It is looking
increasingly likely that the US will migrate to the EMV standard.
Discussions have moved away from ‘if’ and towards ‘when’ the US
will adopt the security specifications that are commonplace across
the globe. Jane Cooper reports on this compelling
case.
Go deeper with GlobalData
The lack of a business case,
a fragmented market and the existence of adequate fraud-prevention
measures have all been cited as reasons why the US has not
introduced EMV technology to its cards and terminals.
There are a number of reasons
the US is seriously considering moving away from its reliance on
the magnetic stripe.
Deborah Baxley, Principal at
Capgemini, says: “I’m more optimistic about it now than ever. The
stars are finally aligning.”
Baxley was co-author of Smart
Card Alliance’s (SCA) White Paper on the topic, which lays out a
roadmap for the industry in moving to the EMV
specifications.
US Tariffs are shifting - will you react or anticipate?
Don’t let policy changes catch you off guard. Stay proactive with real-time data and expert analysis.
By GlobalDataWhen the report was released
in early February 2011, Randy Vanderhoof, executive director of the
SCA, said: “With Europe, Canada, Latin America, and Asia in various
stages of EMV chip migration to reduce counterfeit, lost and stolen
card fraud, and to protect cardholder data, many in the US payments
industry who have examined this technology recognise that it’s time
to take a fresh look at different approaches to EMV that fit the
unique aspects of this market.”
According to EMVCo, the
network-owned body that oversees the specifications, as of
September 2010 there were more than one billion active EMV cards
and 15.4 million EMV terminals across the globe. This figure
accounts for 36 percent of total cards and 65 percent of the total
number of terminals in issue worldwide.
The migration would be no
easy task, and because of the fragmented nature of the US market –
with its thousands of banks and independent sales organisations
(ISOs) – there are many stakeholders that would have to be involved
in such a project.
The industry, however, has
the benefit of learning from the other markets that have migrated
because it has already been established and implemented across the
globe. Since many others have already developed and implemented the
technology, the costs of the various products have come
down.
“Everything got cheaper –
that is the biggest advantage of being late,” comments Baxley on
the costs of introducing both the chip cards and the
terminals.
She adds that many POS
devices already have EMV capability. Many terminal manufacturers
have already introduced hybrid EMV and magnetic stripe readers so
for many merchants they would only have to turn the EMV function
on.
Costs against
benefits
Aside from the declining cost
of the equipment, there has also been an increase in fraud in the
US. Although it is difficult to give an accurate estimate, and some
observers comment that fraud is massively underreported, the
business case for moving to EMV is becoming stronger.
Fraud levels are beginning to
get to the point where the industry is now considering what it will
lose if it does not implement EMV security, rather than what it
would cost to introduce the new infrastructure. Fraud typically
moves to the most vulnerable point and as the US’ neighbours adopt
EMV, it has been feared that fraudsters will target the US market
because it is easier to take advantage of the vulnerabilities of
the magnetic stripe.
Aside from the annual fraud
losses – which have been estimated to be around the $10 billion
mark for the US market – there is also the reputational damage the
industry needs to consider.
The issuer’s reputation also
features in the usability of magnetic stripe cards when the card is
taken overseas. There has been a reported increase in the number of
US cardholders who have been frustrated that their cards have not
been accepted when they travel to EMV-compliant
countries.
These cases, however, may
only be anecdotal, and industry executives point out that where
cards are not accepted it is not a technical issue. Countries that
accept EMV still have the capability to accept magnetic stripe
payments, and EMV-chip cards still carry the magnetic stripe for
the markets where the card needs to be swiped.
In cases where US cards are
not accepted, there is a lack of training on the part of the POS
staff or the merchant, points out Marina Hoffman Norville, Director
of Public Affairs and Communications at American Express. She adds
that if US cardholders are told they cannot use their cards, “they
can request that it is swiped and it will go through”.
Although there are no
technical reasons the magnetic stripe cards cannot be used
overseas, cardholders are typically unsettled if they are told they
cannot use their cards in a foreign store. They are then less
likely to use their cards for the remainder of their overseas trip,
and it can affect the wallet share of that particular card when the
cardholder returns home.
Some issuers have addressed
this and issued EMV chip cards for their US customers who are
likely to travel overseas. For example, in December 2010 Travelex
issued an EMV currency card for US travellers. It carries a
magnetic stripe for use in the US – and markets that have not
adopted EMV – and the EMV chip has been added so that the
cardholders have to enter a PIN in EMV countries. This follows in
the same vein as the United Nations Federal Credit Union, which
introduced the EMV chip in May 2010 for its cardholders, who
typically work and travel overseas.
Keeping
up
As the rest of the world
adopts EMV, there is a danger that the US could be left behind
altogether if it does not follow suit. At the moment, the magnetic
stripe still features on EMV cards, but one day it could be phased
out altogether.
Troy Bernard, director of new
technologies at Discover, says: “As more and more countries achieve
100 percent EMV compliance in card issuing and merchant acquiring,
if they ‘ban’ the magnetic stripe completely, and they find a way
to leverage EMV technology in the online world, then the US not
migrating to EMV will create issues in these EMV
markets.”
Bernard adds: “I must note,
though, that while the rest of the world is way in front of the US
in regards to EMV deployment, reaching 100 percent issuing and
acquiring compliance and tackling internet, card-not-present fraud
using EMV technology will not happen overnight. On the other hand,
US deployment of EMV will not happen overnight either, even if all
parties agreed to start today.”
As well as the US travellers,
there is also pressure from merchants for the US market to migrate
as the retailers argue that the standard is more secure.
In May 2010 at the Smart
Cards Alliance annual meeting, Jamie Henry, director of payment
services for Wal-Mart, said that the retailer strongly advocated
EMV. Wal-Mart has already begun to prepare its hardware to accept
EMV payments and is expected to be ready for the transactions by
the end of 2011. With such a large retailer making a move toward
EMV in this way, it is possible that other merchants will follow
their lead.
So far, the industry has been
able to manage without EMV and has focused on other
fraud-prevention measures such as tokenisation and end-to-end
encryption. The use of analytics to monitor suspicious cardholder
activity has also been heavily used by the industry.
For example, Marina Hoffman
Norville of American Express argues that the company has a
sophisticated monitoring solution that is able to keep an eye on
the constantly-changing activities of fraudsters.
Also, American Express
benefits from being a three-party system because as well as being
an issuer with its database of cardholders, it is also the acquirer
and has direct relationships with its merchants. This means that it
is able to take fraud prevention measures at both the issuing and
acquiring end of the transactions.
Hoffman Norville adds that
this helps with the tools they provide merchants, such as ZIP code
verification, so that the customer at the point of sale has to give
information to the merchant that matches the issuer’s data on the
cardholder.
These fraud-prevention
measures have so far been adequate in combatting fraud. If the
industry is to adopt another solution such as EMV, many executives
first want to debate whether EMV is the right standard, and whether
the US market would be better waiting until it is clear what form
of payments are likely to replace plastic in the future.
Discover’s Bernard comments
that the likelihood of the US moving to EMV depends on the view of
whether the preferred payment device of the future will be payment
cards or mobile phones.
“If it is the card, then I
think EMV will eventually be deployed in the US. The standard
magnetic stripe card has served us well for many years, but will
not be able to stand up to the chip-based payment technologies and
the security and convenience that they provide. If it is the phone,
EMV is not the only solution,” he comments.
Bernard continues: “There are
two options. The first is the NFC standard for payments used in US
merchants such as McDonald’s and The Home Depot today. It leverages
the mag stripe protocols currently used by merchants, acquirers and
issuers, but due to it using smart chip technology, that mag stripe
message changes every time you pay.”
He explains that a fraudster
could intercept the message, but if the security protocols are used
correctly by those in the payment chain, this data could not be
reused to make a purchase.
“Therefore, the hardware
expense of deploying an NFC reader is still required, but the
systems impact to the merchant, issuer, network and acquirer is
limited,” he comments.
The other alternative for the
industry is to use the EMV standard for NFC payments, but Bernard
points to the issue of whether the EMV version of NFC is more
secure than the magnetic stripe version.
“A lot of the value of EMV is
that when it was devised in the early 1990s, it was done so that a
card and terminal could approve a transaction without sending an
authorisation message to the card’s issuer. It was done locally, at
the merchant’s store. This was because telecommunications were
expensive and unreliable in many parts of the world at that time,”
comments Bernard.
That problem with
telecommunications has not occurred in the US, and payment requests
are approved in real-time.
Considering this dynamic data
the mag stripe NFC provides, the reliability of telecommunication
networks in the US, and the fraud detection systems that are
already in place, Bernard raises the question of whether there is a
need to implement EMV in the US.
“I think it will come down to
whether consumers will want to use their payment devices around the
world as they have done with their mag stripe card for the past
many years. In the short term when it comes to mobile NFC, I see
both EMV and mag stripe versions of NFC being supported by the
terminals. The local market will then determine if that is a mag
stripe NFC message or an EMV NFC message. Eventually, this may be
standardised as one version or the other. However, the merchant can
install one NFC reader using the mag stripe NFC app today and then
download the EMV application when it comes to the US.”
For now, the stakeholders in
the US payments industry are still discussing the migration and
what course it could take.
“Based on the solutions
presented to us and what our issuing, merchant, and acquirer
partners are telling us, for the next five to seven years, the
choices are going to be either NFC mag stripe and
contact/contactless EMV. The same hardware can be deployed
regardless of where this goes, but we believe it will start as NFC
mag stripe and contact EMV, and then NFC mag stripe will migrate to
contactless EMV,” Bernard adds.
When this implementation will actually take place is still
a long way off, but it is much more likely to happen now because
merchants and cardholders are pressing for it, fraud is rising, and
the cost of EMV cards and terminals is declining.
