Let the Chips Fall Where They May…EMV Jonathan Stout Vice President eReceivables Consultant Wholesale Marketing & Treasury Management February 2015 ©2014 Wells Fargo Bank, N.A. All rights reserved. Member FDIC.

Some things have undergone massive changes over the years… 1978 2014 IBM 5100 portable computer 55 lbs. .000064 GB $20,000 Apple iPhone 6 6 oz. 128 GB $500

…other things, not as much JOHN R DOE 01/14 – 01/18 01/12 – 01/15

With this lack of change, credit card fraud continues to grow 10% of all Americans have been a victim of credit card fraud 37% incurred by merchants mainly at point of sale from counterfeit cards $399 average amount of loss Source: United States Federal Trade Commission, Consumer Sentinel Network July 12th, 2014

In the last 2 years, millions of accounts have been compromised Recent data breaches (# accounts compromised) Neiman-Marcus 1 million October Target Corp. 40 million November Home Depot 56 million September 2013 2014 Source: need attribute here

Costs of global card fraud are rising Total losses in $Billions and in Cents per $100 in Total Volume Source: 2013 The Nilson Report

Impact of EMV on fraud in Canada Prior to EMV migration, Canada noticed a spike in counterfeit fraud most likely due to migration of fraud from other countries. As EMV penetration at POS increased, counterfeit fraud significantly decreased. Prior to beginning EMV migration, Canada noticed a spike in counterfeit fraud; most likely due to migration of fraud from other countries. As EMV penetration at POS increased, not only did counterfeit fraud significantly decrease, but other types of fraud showed signs of decline including Card Not Present and Lost & Stolen. While counterfeit fraud in the U.S. has been slowly increasing since 2005, cross border counterfeit fraud has seen significant growth, as more countries continue to migrate to EMV. Since EMV penetration in Canada began to climb in 2009, cross border counterfeit has shown significant growth in the U.S. Source: MasterCard Analysis, 2012 ** % face-to-face EMV penetration.

Global Visa chip acceptance status Visa Europe POS 93% ATM 97% Canada POS 86% ATM 92% U.S. POS 6% ATM 0% Asia Pacific POS 79% ATM 13% Latin America POS 54% ATM 40% CEMEA POS 87% ATM 92% Here is where EMV chip cards are accepted globally Visa worldwide POS 72% | ATM 65% Note: Percentage of international card-present transactions that originated from chip terminals during 1Q14. Source: As of January 2014, VisaNet clearing and settlement counts. Visa Europe is the exclusive licensee of Visa Inc. in the territory covered by the European Union.

What is EMV? EMV is an industry wide global specification supporting transaction processing of EMV Chip credit and debit cards Created by Europay, MasterCard, Visa Now maintained by EMVCo, LLC EMV payments improve security Card data schemes are embedded in a computer chip (microprocessor) Uses “dynamic” authentication methods and unique data elements to render stolen data useless EMV – stands for EuroPay, MasterCard and Visa, which is a card present technology to support merchants with fraud reduction With an embedded microprocessor, smart cards have built-in tamper resistance and have the unique ability to securely store large amounts of data, carry out their own on-card functions (e.g., encryption and digital signatures), and interact intelligently with a smart card reader. This kind of chip or smart-card technology adds layers of security against fraud and is virtually impossible to duplicate Chip card form factors include plastic payment cards, fobs, or personal devices such as mobile phones Mobile Phone – secure element. Proprietary information for First Data Employees Only

Stripe vs Chip Current state – static Magnetic stripe Holograms Security codes (three digit number) New EMV/Chip & PIN – dynamic Personal Identification Number (PIN) Dynamic cryptogram Transaction indicator(n+1)

How an EMV transaction works EMV chip card holder experience 1 Insert card instead of swiping 2 Terminal reads card 3 Screen prompts customer to sign or enter PIN 4 EMV terminal beeps reminding customer to remove card 2 EMV chip card acceptance is easy for both merchants and customers – it just takes some getting used to The customer inserts (not swipes) their card into the terminal The terminal reads card data Screen asks for signature and/or PIN Terminal lets customer know when to remove their card Easy to use prompts mean little risk of customers forgetting their cards or not knowing what to do EMV terminal will continue to read magnetic stripes for customers who do not have EMV-enabled cards Important: card should not be removed until prompted

Why Should Merchants Care? Benefits to enabling EMV Fewer chargebacks and costs associated with card present transaction fraud Mobile and Contactless payment acceptance Empower consumers to use the payment method of their choice by adapting contactless payments The liability shift could directly impact merchants fraud costs if not using EMV technology Aite Group estimates EMV deployment in the US could cut reduce card fraud by 90% or more Contactless may: speed up the check out process Attract more business by allowing consumers to use the payment method of their choice. Drive repeat business and loyalty – Eventually we will be able to push offers out to mobile phones and redeem them through POS devices using EMV-enabled payment cards/phones Proprietary information for First Data Employees Only

Why Should Issuers Care? The time is right for the U.S. to migrate to chip U.S. cardholders increasingly experiencing problems overseas. Merchants want the speed, convenience and security of Chip and PIN. Federal Reserve and other regulatory concern at U.S. becoming global center for card fraud. Rest of the world wants a single, interoperable card payments framework without the weak link of magstripe cards. No preparation to migrate to EMV chip One or more banks are migrating or have completed migration to EMV chip Penetration of MasterCard Branded EMV cards, EMV POS, or EMV ATMs exceeds 50% Source: MasterCard

party that is not Chip-enabled Hierarchy of liability Visa vs. MasterCard (October 2015 EMV liability shift) Visa Counterfeit fraud losses “shift” to party who does not enable EMV if fraud would have been avoided if EMV had been used Readiness is critical, given the ‘liability shift’ to the party that is not Chip-enabled Issued Device/Card   Magnetic stripe and/or Contactless magnetic stripe EMV contact or EMV contactless (signature CVM) (online or offline PIN CVM) Acceptance Terminal (not PIN capable) (online or offline PIN capable) Higher Risk Lower Risk MasterCard’s liability hierarchy ranks risk, relative to both Issued Device/Card and Acceptance Terminal, on a scale from higher risk (#1 below) to lower risk (#3 below): Issued Device/Card Acceptance Terminal #1 Mag stripe and/or contactless mag stripe Mag stripe and/or contactless mag stripe #2 EMV contact or contactless (signature CVM) EMV contact or contactless (not PIN capable) #3 EMV contact or contactless (PIN CVM) EMV contact or contactless (PIN capable) The other aspect of MasterCard’s liability hierarchy that can impact merchants is the inclusion of Lost, Stolen, Never Received Fraud (in addition to Counterfeit Fraud) when evaluating liability. Visa does not include Lost, Stolen, Never Received chargeback categories as part of the fraud liability shift. Here’s how MasterCard will assign liability based on these two types of fraud: Chip Liability Shift (Counterfeit Fraud): Issuer is liable if a non-EMV chip card is presented at a hybrid POS terminal Merchant is liable if an EMV chip card is presented at a non-hybrid POS terminal Chip/PIN Liability Shift (Lost/Stolen/Never Received Fraud): Issuer is liable unless a hybrid PIN-preferring card is used at a terminal that is not hybrid PIN-capable or if the PIN pad is not present or working Merchant is liable if a hybrid PIN-preferring card is used at a terminal that is not hybrid PIN-capable or the PIN pad is not present or working Visa’s liability is for counterfeit fraud, does not include Lost/Stolen categories MasterCard has included Lost, Stolen and Never Received in their liability hierarchy.

You could be affected if you’re not prepared

Ecommerce Current online New online Uses account number Expiration date Three digit code (CV2,CVV) Single use accounts New online Secure Code and Verified by Visa Machine finger printing Dynamic passwords Tokenization vs. Account number

Ecommerce – Why do you want to switch? 77 Ecommerce – Why do you want to switch? More secure Customer confidence for online transactions Fraud is coming your way fast!

Visa Checkout Streamlines eCommerce checkout to increase conversion rates Visa Checkout makes it easier, faster, and more secure for eCommerce customers to pay without leaving the merchant’s website. Requires only username and password to check out using any major credit or debit card Easy Fast No need to re-enter payment or shipping information Secure Device fingerprinting, step-up authentication, and advanced risk tools help reduce fraud Visa Checkout May help improve conversion rates by making it easier for customers to pay for online and mobile purchases Similar to PayPal Requires username and password to check out using any major credit or debit card Payment and shipping information does not need to be input again Added security with device fingerprinting, authentication and fraud prevention tools in place Easy, fast secure payment without customer leaving the merchant site Average eCommerce checkout conversion: 61% (2014) 1 55% on tablet 37% phone Visa Checkout conversion2 66% higher than average checkout conversion 22% faster than traditional checkout 12014 eMarketer, Shopping Cart Abandonment: How Retailers are Using the Metric to Drive Better Results 22015 comScore Visa Checkout study

Other Benefits of EMV Terminals

HUGE! Near Field Communication Mobile Commerce The growth potential is Mobile Wallet usage statistics reflect the fact that only a small percentage of merchants have upgraded to Near Field Communication (NFC) compatible terminals despite a large installed user base. And the growth potential is large. HUGE!

Apple Pay overview Mobile payment service launched in October 2014 Visa®, MasterCard®, American Express®, Interlink® and Maestro® are the supported networks Over 500 financial institutions offer Apple Pay to their cardholders Consumers can use their iPhone 6, iPhone 6 Plus and Apple Watch to pay in store by simply holding the device within range of an NFC contactless payment terminal Consumers can also use Apple Pay to make purchases within a mobile app (in app) with participating retailers while using their iPhone 6, iPhone 6 Plus, iPad Air 2 and iPad mini 3 Apple Pay fuels growth of NFC-enabled payments October 2014 launch of Apple Pay is helping to push NFC-enabled mobile payments into the mainstream More companies want to support the same technology for paying by phone Technology website, Ars Technica, reports that NFC-based payments have seen considerable growth since the introduction of Apple Pay Google Wallet, launched in 2011, has seen weekly transactions increase by 50% over recent months and the number of new users nearly double According to the New York Times, some major national retailers see Apple Pay as a strong tailwind to help increase consumer adoption of mobile payments: McDonald’s, which accepts Apple Pay at its 14,000 restaurants in the U.S., reports that Apple Pay accounted for 50% of tap-to-pay transactions. Walgreen’s said its mobile wallet payments have doubled since Apple Pay entered the market.

Apple Pay – consumer experience “in store” On eligible devices, the consumer simply holds their device within range of an NFC contactless payment terminal to pay in store. “in app” On eligible devices, Apple Pay can be used to pay “in app”. Checking out is as easy as selecting Apple Pay and placing a thumb on the Home button (Touch ID) or entering a passcode. Talking points: These screens show what the in store and in app experience looks like to a consumer As a merchant, you’ll be able to take “in store” Apple Pay payments, if you’re already set up for NFC contactless payments If not, we can talk about some solutions if you’re interested in learning more

Checklists – Consumer Do you know what is in your wallet? 1212 Checklists – Consumer Do you know what is in your wallet? How to use the new card? How are you going to manage your PIN’s? What type of card do I have? Contactless/Contact How about mobile wallets? Your experience is going to vary from merchant to merchant and different parts of the world. Join in using new chip and PIN cards!

Checklists – Business Have you started the terminal switch? 1313 Checklists – Business Have you started the terminal switch? Have you prepared to the switch to “card not present” fraud? Staff training swipe versus stays in the terminal? What is your fallback plan? What is your offline and online strategy? What is your global acceptance strategy?

1414 Questions