing banks in the United States are
beginning to issue Chip and PIN compliant cards though,
due to the significantly increased cost of card
production and limited acceptance points in the United
States, they have primarily been issued to clients who
travel overseas regularly. Merchants wishing to accept
Chip and PIN based transactions must have compliant card
readers and POS certifications in place.
Is Chip and PIN available in the US?
It is not generally available, no. However, in August of
2011 Visa announced plans to bring this technology to
the US. Specifically, Visa stated that US Merchant
Acquirers must be certified with Visa and able to
support Chip and PIN transactions by April 1, 2013.
Additionally, as an inducement for merchants to deploy
this technology, beginning October 1, 2015 for most
card-present locations (October 1, 2017 for fuel-selling
merchants), Visa will begin a "liability shift" when
counterfeit cards are used to make purchases. If a
contact chip card is presented to a merchant that has
not adopted, at minimum, contact chip terminals,
liability for counterfeit fraud may shift to the
merchant's acquirer (note that ATMs are excluded from
this liability shift).
In addition, Visa has announced relief from some
PCI-related compliance tasks beginning in October 2012
for merchants where 75 percent or more of the
transactions are originating from dual-interface EMF
chip-enabled terminals in addition to meeting other
criteria.
What can be done now to prepare for this migration?
As these announcements have just been made, Visa is
still preparing documentation for merchants and terminal
manufacturers regarding the specifics of Chip and PIN
deployment in the US. Retailers about to purchase any
terminal or customer-facing PIN pad technology should
explore selecting devices which are EMV compatible.
Published:
Sept 2011 |
