White_paper_EMV-for-US-merchants-LAS

Open Test Solutions
WHITE PAPER
EMV Chip for US Merchants
There’s no good reason to migrate.
Or is there?
Ainsley Ward
EMV & Payment Evangelist

©2015 FIS and/or its subsidiaries. All Rights Reserved.
FIS confidential and proprietary information.
Open Test Solutions
It’s November 4th, 2015 and your monthly statement for cards processing has just arrived. What you see has
you dazed and confused.
Instead of the usual healthy balance reflecting those terrific sales figures for October, it’s a demand for money??!
It seems that many of those nice tourists that visited on Columbus Day had their authorized transactions
rejected as fraudulent and you’ve been left with the check. It’s not going to close your business, but a few
more months like this and you could be in real trouble.
You decide to head next door to your friend’s
restaurant for a consoling latté. She’s got a sticker
on the door proudly announcing that she accepts
things called EMV Chip and Apple Pay — sounds
like she might be getting a bill soon too.
During your coffee your neighbor heads over
for a chat carrying what looks like two mobile
phones — you hope that she’s not spent this
month’s take already!
What she shows you next blows your mind — the
second mobile is a new contactless-enabled
pay-at-table payment terminal that she’s got for
each of her waiters! Best of all, she says it’s EMV
certified which means that she’s no longer liable
for counterfeit fraud and has actually increased
customer spending and lowered card decline rates.
So why hadn’t you heard about this EMV Chip
thing? Why have criminals targeted your shop when
your neighbor is safe and secure?
The truth of the matter is that EMV Chip migration
going on in the US is not a mandate but a smart
business decision to tackle the changing business and fraud landscape: so no-one was telling you that it had
to happen and in truth the business case is unique for each and every merchant — but the logic to migrate
as soon as possible is undeniable and will benefit your business for years to come.
PayPal will shortly
launch a contactless
EMV Chip mPOS device.

Open Test Solutions
So what IS this EMV Chip thing?
EMV is a constantly evolving standard for credit & debit card transactions. It governs how the cards and
terminals work, how they interact and all of the certification & security surrounding transactions and the
infrastructure to support them. Essentially it’s next generation cards with a small computer chip replacing
the old magnetic stripe. Because your customer’s card data is now securely stored on a chip rather than the
stripe, it makes the cards much more difficult to counterfeit — and also means that you need a new certified
payment terminal to read them. Securing the data in this way means that the card issuer can be much more
certain that the card is genuine and so they are able to approve transactions much more frequently.
Alongside new
features, Chip cards
retain the recognizable
features of their
predecessors to
remain backwards
compatible
And why should you migrate to EMV Chip?
Meeting customer expectations
The biggest part of the overall rationale for merchant migration is the ‘liability shift’, but we’ll come to that
later. The most compelling reason for every merchant is customer service, part of which is meeting customer
expectations that you are securely managing their data and deploying the technology that keeps them safe.
Across the US banks are issuing EMV chip cards to their clients — in fact latest estimates predict that over 70%
of cards will be chip-enabled by the end of 20151
. If your clients can’t use the chip on their cards to perform
card transactions, they will perceive your store as less secure— a message impressed on them by their card
issuer, the media2
and even the US Government3
. Think of this cost in terms of customer acquisition — how
much does it cost you to bring a new customer into your store, and how much does it cost you to win them
back? Sometimes the retail business is just a case of keeping up with the Krogers...
1 Figures from US EMV Migration Forum www.emv-connection.com
2 Example: New York Times, June 10, 2015 ‘Why Americans are getting new credit cards’
3 October 17, 2014 Presidential Executive Order – Improving the Security of Consumer Financial Transactions
Primary Account
Number (PAN)
including Issuer BIN
Magnetic Stripe
EMV Chip
Expiry Date
Cardholder Name Hologram
Signature Strip
Physical
Issuer
Program Type
Member or Issuer Since DateBrand
CVx2 Code

Open Test Solutions
The EMV Chip Liability Shift
Latest figures show that $7.1bn worth of credit card fraud was committed in the US in 2014 alone 4
, that’s around
$20m per day — but previously the bulk of that was paid for by the card issuers, who made the yes or no decision
on whether the transaction could happen and so took liability for it. The same happens for debit cards. What
the ‘EMV Chip liability shift’ does (which for POS in the US is 1 October 2015) is change this balance — liability
for fraud committed using counterfeit cards shifts’ to transaction party that is not yet EMV compliant, and in this
case you are left picking up the check if your payment terminal only accepts magnetic stripe transactions. This
doesn’t mean that you’re now liable for all fraud, but counterfeit and lost & stolen fraud currently account for 64%
of card fraud in the US5
and so it is the biggest problem that’s the target of the liability shift. It also means that as
the pool of non-compliant merchants reduces, criminals will actively seek out vulnerable stores and target them
for fraud attacks — coordinating multiple locations or multiple frauds to circumnavigate your usual checks and
balances. Essentially they go after the weakest link and if that’s you, your fraud level will increase and your liability
is guaranteed — you risk a bigger share of the $20m every day that you’re not compliant.
4 Figures from Business Insider and Nilson Report
5 Source: Visa Fraud Reporting System (FRS) and Enterprise Data Warehouse (EDW) 2013; U.S. domestic Visa debit and credit
“The most compelling
reason for every merchant
is customer service.”

Open Test Solutions
0
2
4
6
8
2012
$2.1
$2.4
$3.0
$3.6
$3.1
$2.5
$1.8
$0.9
$0.9
$0.8
$0.8$0.8$0.8$0.9
$2.6 $2.8 $2.9
$3.1
$3.8
$5.2
$6.4
2013 2014 e2015 e2016 e2017 e2018
Counterfeit Lost/stolen CNP
U.S. Card Fraud Losses 2012 to 2018
(in US$ billions)
Source: Aite Group
Figures indicate that EMV will tackle the largest issue with card fraud, but will likely drive it to other channels.
Accepting other payment methods
However, it’s not all about protecting yourself from liability. Another consideration for migrating to EMV
Chip is the number of additional payment methods that you can support. You can have different acceptance
options depending on the type of business that you are running — pay-at-table for restaurants; pay-at-pump
for gas stations and contactless, which is most beneficial for high volume retailers.

As EMV is the underpinning technology for all modern card-present transactions, you can begin to accept
alternate form factors that are being delivered by issuers to your customers — this could include Apply
Pay or any of the Android-based alternatives that allow your customers to pay with their mobile phone. By
investing in a modern payment terminal, you could also have the infrastructure to work with Bluetooth Low
Energy (BLE) solutions or even QR-code based systems. In fact updating your terminal because of EMV may
mean that you have new payment opportunities on top of just cards. While few people will buy from your
store just because they’ve got Apple Pay on their phone, it could be a deciding factor when they need to
make a decision between you and a competitor — do you have the payment method that is most convenient
for them, or do they have to schlep to the ATM before they can buy from you?

Open Test Solutions
“One of the worst
things that can happen
in your store is that
the customer’s card is
declined. This means
longer service times
or even abandoned
purchases.”
Payments with
smartphones will
become more popular
in the next few years as
major manufacturers
launch services
The Business Case for Merchant Migration
The three components that we’ve just outlined make up the core of your business case — customer
retention/acquisition (churn); fraud cost potential from the liability shift; decreased decline rate (higher
acceptance). There is also strong anecdotal evidence from the many markets that have previously migrated
that cash usage declines. However, as the US is already a market with a high card usage rate, the impact on
cash usage overall may be localized to specific retailers.
Churn
Churn rate is a simple calculation — essentially the number of lost
customers versus the number of new customers that you gain over
a period of time. However it is the impact of this churn on your
business that has a cost implication. In many migrating markets
the customer perception of the security offered by EMV Chip
technology has severely affected the churn rate of businesses as
less loyal customers move towards more secure retailers. Cost of
customer churn depends on your company size, average transaction
value and the amount of times the customer typically visits in a
year. For example, if you are a local supermarket where customers
visit 20 times a year, spending on average $150 per visit then your
customer is worth $3000 per year in revenue.
If your margin is around 5%, then you stand to
lose $150 per customer per year if your churn
increases. Likewise, if you are the first retailer
in the area to migrate, you could gain $150 per
customer attracted.
Decreased decline rate
One of the worst things that can happen in your
store is that the customer’s card is declined.
Although this can happen for genuine reasons
such as insufficient funds or stolen cards, many
declines are actually due to the fact that their card
issuer doesn’t trust the transaction. For you as a
retailer, this means longer service times or even
abandoned purchases. Implementing EMV Chip
at your POS allows the card issuer to make better
decisions and has a significant effect on declines — reducing declines on domestic cards
by around 8% and on international cards around 14%6
. This can have a real impact on your
revenues, reduce queuing times and greatly increase customer satisfaction.
6 Figures from Visa based on multiple migrations

Open Test Solutions
Mag-Stripe EMV Chip
0
20
40
60
80
100
91.3%
94.9%
Mag-Stripe EMV Chip
0
20
40
60
80
100
92%
94.7%
Domestic Approval Rate
(LAC)
Cross-border Approval Rate
(CEMEA)
Past migrations show that more transactions are approved once EMV is implemented
Note: VisaNet data for 12 months ending July 2014
Liability for Fraud
If you haven’t yet invested in EMV Chip payment devices for your store and your customer presents an
EMV Chip card for payment, you are now liable if the transaction turns out to be fraudulent – regardless of
authorization from the card issuer. Currently over half of the world’s card payment fraud is committed in the
USA – but due to liability resting with the card issuers at the moment, it is likely that some fraud is simply
written off and is still not being reported.
Criminals target the weakest link in any payments system and, as demonstrated in other markets, will begin
hunting down those merchants yet to rollout the new EMV Chip terminals. This means that until you migrate,
you are being hunted. Fraud with counterfeit magnetic stripe cards typically doesn’t reduce significantly until
market migration of cards and terminals is around 85% complete, but the spread of merchants bearing the
problem reduces as the migration progresses. If you are late to migrate, not only will your fraud increase, but
you will now bear all the costs of dealing with it.
Imagine that you have 20 stores, each processing around 30 customers an hour at an average transaction
value of $100. This means that your chain generates around $60,000 per hour. If you are the target of a
coordinated fraud attack, it’s possible that you could easily lose an hour’s trading revenues, plus the goods
that have been sold and be subject to compensation claims. It could be an expensive hour’s trading — is
your business capable of sustaining that kind of hit? Criminals are well organized and communicate, so if
they have success at your stores once, they will keep coming back until you’ve migrated. Once you have
EMV Chip terminals installed and operating, then liability returns to the card issuer and this problem
disappears from your perspective.

Open Test Solutions
Why is EMV Chip a merchant issue?
It’s the last point in the business case that really makes EMV a merchant issue. The liability shift is an
interbank agreement that moves liability for counterfeit fraud between the Issuer and Acquiring banks
dependent on their migration status. However, because you are connected to the cards network via an
Acquiring bank, possibly via a processor or reseller, the liability that they incur is passed down the line in the
same way that all other costs and fees are passed on. Being at the end of the line, and the front end interface
to the customer, means that it’s invariably you as a merchant that will bear the costs of counterfeit fraud. The
only way that you can avoid these pass-through costs is to implement EMV Chip and to gain the required
certification in conjunction with your Acquirer.
The decision to change liability for counterfeit fraud didn’t come from the banks. In order to reduce the
overall fraud levels in their networks and to drive the EMV Chip rollout, the major payment brands created
liability shifts. These are not mandates. There is no legal imperative for you to migrate to EMV Chip, but as
you can see, the liability shift means there are compelling reasons not to be a late migrator.
If I don’t migrate, will I be in trouble?
There are no mandates for merchants to migrate from the payment brands. Indeed,
as you have no direct contractual relationship with them, they can’t force you to do
anything. However, your own processor or reseller may decide to mandate migration
and if you wish to continue supporting only magnetic stripe card transaction then
you may need to find an alternate supplier.
EMV Chip migration is a business decision, and your timing will be all about what is
right for your business. To date merchant migration in the US has been comparably
slow with as few as 20% of POS likely migrated on liability shift day7
. This means
that the largest payments infrastructure migration in history will happen mostly after
the liability shift has occurred, putting pressure on the entire system to go quickly:
a system that has a number of checks and balances built in to ensure the right end
result and so driven by finite timescales.
Why don’t I just go straight to mobile?
EMV Chip is the underpinning technology for cards payments going forwards regardless of the format. One
of the major considerations for merchants moving forward is how to futureproof your migration so that you
do not have to revisit infrastructure as soon as it’s implemented. A current activity changing the market is the
proliferation of new programs to enable payment using smartphones, but these are not yet prevalent on any
significant scale. Many of these use the EMV contactless interface (sometimes called NFC) which requires
additional capabilities on your POS and in your processing system connection. You may have already been
asked if you accept Apple Pay or any of the other similar NFC payment methods, all of which are based on
7 FIS OTS informal research conducted with major US processors
“EMV Chip
migration is
a business
decision, and
your timing will
be all about what
is right for your
business.”

Open Test Solutions
EMV Chip — ensuring that you can support these requires only a small incremental addition to the basic
EMV Chip infrastructure and can generate new customers for your store.
If you want to support QR code payments, it can be useful to have a large color screen on your customer-
facing device so that codes can be displayed. Likewise, many POS devices support the Bluetooth Low Energy
(BLE) protocol that is the underpinning of ‘beacon’ driven payments. Careful selection of your device will
ensure that you’re not pinned down to a single technology.
However, perhaps the greatest change to card payments in the US was an amendment to the Dodd-Frank Wall
Street Reform Consumer Protection Act known as the Durbin amendment8
. This enshrined some merchant
rights into legislation that allow you choice of independent debit networks for each debit transaction. To ensure
that this remains possible in EMV, a special application known as the ‘Common Debit Application’ is being
loaded onto most US-issued debit cards. This application is a technological facilitator that ensures the existing
routing options that you currently have; and you can still decide whether to create the choice at the POS
for each transaction or whether to use existing automated routing if you have a merchant switch. Essentially
migration to EMV Chip should not reduce the routing choices that you currently enjoy.
So do I just buy a new card terminal or is there more to it?
As the US cards market has grown organically over the past 50 years, there are considerable variances in
technology deployed and many more players deliver solutions. The EMV liability shift isn’t just based on chip
technology, but on the implementation of a new payments ecosystem that is certified as a whole — this is a
big change from today where just the interfaces are checked. It is by doing this check on the whole system
that card issuers can have the confidence to accept liability — and also to increase positive authorization of
transactions when EMV is in place.
What this means for you as a merchant is that you need to purchase hardware and software that already has
that basic certifications, known as EMV Level 1 and Level 2 — you can check these on the EMVCo.com
8 Full text of the amendment http://blog.legalsolutions.thomsonreuters.com/wp-content/uploads/2011/10/durbin_amendment.pdf
EMV Payment Terminal
EMV Level 1 Certified
EMV Kernel Level 2 Certified
Retail Payment
Host (Switch)
Processor HostRetail System
Register
Back-Office
Level 3 certification
covers all the
components of
the Acquiring
infrastructure

Open Test Solutions
website. However, these components alone are not a certified solution; you will need to work together with
your vendors and processor to ensure that you receive a Level 3 certification from each of the payment
brands that you accept. This is often known as Terminal Integration Testing. Level 3 ensures that the entire
system is secure so that messages generated by the customer’s card interacting with your POS reach the
card issuer without risk of alteration, interception or manipulation of any kind (see visual on the previous
page). This creates the trusted framework necessary for a modern payments infrastructure.
This is a whole new process and makes EMV Chip
implementation more time and resource consuming than
magnetic stripe, but the benefits make it wholly worthwhile.
Due to the added complexity the major US processors
have worked with a number of expert suppliers to provide
accredited support solutions for merchants migrating
to EMV Chip. Known as the US EMV VAR Qualification
Program9
, it gives you access to training programs,
implementation support and pre-certification services
that have been proven to make the EMV Chip migration
easier and reduce your time to market. FIS is a part of
this program and also accredited by MasterCard, Visa
and American Express to provide EMV migration services
towards the US market.
9 This program is managed by PCI https://www.pcisecuritystandards.org/approved_companies_providers/var_qualifications_program.php
“The EMV Chip
benefits make it wholly
worthwhile.”

Open Test Solutions
Conclusions
While it’s clear that you’re not under any mandate to migrate to EMV Chip as a merchant, the business
rationale for doing so is quite compelling. You will gain customer trust, reduce card declines and avoid
becoming liable for counterfeit fraud transactions that take place in your stores. But most of all you put in
place the technology that will allow you to accept new ways of paying which will potentially generate additional
revenues.
The liability for fraud is a pass-through cost — and you are at the end of the line. With $20 million of fraud
committed each day, the longer you wait, the bigger your share of that fraud will be.
EMV is about implementing an entire payment ecosystem so it’s not something that you can do alone — you
need to speak to your reseller and will ultimately be in contact with your processor during the certification
process. While implementing EMV Chip technology is not simple, there have been accredited programs
created to help you and the experts providing these have proven experience in EMV implementation.
EMV Chip is tried and tested, meaning the US market gets to benefit from all of the evolutions in the
technology created to solve problems elsewhere. There’s lots of free information available, but always be
aware of validity of the source and the date it was created — EMV standards continue to evolve. For the
most reliable information, make use of the EMV Migration Forum created to support the US migration, but
more importantly talk to certified vendors such as FIS OTS (formerly Clear2Pay) for independent advice.
About FIS Open Test Solutions
Unlocking the power of EMV can be a challenge. You may not have the time, the right specialization or
knowledge to implement your project autonomously. We help you remove obstacles, identify critical steps
and guide you through each stage of your migration journey to ease your acceptance process as much as
possible. We aim to build a true partner relation to build engagement and generate insights that we use
to develop the solution that fits your business perfectly. You can bank on us for certified test solutions,
accredited services and consultancy.
EMV is in our DNA; for more than 25 years, we are an evident partner for global banks, payment networks
and payment processors. We work closely with organisations such as EMVCo, the EMV Migration Forum and
major payment networks such as American Express, Discover, MasterCard, UnionPay and Visa.
More information: www.fisglobal.com/products-opentestsolutions
Contact: emv@clear2pay.com

Open Test Solutions
FIS Open Test Solutions
3050 South 35th Street
Suite C
Phoenix, AZ 85034
E: emv@clear2pay.com
W: www.fisglobal.com

White_paper_EMV-for-US-merchants-LAS

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (20)

Similaire à White_paper_EMV-for-US-merchants-LAS

Similaire à White_paper_EMV-for-US-merchants-LAS (20)

White_paper_EMV-for-US-merchants-LAS