In recent months, talk of Chip and PIN, “EMV” and smart credit cards has all focused on the impending deadline of October 2015. By that month, U.S. merchants are expected to have migrated to a different sort of payment system, one that depends primarily on an embedded chip rather than the traditional magnetic stripe; such technology already is in widespread use elsewhere.
But that’s not the whole story.
Despite the ever-increasing pitch of the conversation in the U.S. — reminiscent in some ways of the days prior to Y2K — the shift to the Europay, MasterCard, Visa (EMV) standard is an option rather than a mandate. And it’s one that even Visa specifically says small-ticket unattended merchants should consider carefully before making the jump. Here’s the word from a Visa Chip Payment Acceptance statement issued in 2014:
“As the U.S. migration to EMV chip continues, merchants who are not yet supporting chip processing are encouraged to carefully assess their point of sale (POS) environment in an effort to weight the costs and benefits of upgrading/replacing their existing system capabilities.
“This is especially important for small-ticket unattended merchants with low-value, low-risk transactions (e.g., parking meters, laundromats, car wash terminals, etc.). Before making any chip terminal hardware or software decisions, merchants in these segments need to clearly understand the what, why, and how behind EMV chip processing to select the right solutions for their business.
“As with any large-scale payment infrastructure change, merchants can often receive mixed and sometimes confusing messages from outside sources. With chip payment technology, any kind of misinformation can lead to invalid assumption and ultimately faulty business decisions.”
Yes, Visa mentioned car washes — unattended ones in particular. Take a look at any car wash or small business forum, however, and you’ll likely notice that confusion still abounds. Do you need to switch? And if so, do you need to switch now?
First, it’s important to note what happens — and doesn’t happen — in October. It’s not that cards without the chip will no longer be accepted, or that magnetic stripes will disappear. At least not at this point. Rather, the date marks a shift in liability for fraudulent transactions specific to lost, stolen or counterfeit cards; it does not protect against chargebacks.
Dave Richards, vice president at Genesys Technologies, parent company of payment solutions provider CryptoPay, recently facilitated a roundtable on the topic in Las Vegas. While there, he considered just how much risk is involved for the industry. Partner WorldPay offered some stats: Out of roughly 2 million transactions CryptoPay processed from April 2014 to April 2015, there were only five transactions reviewed for fraud analysis. That translates to one in 400,000 — and the risk of being killed by a meteorite is one in 250,000.
“If I go to the trouble of counterfeiting a credit card, am I going to go use it at a car wash?” he asked.
CryptoPay offers a different type of solution to the security issue; working though a proprietary wireless network, the swiper encrypts the credit card data at the moment of the swipe. The best way to protect that data, he said, is to not have it in the system in the first place.
So that’s one option. Here’s further food for thought:
Terminals that accept EMV
Car wash terminals that accept EMV payments are indeed available. Innovative Control Systems (ICS), for example, offers secure cash EMV payment terminals with point-to-point encryption and a Chip and PIN ready option. Exacta, too, offers an EMV teller with Chip and PIN capabilities. Just to clarify: Chip and PIN, the EMV option used most commonly outside the U.S., requires a four-digit personal identification number to reduce fraud. Chip-and-signature, the first step in the U.S. migration toward EMV, incorporates a signature rather than a PIN. But in general, the guideline that no signature is required for transactions under $25 will still apply. One additional note: Whether Chip and PIN or chip-and-signature, this type of card stays in the terminal throughout the transaction, rather than being used by a quick swipe. Some believe this will lead to forgotten cards by the time the wash is complete.
Then there’s the question of contactless tap-and-pay options such as Apple Pay, which uses a mobile device and near-field communication (NFC) for transactions. Here, the information is transmitted through radio frequency, and there’s no need for the credit card data to be stored in the phone. A unique number is automatically created for each transaction, increasing security.
Tap-and-pay (also known as wave-and-pay) allows the user to simply hold the credit/debit card close to the terminal to make the transaction. It may seem a long way off when it comes to payment terminals for car washes, but outside of the U.S., such contactless technology is increasingly seen as faster, more convenient and more secure — especially for small-value purchases.
According to the Smart Payment Association (SPA), the trade body of the smart payments industry, contactless technology represented more than 42 percent of total smart payment card shipments worldwide in 2014, up from 37 percent in 2013.
So just how popular are smart cards? EMVCo, which manages and evolves the EMV Specifications and related testing processes, reported in May that 3.4 billion EMV chip payment cards are now in global circulation. In addition, 32 percent of card-present transactions worldwide are now EMV. The U.S. remains dramatically behind. In one zone of Europe, 96.6 percent of card-present transactions were EMV during calendar year 2014. In Canada, Latin America and the Caribbean, the number was 85.41 percent. And in the U.S. during the same time period, 0.12 percent.
According to the EMV Migration Forum, an independent, cross-industry body created by the Smart Card Alliance in 2012, EMV chip technology “drastically reduces card fraud in a face-to-face card-present environment; provides global interoperability; and enables safer and smarter transactions across cards and contactless channels.” After the introduction of Chip and PIN in the U.K., card-present fraud dropped 75 percent, according to Financial Fraud Action U.K. But with that change, there also was a dramatic increase in card-not-present fraud (such as transactions made online) as a path of least resistance for criminals. Some actually credit the rise in large-scale retail data breaches in the U.S. to that fact. PwC’s “The Global State of Information Security® Survey 2014” reported that U.S. bank card fraud rates have risen by 70 percent since 2004. In addition, the August 2013 issue of The Nilson Report stated that the U.S. represented almost half of global card fraud losses in 2012 — even though the country generated only 27 percent of total card volume.
So, yes, the future will likely look quite different from the present as the U.S. attempts to continue combatting fraud. But it will take some time. Consider this: A Chip and PIN payment module underwent a trial in a self-service car wash on the north Wales coast as far back as 2007.
Even if EMV appears right for the rest of the world, that doesn’t necessarily answer the question of whether it’s right for your business. Thanks to the fact that the magnetic stripe isn’t going anywhere soon, smart card holders will still be able to use your terminals — even after October.