1. Restaurant.org @WeRRestaurants /RestaurantDotOrg
/NationalRestaurantAssociation

2. EMV and Restaurants: What You Need to Know April 29, 2015

3. Panelists
Mike English – Heartland Payments Executive Director of Product Development Jan McGrath – MasterCard Vice President, Go to Market Strategy, USPD Jim Higgins – National Restaurant Association Vice President, Payments & Financial Services

4. Agenda- Payment Security
EMV overview & Timelines
Demystifying the liability shift
Considerations to act soon vs later
Payment Security beyond EMV
Tokenization & Encryption
Questions

5. What EMV is… Micro Chips on Cards and Chip readers at merchant POS
US adoption of a world standard
Anti counterfeit chip technology
An enabling technology for additional security

6. EMV Card and Security Validating the Card & Cardholder
Optional PIN adds extra validation of the cardholder. Chip and Signature is allowed but is less secure
Card Authentication
EMV uses Cryptogram s to verify the card is authentic
And verifies the issuer is authentic to the card
Validating Card Use
Transaction Certificate (TC) proves that the card was present and was used for payment
©2014 Heartland Payment Systems, Inc.

7. What EMV is not… Is not mandated or required
Does not protect against all chargebacks
Does not secure cardholder data
Does not equate to PCI compliance
Does not reduce interchange

8. U.S. EMV Timelines for Restaurants
Oct-2013
MC ADC relief takes
effect (50%)
Oct-2016
Visa GCAR relief
Oct-2015
Liability shift
Oct-2012
PCI validation relief1
2012
2013
2014
2015
2016
2017
Apr-2013
Processor support for chip processing
Oct-2015
MC ADC
relief (100%)
AFD: Automated Fuel Dispenser
Visa GCAR: Global Compromised Account Recovery
MasterCard ADC: Account Data Compromise
1 Applies to Level 1 & Level 2 merchants where 75% of transactions come from a dual interface, chip-enabled, terminal

9. Chip Liability Hierarchy
Issued Device/Card
Magnetic stripe and/or contactless magnetic stripe
EMV contact or EMV contactless (signature CVM)
EMV contact or EMV contactless (online or offline PIN CVM)
Acceptance Terminal
Magnetic stripe and/or contactless magnetic stripe
EMV contact or EMV contactless (not PIN capable)
EMV contact or EMV contactless (online or offline PIN capable)
Higher Risk
Lower Risk

10. Market Projections Cards Terminals Payment Security Taskforce Aite
50% of U.S. issued cards will be chip enabled by end 2015
At least 47% of U.S. terminals will be chip enabled by end 2015
Aite % % %
Javelin % % %
2015 = 3.59mm / EMV 53%
2016 = 4.76mm / EMV 71%
2017 = 5.64mm / EMV 84%

11. ISSUANCE
ACCEPTANCE
PERFORMANCE 9%
of all U.S. MasterCard cards are chip cards
10%
Growth in MasterCard chip- enabled cards in-market MOM
Debit chip card issuance continues to grow rapidly
Consumer credit card issuance showed moderate growth
50%
of all MasterCard issuer programs are deploying Signature preferring profiles
60% of consumer credit programs to date are deploying signature preferring profiles
7% of programs have certified on both profiles (Signature and PIN)
13%
growth in chip-active locations MOM
12%
of U.S. ATMs are chip active
16%
growth in chip-active POS transactions MOM
208,715
Chip-active locations in the U.S.
Activity distributed across large, mid-tier and single location merchants
474 merchants with multiple locations
143,935 single-location merchants
98%
Approval rates for all domestic U.S. chip transactions
In line with current magnetic stripe approval rates
PIN declines are minimal; <1% of overall transaction volume 9%
Fallback 9%
Fallback returning to more acceptable levels after a large retailer coded chip transactions as mag stripe fallback transactions during the holidays. They are now working to revert to standards
EXECUTIVE SUMMARY – U.S. MARKET CHIP TRENDS, March 2015
Enabled – Fully capable of chip transactions; will do chip transaction if interfaces with a chip-enabled terminal
Active – Chip transactions seen in that period

12. EMV adoption Now or Later?
Current and anticipated chargeback costs
Sensitivity to card security
Competitors and EMV
Locations and demographics best suited for EMV
Impact on PCI
Future technology considerations

13. MASTERCARD CHIP RESEARCH WHAT CONSUMERS ARE SAYING
April 16, 2017
MasterCard has tackled some of the key issues during the EMV migration head on
Understanding the consumers; their levels of awareness and their thoughts and attitudes
Usability Study – how will consumers handle the new kind of transaction, what will they understand and how should issuers and the market prepare consumers for chip
MASTERCARD CHIP RESEARCH WHAT CONSUMERS ARE SAYING

14. 69% 33% 49% 60% 15% 45% 50% 9% 37% US CONSUMERS WANT EMV 2015 2014
ALREADY AWARE OF EMV IN THE US
WOULD CHANGE BANKS IF CHIP NOT OFFERED
PREFER PIN TO PURCHASE AT THE POS
69%
33%
49%
2015
60%
15%
45%
2014
50% 9%
37%
2013

15. EMV USE
BELIEVE CHIP CARDS ARE EASY TO USE
MORE INNOVATIVE WAYS TO PAY FOR PRODUCTS AND SERVICES
WANT A CHIP CARD IMMEDIATELY
PREFER TO SHOP AT MERCHANT THAT ACCEPTS CHIP CARDS
62%
61%
39%
40%
2015
47%
42%
40% 35%
32%
2014
Debit
Credit

16. WHERE CONSUMERS EXPECT TO SHOP
April 16, 2017
WHERE CONSUMERS EXPECT TO SHOP
80%
78%
77%
74%
76%
48%
Supermarkets/Gr ocery Stores
Department Stores
Gas Stations
Food and Beverage
Drug Stores
Unmanned Ticket Terminals
Source: MasterCard US EMV Consumer Research 2015
The large majority of card users continue to expect all types of stores to accept chip cards

17. Completing a Chip Transaction
Usability studies inform both Issuer & Merchants
FIRST USE
CONSUMER PREFERENCE
EASE OF USE
6% of participants inserted the card incorrectly overall transaction types
27% removed the card too soon on first use
A further 8% did it again on their second try
Note debit users more likely to pull the card out sooner because of the ATM process – 30% more likely than credit transactions
62% of participants preferred chip & PIN
38% preferred chip & signature
Previous study (27% and 10% respectively)
Credit users expect they will select or update the PIN on their credit card during the card activation process
Chip & signature rated lower than chip & PIN for ease of use
After a first failed attempt consumers get it right most of the time on the second attempt and beyond
Assistance from terminal prompts and store cashiers will help increase success of first use
Now for a closer look at the MasterCard numbers;
Generally we are seeing good progress on the issuing side – outpacing the level of acceptance points so far
Pace driven by data breaches and a need to be seen to securing consumer data
Issuers feel the urgency to secure cardholder data because this is what their consumers expect
Source: MasterCard Usability Study August 2014

18. EMV Process Adjustments
Staff training
Customer verification methods
Tap, insert or nothing?
What is intuitive?
Is speed of service a need?
Patron comfort factor
Forgotten cards?
Additional time per transaction?
Are there other technology considerations?
Serving a demographic that is looking to mobile payments?

19. EMV limitations to Security
Implementing EMV still leaves a customer’s primary account number (PAN) and discretionary data exposed
If crime ware gets into the restaurant’s POS system or network, the cardholder data could be stolen and used fraudulently
Every EMV card being issued in the US includes a magstripe
1 Visa International Operating Regulations (Public version), 15 April 2013, page 421, reference ID#:

20. Encryption and Tokenization adds Security
Encryption protects data ‘in flight’
Tokenization protects data ‘at rest’
Tokenization and Encryption offer the most secure solution available today for most merchants
PCI Audit benefits- Fewer compliance questions to answer
1 Visa International Operating Regulations (Public version), 15 April 2013, page 421, reference ID#:

21. EMV, Encryption and Tokenization

22. Why is encryption and tokenization needed for full payment security?
904
In the first 9 months of 2014, 904 million records were compromised in 1,922 confirmed incidents in businesses in the United States.
Many of the incidents reported in 2014 involved record-setting amounts of data, including 20 incidents that compromised more than 1 million records each.
9,700 companies found that they’d detected nearly 43 million security incidents in 2014, a compound annual growth rate of 66% since 2009
> 1,000,000
9,700
Managing cyber risks in an interconnected world, PwC, 2015
Steve Ragan, “Nearly a billion records were compromised in 2014,” Network World.
Verizon 2014 Data Breach Investigations Report:

23. It’s About Mitigating Risk!
EMV plus and encryption and tokenization remove ability to thieves to sell stolen payment data
Encryption and tokenization remove card data from the businesses’ environment
Encryption and tokenization are a definitive response to “all organizations should assume they’ve been hacked”
Encryption and tokenization reduce a merchant’s PCI scope as per a Coalfire study
Cisco 2014 Annual Security report
Heartland Payment Systems E3™ MSR Wedge Technical Assessment White Paper, Coalfire, January 4, 2011

24. Questions? Mike English Executive Director of Product Development
(877) x 2756
Janette McGrath
VP – Go To Market Strategy USPD
(636)
Jim Higgins
VP – Payments & Financial Services
National Restaurant Association
Questions?

25. Restaurant.org @WeRRestaurants /RestaurantDotOrg
/NationalRestaurantAssociation