No one has approached us about EMV so I assume we do not need to do anything. Is that true?

Posted On: March 21st 2011

Depends on who you are? If you are a Merchant and there is talk about a liability shift that is/will be set in place then you need to start contacting your processor. If you are an Issuer than EMV could be a important business consideration. If you have international travelers or do cross border business with Canada (which is full EMV) for example, than you should consider EMV for your business.

False, in order to support EMV, you will need to perform a series of upgrades to your supporting systems. The biggest changes will be to your card creation / personalization system and your authorization / host systems.

Lessons learnt from other regions prove that the more preparation and testing done in conjunction with acquirers will ensure a smooth migration to chip.
Source: ICC

Not true, you can prepare for EMV now by educating yourself on the required available components, costs and timeframes necessary to support EMV whether you are a Card Issuer, Card accepting merchant, Point-of-sale systems provider, or Acquiring or Authorization Systems processor or software Provider.

The answer may depend on whether there are any mandated changeover dates from the credit card schemes (Visa, MasterCard, Amex, Discover, etc.) that will shift liability for fraudulent transactions from issuers to merchants as of a certain date. For debit in the US, less clear to me given the absence of an issuer-controlled Interac equivalent.

Does EMV change the way we take credit and debit at the POS?

Posted On: March 21st 2011

Yes, it is Dip and not swipe. Signature as authentication is decided by the Issuer/Card not terminal. At this moment in US debit cards use PIN and Credit use Signature. This will probably be evened out with the rest of the world and thus use PIN for both card products. With PIN you customers will not be able to give their cards to the clerk for payment. So consumer & Merchant training is needed to get them acquainted with entering PIN themselves. For merchants the interfaces with you processor is different. Have your processor educate you on the differences.

Yes, instead of swiping the card, the customer will need to insert their chip card into the reader on the pin pad or device used. The card will remain in the reader until the transaction is complete.

As a card accepting merchant, your cash register people could see some differences and similarities– they will not be swiping the card magnetic stripe. Instead, the purchaser will insert their EMV credit or debit card into your POS (Point-of –sale) device and could enter a card holder PIN (versus a signature) as part of the payment approval process.

Definitely. New equipment (especially of concern for retailers with integrated equipment today). Different authentication procedures. Change is likely more significant for debit than for credit given the prevalence of signature debit in the US.

Why move to chip cards? Can’t they be copied like mag-stripe cards?

Posted On: March 21st 2011

Yes they can. Fraud can never be prevented completely, but Chip does make it a whole lot more difficult for fraudsters to hack you card and do fraudulent transactions. The amount of security mostly depends on what you are able to invest in security? Chip gives you protection against copying and counterfeit while Magstripe does not.

The mag-stripe on chip cards can still be copied like before; however, chip card readers are designed to recognize chip cards even when swiped. When this happens, the terminal will ask the cardholder to 'insert the chip', rendering counterfeit mag-stripes useless.
Some data can be copied out of the chip card, however, the information required to complete a successful chip transaction cannot. This data is stored in a secure part of the chip that can only be accessed by the chip card itself.

Each smart card has a UID (unique identification) and digital signature that cannot be copied like the magnetic stripe.
If transaction information is duplicated, the bank issuer would deny the transaction during authorization based on duplicate information.
During an internet transaction, using a card reader attached to a PC, data on the chip can be used with a cardholder PIN/password to validate the cardholder. It is also possible that the card holder may use an OTP (one time password) that is good only for that specific Internet transaction which also provides online fraud protection.

The authentication information on the chip cannot be copied at present...although no technology lasts forever. But be aware, the mag stripe that may be retained on the chip cards can still be copied and exploited in a non-chip environment. Business case is a combination of fraud reduction and value-added features enabled by the chip card. The former has been easier to quantify in Canada, the latter has proven somewhat elusive to quantify.

How do I know that I won’t have to upgrade again in the near future?

Posted On: March 21st 2011

Again, this question depends on who you are? EMV has been around for 20 years and has been stable for quite some years now. All EMV updates are backwards compatible. If you decide in the future to make use of some of the other functionalities of EMV (like CAP, contactless, loyalty etc) then this will influence your system, e.g. terminal, Contract with your processor, your card. But this is a business decision.

Unfortunately, you don't. The adoption of chip cards into the payment system is the first step. In the future, you will be able to use chip cards as a tool to optimize marketing strategies, fraud prevention, risk management etc.... Depending on the type of features you would like to use, you might be required to further upgrade parts of your systems.

EMV is well established and so is its maintenance program. EMVCo is advised by payment brands, payment group organizations, and industry participants. It is a proven security method and is scrutinized by academics and fraudsters; hence undergoing continuous improvements by EMVCo.
Future specification upgrades may be necessary to keep up with any chip update features in point of sale equipment to continue PCI (payment card industry) security updates to maintain full merchant and cardholder data protection along with emerging chip technology updates for the card issuer and cardholder. This could be accomplished within a normal upgrade cycle.

You will. The only questions are when and why. No technology lasts forever.

Are you planning to introduce biometrics in the next few years and how would that work with an EMV terminal?

Posted On: March 21st 2011

EMV already has functionalities implemented with respect to biometrics. However at this moment worldwide there are no acceptance devices with Biometrics available in the market. Further the specs and standards on Biometrics are still in very early stages of development. Finally, Biometrics gives rise to other big problems that are currently talk of the day (what happens if my biometrics get compromised, I cannot get a new Iris?)

At this time, there are no plans to move to biometric customer authentication for payment products.

An example of biometrics used in conjunction with EMV technology – At specified card acceptance devices, a cardholders fingerprint could be read and matched against information stored on the chip card to validate the cardholder.

What are the steps and milestones for EMV conversion?

Posted On: March 21st 2011

As Collis we have a complete service solution that can help any customer (issuer or acquirer) fully migrating to EMV. We offer 4D (define, design, develop, deploy) migration services. These project phases guide any customer through all the steps required for a successful migration. This question also depends on who you are? What we do recommend is to start with getting your knowledge on EMV up to level.

Card Creation: You will need to implement a data preparation system to enrich your card creation / embossing files.
Authorization: You will need to upgrade all of your authorization systems from the PIN Pads to the host system to decrypt and process EMV data.
Customer / Employee Adoption: Many customers are not accustomed to using PINs to process credit card transactions. This will be a major learning curve for your customers and customer support staff.

Educating yourself; then Deciding, Planning and Doing – whether you are a as a Card Issuer, Card accepting merchant, Point-of-sale systems provider, or Acquiring or Authorization Systems processor.
Development time line depends upon the cooperation of multiple vendors. A complete turnkey solution could be beneficial but may not be the right thing for your organization. Build internal consensus for your solution and take advantage of your current payment environment and systems providers.

Where do we go for help? We are a mid size retailer and are unsure of timelines and options. We cannot afford to allocate a lot of resources to this, so waiting until the last minute would be a disaster for us.

Posted On: March 21st 2011

You can look for an integrator or go to you processor (large processors have migration services). Or you can go to Collis who can help you from start to finish and are independent so you do not have to worry for any lock ins.

The first step would be to contact your acquiring bank for more information. They should be able to provide you with some guidance regarding changes to policies and processes, and where to acquire new PIN Pads if required.

In some cases, you might be able to get some up to date and relevant information from the payment schemes you support (ie: MasterCard, Visa, AMEX etc...)

Speak to your acquirer and the card schemes as soon as possible, they will give advice on key dates and organizations that they endorse to assist with the chip migration.

Your current system providers (payment brand, payment group organization, point of sale servicer, acquiring processor) along with system integration service providers are aware of the required components, options, and implementation timelines necessary to get your EMV program launched hopefully within your normal system upgrade cycle.

Look to your retailer association or small business association to play a lead value-added role on behalf of its membership offering advocacy, communication and training, and aggregated purchase opportunities.


When should we expect customers to show up with chip cards and what do we do with them?

Posted On: March 21st 2011

There are over 1 billon EMV Cards in the world today, so chances are high that you will run into them. At this moment there is still magstrip on these cards and when there is no Chip acceptance, these cards will fall back to Magstripe or even to manual using the embossing. However, EU parliament today is discussing to get rid of the magstripe. Some EU countries today (UK) are even rejecting the use of Magstripe as it is the weakest link in card payments. This means that many UK travelers will not be able to use their card in the US. Furthermore, if you are in tourism or foreign affairs you probably have already been in contact with EMV as almost every country in the world is using it or in the process of implementing EMV (except the US).

Most of your international customers will already have chip cards, so expect to support them shortly after you upgrade your pin pads. Chip cards are quite easy to use if you follow the PIN Pad / POS prompts. If a chip cards is swiped it will ask you to insert it into the reader instead. Afterwards, the customer might be asked to confirm some information and enter a PIN. In some cases, chip cards will still require a signature, just like regular mag-stripe cards.

Chip cards are out there now, your staff should know if you are able to process a chip transaction or not.

Today ... In the USA, chip cards are in use (or plan to be in use within months) by several US based Federal Credit Unions, Financial institutions, as well as Debit and Credit card Issuers. Additionally, customers traveling globally from outside the US (Canada, Europe, etc.) have already been issued chip cards. As a card accepting merchant, if your point-of-sale device is not chip enabled, you would continue the purchase experience using existing magnetic stripe (along with PIN or signature) processes.

Depends on the plans of your issuers. You are already seeing chip cards in the hands of tourists from Europe and Canada. As Canadian cards have retained the mag stripe, they function as your current mag stripe cards do until your merchants change to chip-capable infrastructure.

Will it take longer to process payment with the proposed chip and pin? How does it compare to existing credit and debit and to cash?

Posted On: March 21st 2011

Yes and no. First off, it does not need to take longer. This all depends on how it is implemented (normally it is not implemented in the most efficient manor, resulting in longer transaction time). The processing of the payment takes just as much time as Magstrip transaction. Transaction can be longer if you use PIN for example or if you keep debit and credit as 2 products on 1 card (consumer needs to choose). But we are talking about seconds and not minutes.

Generally speaking, they are comparable. There are factors that can both speed up or slow down traffic in your lanes.

Factors that can speed up the transaction:

  • No need to give change
  • No need to check the signature (in most cases)
  • Card should not leave the customer's hand

Factors that can slow down the transaction

  • Customer does not know the PIN and needs multiple attempts
  • Cashier unaware of chip card process
  • More data being sent to the issuer's host system.

Source: Canadian Tire Financial Services

There may be a minimal speed difference to process a Chip and PIN versus a use of a magnetic stripe cards. The enhanced fraud reduction gained by an EMV chip transaction has to be weighted versus this transaction speed.

For what it's worth, my own observations at Canadian retailers suggest that the transaction times are actually faster, especially factoring in the lack of a required signature.

Going forward, will there be exceptions that allow cardholders to use signature rather than PIN and how will this work?

Posted On: March 21st 2011

The selection of method of authentication is determined by the Issuer. The issuer sets up the CVM (cardholder verification method) list on the cards. Every Issuer sets its own exceptions for using signature or manual (so there are exceptions).

Yes, depending on how the card issuer has setup their systems, it is possible to use signature rather than PIN. Different banks will do this differently for different reasons, the trick it to check the receipt. If the transaction was successfully completed using the PIN, the merchant copy will generally say so (where the signature line is supposed to be), but if a signature is required, the receipt will come out of the POS with a signature line.

Exceptions have been made in some regions for visually impaired but generally there are no exceptions. Terminals keypads have evolved and assist the visually impaired with entering their pin.

There could be instances (due to fall back processes or card authorization parameters) where signature could be accepted at the point-of-sale device as part of the transaction approval process.

That will presumably depend on the rules established by the card schemes for your jurisdiction.

How will customer training be handled? Who is responsible?

Posted On: March 21st 2011

There is no regulation on customer training. This is usually handled by central bank (e.g. UK) and or by issuing bank. Central bank makes advertisement campaigns. Issuing banks give each new cardholder a brochure/letter explaining the changes.

All parties involved are equally responsible for educating the customer since everyone has a stake in the process. When an issuer sends out the card, the carriers and brochures should include some information on the use of chip cards, while the merchants will be responsible for educating the customer in face-to-face situations. It is very important to keep your front-line employees up-to-date and well trained going forward.

The onus is on the merchant to train their staff. Assistance is out there in the form of test card packs.

Cardholders will be educated by their card issuing banks on how their EMV chip card can be used in the merchant environment. As a card accepting merchant, it will be of benefit for all register personnel be fully educated and trained on point of sale chip card acceptance processes.

I believe that both issuers and merchants have an important role to play here to ensure a smooth transition. Retailers should hold their acquirers accountable for providing excellent training and support throughout the conversion process. Merchants that provide good training to their staffs will reap the benefits of faster transaction times and fewer frustrated customers (especially important in high volume environments).