What is EMV?
While most people think of EMV as the chip on their payment card, EMVCo defines “EMV” as the superset of all specifications the organization manages including their tokenization, 3D Secure and Secure Remote Commerce specifications as well as the venerable contact and contactless chip specifications. For our purposes, however, we will stick to EMV chip card processing.
EMV was and is one of the biggest changes to happen in the payments world. Defining a more secure method of payment, the specification was developed jointly by Europay, MasterCard and Visa in the mid-1990s.
EMV is a proprietary standard used by the global payment networks to combat card-present counterfeit fraud. For merchants to process chip cards, their payment card processing devices and solutions must be certified to the card brands’ chip card processing requirements.
How does an EMV chip work?
EMV introduces a small computer or “chip” to each payments device. The chip stores information, performs processing and contains secure keys that generate cryptographic data. With each transaction, dynamic data is generated making it nearly impossible to use counterfeit cards at point-of-sale devices or replay intercepted transactions. This is in contrast to traditional magnetic stripe cards, which contain static data in the magnetic stripe.
When an individual steals data from the stripe on a traditional magnetic stripe card, they are able to re-use it again and again because the information on the stripe never changes. With chip cards, the data is different every time it is used, which prevents it from being replicated. While EMV cannot do away with data breaches, it can limit the value thieves get from the stolen customer data.
What are the benefits of chip cards?
Chip cards are designed to protect against counterfeit fraud through authentication of dynamic data generated by chip cards, smart phones and other EMV-compliant devices. They provide risk management parameters at the card level and, when used with PIN, can offer protection against lost and stolen card fraud.
Since the widespread adoption of EMV in the United States, counterfeit fraud rates have decreased significantly according to MasterCard and Visa. In March 2018, Visa reported a 76 percent decrease from December 2015 to December 2017 in counterfeit fraud costs for U.S. merchants that have adopted chip technology in their stores.
How does this affect my business?
Since October of 2015, if a customer presents a chip card for payment at a non-chip enabled merchant payment device and the merchant is unable to process that transaction using the chip technology, that merchant may be liable for any counterfeit fraud that occurs as a result of the transaction. Following the shift, liability for fraudulent payments has been muddied a bit, especially when it comes to fallback transactions. When a customer attempts to use a chip card at a chip-enabled POS but is unable to due to a malfunctioning reader or card, the transaction may “fallback” and the magnetic stripe on the card is used. If the fallback is properly identified and authorized online, the issuer will assume liability. Otherwise, the merchant may be held responsible. Understanding fraud liability can be confusing, but you can shine a light on the subject through our “Navigating the EMV Liability Shift” flowchart.
To support the processing of chip transactions, an EMV-enabled terminal is required with a reader designed for chip cards. Midwest Pay offers a variety of POS terminals that can process EMV chip cards.
What changes during checkout with a chip-enabled terminal?
Using a chip card at check-out isn’t that much different than a traditional magnetic swipe card. At the point of sale, there are two main changes:
- Instead of swiping the card, the customer will insert the card into the reader
- With standard EMV processing, the card will remain in the reader for the duration of the transaction (not required for “quick chip” solutions, see section below)
This process is sometimes referred to as “dipping.” During the dip, the card and terminal conduct a dialog to identify processing restrictions, perform risk analysis and generate the dynamic data. If the transaction is to be authorized online, the data is sent to the issuer who verifies the legitimacy of the card and generates a transaction response. The response may then be validated by the card. The process can take a bit more time than a simple swipe so the customer should be prompted to remove their card when the process has completed. However, with quick chip implementations, much of this time lag can be eliminated.
Is there’s no more swiping, can EMV cards only be “dipped”?
Not necessarily. Chip-enabled terminals are backwards compatible with mag-swipe processing so cards from issuers that have not converted to chip yet can still be supported. Likewise, chip cards will continue to have a magnetic stripe on the back of them so they can be used with magnetic-swipe only terminals.
In addition, some chip cards come equipped with near field communication (NFC) compatibility, which is the same technology used for mobile payment systems like Apple Pay and Google Pay. Instead of dipping, these cards can be tapped at POS terminals.
Chip cards that support both dipping and tapping are referred to as “dual interface cards.” Internationally, contactless has gained significant momentum over the last several years with dual interface cards responsible for a large percentage of the transaction volume. Issuers in the U.S. are just starting to provide cardholders with dual interface cards, but given the speed and convenience of tapping, merchants and customers can both expect to see more NFC-enabled cards in the not too distant future.
How can I improve the customer experience at the terminal?
Customers who are unfamiliar with the new process may insert the card and then immediately try to remove it from the reader, or they may forget that their card is in the reader and leave it behind. Merchants should be prepared for a potential increase in the number of cards left behind by customers.
Cardholder prompting on the terminal is key to ensuring a smooth checkout experience. A clean display layout with simple prompts can help guide the cardholder through the experience. Eliminate unnecessary prompts where possible. To reduce the number of cards left in terminals, consider not printing the cardholder’s receipt until after the card has been removed from the card reader. Another option is to have the terminal to produce an audible beep when the card should be removed. However, the tone and volume of the beep should not be such as to make the cardholder think they have done something wrong and cause confusion. Training employees on new chip processes is perhaps the most critical element to ensuring a smooth customer experience.
Will the magnetic stripe reader eventually be removed from chip terminals?
For the foreseeable future, magnetic stripe readers will continue to be a feature on chip-enabled terminals. This allows the terminals to continue processing transactions from the existing base of magnetic stripe cards in the market and also support fallback transactions.
Maintain an information security policy
#12. Create information security policies for all personnel. Anyone who comes in contact with any systems containing sensitive credit card data should be trained in your security policies. This requirement helps your business stay secure through transparent and meaningful communication.
Do chip transactions take longer to authorize than magnetic stripe transactions?
As mentioned above, customers and merchants may perceive standard chip transactions as more time-consuming than traditional swipe transactions. The actual transaction time is dependent on factors such as how the issuer personalized the card and how the terminal is configured. However, techniques like quick chip can improve both the perceived and actual speed of the transaction.
So what is “Quick Chip” and how can it benefit my business?
Quick chip (known as M/Chip Fast for Mastercard) is an approach to processing chip transactions that reduces the amount of time the card is in the terminal. The brands’ quick chip solutions employ two key functions to accomplish this reduction. First, a “placeholder” or pseudo transaction amount is provided to the card as soon as it is inserted into the terminal. This allows the card to create the dynamic data for the transaction without having to wait for the actual amount of the transaction to be known. For the cardholder, this means that the card does not have to sit in the terminal while their items are being rung up or that the cardholder is held captive by the terminal waiting for the prompt to insert their card.
Once the card has created the dynamic data, the second function is invoked in which the terminal requests the card to “complete” the transaction so the card can be removed. In a typical online contact transaction, this is done after the response comes back from the issuer. By using the quick chip technique, which is the same process used for contactless transactions, the card can be removed from the reader before the response comes back from the issuer. Solutions that are implemented using the quick chip process are able to reduce the time the card is in the terminal to less than a second in some cases. Merchants should be aware that PIN entry and prompting for features like cashback can impact the process and the time the card is in the terminal.
Does EMV chip processing require a PIN be entered on credit as well as debit transactions?
While PIN is now an option for credit as well as debit, none of the brands currently require PIN on credit transactions. The issuer will determine if a PIN is issued or not.
How does chip affect the price I pay for accepting card payments?
Interchange, which represents the largest percentage of the fees paid for accepting card payments, is not affected by EMV chip processing.
Does the adoption of chip eliminate the need for end-to-end encryption or tokenization?
No. Chip cards do not encrypt the transaction data (including the account number), so encryption and tokenization are still valuable tools in securing payment data.
Does EMV apply to online payments as well?
Online payments are currently not in the scope of EMV chip processing. Since there is no card-terminal interaction, no dynamic data is created. However, as mentioned earlier, EMVCo initiatives also include the next generation of 3D Secure and tokenization as well as newer concepts like Secure Remote Commerce to help secure online transactions. For now, cardholders are able to use their chip cards for online payments as they do today.
How do chip cards work with tablet-based POS systems?
To make chip cards work on tablet-based POS systems, a wired or wireless PIN pad (WPP) that can read chip cards is required. Additionally, NFC (Near Field Communication) for wireless will need to be activated on the tablet.
Conclusion
The introduction of EMV chip-enabled cards and terminals represented one of the single biggest changes in the payments industry. While the road has been bumpy at times and there is still much to learn in creating the best merchant and cardholder experiences possible, we can expect the chip to remain part of the landscape for years to come. The savvy merchant will use the lessons learned over the last several years to implement an effective and customer-friendly EMV chip acceptance experience.