EMV: The Future is NowEMV: The Future is Now

EMV: The Future is Now

Moderator:Jason Putnam

Vice President of Sales, First American Payment Systems

Panelists:Patty Walters

Senior Vice President of Merchant Products and Security, Vantiv

Greg Boardman

Senior Vice President of Product and Development, Ingenico

John Badovinac

Senior Manger US Acquirer Relations, Discover Financial Services

2

Session Objectives

EMV - What is it?

Why does it matter?

How does it impact me?

What opportunities does it create?

What should I be doing right now?

Who can help?

EMV: The Future is Now

3

EMV – What is it?

Global standard for chip card technology Developed by Europay, MasterCard and

Visa in 1993

Typically a chip inset within a plastic card Chip stores cardholder and application

data more securely EMV provides protection against card

reproduction fraud EMV can be contact or contactless

4

Cards include microprocessor chip that stores info securely and performs cryptographic processing during transaction a payment transaction

Even if fraudsters are able to steal account data from chip transactions, this data cannot be used to create a fraudulent transaction in an EMV or magnetic stripe environment, since every EMV transaction carries dynamic data

Can address card-not-present fraud if cardholders use their EMV cards and individual readers to authenticate Internet transactions

What are the Specifics?

Card authentication protects against counterfeit fraud

Cardholder verification protects against lost and stolen fraud

Issuer and Acquirer defines rules used to authorize transactions

EMV – Why does it matter?EMV Reduces Fraud

5

• BOTH CARD & TERMINAL capabilities impact authorization, authentication & CVM’s used for any given transaction

• Offline data authentication may still happen even though a transaction is ultimately sent online for approval

EMV – Why does it matter?EMV Reduces Fraud

6

EMV – Why does it matter?EMV Reduces Fraud

In 2011, there was no spike in fraud due to holiday season

2008 – 2010, Canada noticed increased peaks of fraud due to

holiday season

As EMV penetration at POS increased, counterfeit as well as other types of fraud decreased

7

EMV Global Penetration

31.2% of cards

76.5% of terminals

73.9% of cards

89.0% of terminals

17.6% of cards

60.7% of terminals

27.0% of cards

43.0% of terminals

12.7% of cards

65.4% of terminals

* Figures reported as of Q1, 2011 and represent the latest statistics from American Express, JCB, MasterCard, and Visa, as reported by their member financial institutions globally. Figures do not include data from the United States

Canada, Latin America, and the Carribean

Asia Pacific

Africa and the Middle East

Europe Zone 1

Europe Zone 2

United States

EMV – Why does it matter?EMV Provides Global Interoperability

8

To implement EMV we need to:

Build EMV Processing infrastructure

Establish merchant acceptance for EMV

Encourage issuance of EMV cards

Payment networks have facilitated this by issuing compliance guidelines in their annual release:

Setting standards/timelines for processing capability

Promoting acceptance

Promoting issuanceLiability Shift

EMV – How does it impact me?

9

Dates VISA MasterCard Discover American Express

Oct 2012 • Technology Innovation Program (TIP) Annual PCI DSS audit relief• 75% Visa transactions must originate from EMV-chip terminals • Terminals must support both contact and contactless including NFC

April 2013 •Acquirers and sub-processors must support EMV (Mandate)

•Acquirers / sub-processors must support EMV•Maestro ATM liability shift1

•Acquirers, sub-processors, direct connect merchants support EMV elements

•Acquirers and sub-processors must support EMV , including mobile (Mandate)

Oct 2013 •Merchant Account Data Compromise(ADC) relief (Phase I)

•TBA • PCI DSS relief •75% of transactions occur on Amex EMV chip-based contact and contactless devices

Oct 2015 •US Liability Shift1 •US Liability Shift2

•Merchant ADC Relief (Phase II)

•TBA •US Liability Shift

Oct 2016 • US liability shift for ATM transactions

•TBA

Oct 2017 •Automated Fuel Dispenser (AFD) Liability Shift1

•AFD Liability Shift2 •TBA •AFD Liability Shift

EMV – How does it impact me?

1 Liability for counterfeit transaction shifts to terminal owners if they don’t accept EMV2 Liability for counterfeit transaction shifts to party who has least-secure support 10

An EMV card is inserted into a terminal The chip embedded in the card contains encrypted data,

this is accessed by the reader in the terminal Using data from the card, the terminal creates and sends

a unique code, or “cryptogram” to the processor’s host during the transaction, validating the card

The card is removed when the transaction is completed

EMV – How does it impact me?EMV How it Works

11

The Authentication Process

EMV – How does it impact me?EMV How it Works

12

An EMV chip can be on a “contactless” card where the chip is “tapped” or “held” near the terminal …..or…..

A chip can be inside your smart phone and the phone is “waived” near the terminal…

Mobile wallets (eWallets) are rapidly growing in number, which multiplies the opportunity for incremental sales for merchants and new revenue options for ISOs

Remember that the incentives from the card brand associations are predicated on accepting both contact and contactless EMV as well as NFC

EMV – How does it impact me?EMV How it Works

13

EMV – How does it impact me?EMV Implementation Impacts

Modify the Terminal-to-Acquirer interface to support EMV

Add EMV data elements to authorization and clearing messages

Review disputes processes to support EMV

Provide user guides and technical specifications

Update policies, procedures, and operating regulations to incorporate EMV

Facilitate the testing and certification of network partners to ensure they can properly support EMV

Support EMV data elements in authorization messages

Define how chip cards will work

Enhance risk management systems

Determine the card migration strategy

Update customer support and operational systems

Obtain and store required security data

Enhance data preparation and card personalization

Achieve certification

Terminals Acquirer Network Issuer Card Production

Install EMV security data in terminal and upgrade to process EMV transactions

14

An EMV chip can make decisions and do calculations An EMV chip can operate ‘offline’ and speed transactions

for transit, sporting events, concerts, etc. An EMV chip can provide access control credentials for

identification and campus access EMV is enabling new payment technologies that will

accelerate the development of mobile payment solutions

EMV - What new opportunities does it create?

15

16

EMV - What should I be doing right now?

16

Designate an in-house EMV expert / program owner (critical for large merchants / ISO / Processor)

Ensure POS providers / VARS aligned with EMV (including plan and roadmap)

Ensure POS that I own or will soon own supports all payment types

Remember: Contact, Contactless / NFC, and magstripe

My NFC support includes mobile wallet (of my choosing)

The device bears all the necessary approvals (Lvl1, Lvl2, C’less approvals, PCI PTS)

Remember that V1 expires in 2014!

Ensure the ability to remotely manage (some peripherals may not accommodate this)…

Ensure EMV migration dates coincide with the Payment Network’s key dates for compliance

Ensure POS provider can assist in the migration process

Ensure processor / acquirer is available for the migration and planning

I have received my end to end certification process from them (if applicable)

I have all the test tools I need (cards, etc.)

Develop a training program for my personnel

To understand the new payment types

To understand the changes in consumer behavior at the POS

To dispel myths

EMV - What should I be doing right now?

17

Small Typically tier 4 Simple structure Small EMV footprint Easy conversion Single – several store Storefront

Mid-sized Typically tier 3 Small structure Light EMV footprint Small conversion Regional chains Storefront E-commerce

Large Tier 2 level merchant Large structure Large EMV footprint Challenging conversion Regional – nat. chains Storefront E-commerce MOTO Field Services

Super Tier 1 level merchant Complex Structure Huge EMV footprint Integrated POS Difficult conversion National chains Storefront E-commerce MOTO Field Services Multiple brands

EMV - What should I be doing right now?Retail Infrastructure Use Cases

18

EMV - What should I be doing right now?Retail Infrastructure Use Cases

19

Setup POST Register Controller Switch End to End Cert Processor Impact

HW SW HW SW SW SW SW

Countertop POSTReplace w/new POST - - - - - Low

Countertop POSTAdd all-in-one PINpad - - - - High

Mobile POSTReplace w/new POST - - - - - Low

POS w/mag wedgeReplace w/CT POST - - - - - Low

POS w/mag wedgeReplace w/PINpad - - - Medium

Integrated PINpadReplace w/new PINpad - High

Integrated wedgeReplace w/PINpad - High

Smart phone integratedReplace w/EMV dongle - High

Smart phone stand aloneReplace w/EMV dongle - - - - - Low

EMV - What should I be doing right now?Merchant Impact Chart

20

http://www.emv-connection.com/

http://www.smartcardalliance.org/Main page:

EMV Migration:

CSCIP Certification Program:

Roadmap whitepaper:

http://www.smartcardalliance.org/pages/activities-leap-about/

http://www.smartcardalliance.org/resources/pdf/Payments_Roadmap_in_the_US_091512.pdf

EMV – Who can help?

21

http://www.merchantadvisorygroup.org/Main page:

EMV – Who can help?

22

http://www.emvco.com/Main page:

Best Practices:

Guide to EMV:

White Papers:

http://www.emvco.com/best_practices.aspx

http://www.emvco.com/best_practices.aspx?id=217

http://www.emvco.com/best_practices.aspx?id=33

EMV – Who can help?

23

http://corporate.visa.com/newsroom/press-releases/press1142.jsphttp://discovernetworknews.com/stories/discover-implements-emv-mandate-for-u-s-canada-and-mexico/http://newsroom.mastercard.com/press-releases/mastercard-extends-u-s-emv-migration-roadmap-to-atm-channel/

http://blog.visa.com/tag/emv/Blogs:

Press:

Portals: http://www.mastercard.us/mchip-emv.html

EMV – Who can help?

24

Solutions Providers

White papers:

FAQ:

Press:

Portals:

Blogs:

http://pymnts.com/assets/Shared/Gemalto-EMV-Whitepaper.pdf

http://pymnts.com/briefing-room/security-and-risk/EMV/Ingenico-s-Denis-Predicts-the-Future-of-EMV-in-North-America

http://ingenico.us/solutions/emv-payments/

http://ingenico.us/solutions/emv-payments/

http://blog.verifone.com/uncategorized/a-four-step-guide-to-emv-for-merchants-part-iii/

EMV – Who can help?

Consultation Training Advocacy Enablement Presence

25

1099 Days remaining to

October, 2015 liability shift

days remaining

Start Planning Today!

EMV - What should I be doing right now?

26

EMV: The Future is Now

Q&A

EMV: The Future is Now

Q&A