EMV: Chip Cards Are Coming To the US – And What Businesses Need to Know

Agenda EMV – What Is It? EMV In The UK EMV Is Coming To The US What Is The Liability Shift? Risk Of The Liability Shift Preparing For EMV Now

A Brief Look At EMV What Is EMV? EMV stands for EuroPay, MasterCard and Visa, the entities that originally pushed for this standard. Also known as “Chip and Pin” and “Smart Cards” Dynamic two-factor authentication. Card has EMV chip embedded in it. Cardholder swipes card and either enters PIN or signs receipt (determined by Issuer) Smart Card capable terminal needed to recognize chip inside of card Different from existing “Contactless” cards, which have a chip, but no authentication (i.e. non-EMV) Over 1 billion cards have been issued worldwide (100MM in the US as of Dec 2014).

A Brief Look At EMV What Is EMV? Note the visible chip on the front – but there WILL be a mag stripe on the back for the foreseeable future The magnetic stripe has information indicating it is an EMV capable card; an EMV capable reader will force the user to insert the chip and remain inserted for the duration of the transaction

A Brief Look At EMV EMV in the UK Originally deployed in the UK in 2004 – “Chip and PIN” flavor Beginning Jan 2005 merchants bore cost of face-to-face fraud if they were not EMV compliant Source: “Financial Fraud Action UK, Fraud the Facts 2012

A Brief Look At EMV EMV Is Coming To The US EMV support has and will occur over several phases through 2017 October 2015 is a key date for merchants - Counterfeit Card and Lost or Stolen liability shift

A Brief Look At EMV What Is The Liability Shift? In order to incent Issuers and Merchants to deploy EMV compliant technology: Following October 2015, the Issuer bears liability for counterfeit card transactions (Visa and MC) or lost or stolen cards (MC, Amex, and Discover) which occur at EMV certified devices The Merchant bears liability for counterfeit card transactions (Visa and MC) or lost or stolen cards (MC, Amex, and Discover) if the genuine card was EMV capable and the merchant did not use an EMV certified device Note that EMV adoption is NOT a mandate for Merchants or Issuers!

A Brief Look At EMV Risk of Liability Shift? Liability shift ONLY applies if card was reissued with chip or terminal supports EMV Dec 2014: Approx 100MM cards issued in the US Approx 570MM cards will be delivered to US cardholders in 2015 Approx 1.2 B cards in US by end of 2016 (1.6B cards issued today) Payments Source June 24, 2015: 25% of merchants will be ready in Oct. Finextra August 7, 2015: Just 10% of cardholders have received cards Baseline risk TODAY is very low but will increase Visa counterfeit card estimate: 0.012% of transactions; 0.028% of value Shift only applies when cards or terminals support EMV Risk will increase as more terminals are deployed Risk will increase as more cards are reissued Fraud follows the path of least resistance Sources: Digital Transactions, Jan 8 2015, Jan 14 2015 Visa study for Worldpay

A Brief Look At EMV Preparing For EMV Now Be sure to consult with your vendors and acquirer now if there are any POS equipment purchases/equipment refreshes soon While EMV is still being implemented at the application level, EMV-ready hardware is available today – and any hardware MUST be supported by your POS vendor! Training will be presented both in information campaigns from Issuers and Associations as well as Vendors “Pay at the Table” will become commonplace for table service restaurants due to PIN entry requirements Tip entry is typically handled by the cardholder on the payment terminal

A Brief Look At EMV Preparing For EMV Now Worldpay also offers EMV information at http://www.worldpay.com/us/emv

A Brief Look At EMV Preparing For EMV Now EMV will NOT supplant the need for PCI compliance Though the EMV chip will provide two-factor authentication, the “card number” itself is generally not encrypted as a result of EMV implementation Card Present fraud will migrate away from EMV-compliant locations – you don’t want to be the “last on the block” to implement E-Commerce transactions are vulnerable to fraud migration – UK experienced 50-100% E-Commerce Fraud increase in the 2 years following their liability shift Reminder that while you SHOULD be planning for the EMV upgrade now, solutions are slow in coming and the October 2015 deadline is ONLY for the liability shift – and the liability will start small but will grow through 2016 and 2017

Thank You For Your Time! Questions?