Experts warn deployment could take longer than expected
Now that VISA and MasterCard have released road maps to EMV in the United States, the initial implementation milestone is fast approaching. With a first deadline in the fall there are some in the industry who wonder if the deadlines are too aggressive and whether the project could drag on for 10- years.
“The size and complexity of the U.S. market could potentially
make the rollout of EMV a decade-long exercise,” says Mads Petersen, CEO of CIM
USA. “Clearly the larger issuers can get cards on the streets quickly, but merchant
owned stand-alone terminals will be the last in the chain to be updated and will require
the most radical changes.”
In August of 2011, Visa announced its path toward EMV contact and contactless chip technology in the United States. The road map encourages investments in technology that will hasten the adoption of mobile payments and improve international interoperability.
The first initiative, effective October 1, 2012, has Visa expanding its Technology Innovation Program (TIP) to merchants in the U.S. “We still require Payment Card Industry Data Security Standard Compliance, but those merchants who deploy contact chip and contactless chip technology at their points of sale would have some reduced requirements for validating their compliance to PCI DSS,” says Stephanie Ericksen, head of Authentication Product Integration at Visa USA. “We’d like to see the U.S. infrastructure adopt dynamic data and begin to do that as soon as possible.”
For merchants to avoid the annual validation requirement, at least 75% of their Visa transactions must originate from chip-enabled terminals. The terminals must be enabled to support both contact and contactless chip acceptance–including mobile contactless payments based on NFC technology–and their systems must not store data, security codes or PINs.
Step two involves building the processing infrastructure for chip acceptance. VISA will require merchants to upgrade their systems to pass contact chip data or dynamic data from the acquirer system by April of 2013.
Then comes what Ericksen calls the final milestone in October of 2015–the liability shift. “The merchants that have not yet deployed contact chip technology at the point of sale may take on some additional liability for counterfeit transactions if chip could have prevented that counterfeit,” says Ericksen.
As the infrastructure is upgraded and these cards are more widely issued, Ericksen says anyone with a chip-enabled card will be able to go to a chip-enabled merchant. “Depending on the type of terminal the merchant has deployed, the cardholder will be able to either do an EMV contact chip transaction or a contactless transaction with their card,” says Ericksen.” Or if the merchant does not have contact or contactless chip, they can still swipe their card and do a mag stripe transaction.
It’s an approach that’s not unique to the U.S., according to Ericksen, who is combating the misconception that “chip” means “chip and pin.” She explains that many countries around the world have adopted EMV chip technology that is not based on chip and PIN.
It is true that in many cases EMV chip has been partnered with offline PIN. “That’s because the offline authentication that’s being used by the chip is coupled with the PIN to secure the transaction for the offline environment,” says Ericksen.
“We have an online environment here in the U.S. and there are many countries around the world that also have that as well,” she adds. Because of this, there is not the need to manage offline PIN and the complexities that come with it.
That’s the model VISA plans to deploy in the United States.
MasterCard pushes for PIN
MasterCard’s roadmap to EMV in the U.S. was released in January and like VISA, it has the same deadline of April 2013 for MasterCard’s acquirers to have their infrastructure ready, though it’s sliding scale of liability is less stringent.
While VISA’s road map veers away from chip and PIN, MasterCard is advocating for it’s adoption because it believes it to be the most secure method, says Colin McGrath, MasterCard’s vice president of Development in U.S. Markets. “We believe that will provide the best and most secure experience for consumers. It’ll provide the greatest security for issuers and for merchants, so everyone really benefits,” says McGrath.
But, he stresses, technology changes and market demands may lead to other approaches. “It’s difficult to predict what the future holds from a technology standpoint, so what we’re really trying to articulate is a framework that’s flexible and can be adapted to grow with whatever the changing technology presents,” McGrath explains.
“A lot of partners in the payments ecosystem are looking for that next advance. Where is it going to come from? We believe now is the time to get people on the same page about upgrading the infrastructure for the U.S. payments industry,” says McGrath.
Aggressive Timeline
Gregg Smith, co-founder and partner in EMV Academy, says EMV will not be easy to implement in the U.S. He thinks the timelines for VISA and MasterCard are too aggressive. “There doesn’t seem to be a lot of people jumping on the bandwagon yet because many don’t believe it is going to happen this fast,” says Smith. “I would say it’s going take two to three-years to get implemented, and probably in five-years it will be to where all of the other countries in the world are today. I think it’s going to be a lot longer process than people would like to believe.”
Smith says part of the problem is the sheer quantity of banks. While Canada has six major banks, he notes there are upwards of 14,000 community banks and credit unions in the U.S. “Execution is quite complicated,” says Smith. “There’s got to be several hundred acquirers and processors, and they have to get the back end ready to accept chip cards. The complexity is huge.”
Jeremy Gumbley, CTO at CreditCall, thinks the timing is right for companies to jump in now. “The great thing about the USA going to EMV now as opposed to earlier is that it can take advantage of the experience gleaned from the rest of the world migrating to EMV, avoiding the common mistakes that have occurred elsewhere,” he adds.
Complex Technology
Smith believes EMV in the U.S will migrate from chip and signature to chip and pin. Without chip and pin, he says, users are missing one of the key levels of security that EMV provides. “Data shows a big shift in fraud in this country now that other countries are certified,” says Smith. “U.K. tourists still get fraud, but they get it when they come here because their chip cards convert to mag stripe.”
Smith also cautions that there’s a shortage of people who know how to implement this technology. “There is no expertise in the U.S. to be able to tell people how to do this. The lack of resources, to me, says if you don’t get involved in this thing now, come the second half of this year, there may be nobody to talk to,” he says.
“If we took everybody in Europe that understood EMV and brought them here for a year to help out,” he concludes, “there still wouldn’t be enough.”