U.S. EMV Migration And The Fight Against Fraud

The introduction of EMV Chip-enabled payment cards marks a major change for the global payments landscape. The new standard, which replaces the traditional mag-stripe cards with Chip-enabled cards, is an important move towards worldwide interoperability and a key initiative in the global fight against payment fraud. However, with staggered regional adoption rates and some significant technology implications, the payments industry must overcome a number of challenges if it is to realize these goals.

According to EMVCo, the organization that manages the EMV standards and associated compliance processes, there were 1.62 billion EMV-compliant payment cards in use across the globe in Q4 2012. In parts of Europe, 95 percent of terminals were Chip-enabled, compared to 79 percent in Canada, Latin America and the Caribbean, 77 percent in Africa and the Middle East, and 51 percent in APAC. All eyes are now on the U.S. as the last major economy to tackle the transition. The region has begun implementing its migration plan, which is an important move forward as, ultimately, the EMV business case relies heavily on global adoption.

This is particularly important when considering the goal of interoperability. U.S. citizens travelling abroad often experience difficulties when using their mag-stripe cards in EMV mature regions as some merchants refuse to accept the old-style cards. In a bid to offer a solution, financial institutions are issuing EMV Chip-enabled credit cards to U.S. travelers – although these often come with a notable cost and are commonly Chip and signature only rather than Chip and PIN.

The fight against fraud

Alongside interoperability, a key driver for EMV is the reduction of payment fraud. The new standard helps prevent fraud by making it much more difficult to create counterfeit or cloned cards – and the results are clear in regions where EMV is well advanced.

Recent statistics from the European Central Bank (ECB) revealed that, despite growing card usage, fraud in the Single Euro Payments Area (SEPA) – a mature EMV territory – fell 7.6% between 2007 and 2011. This decline is underpinned by a slowdown in the growth of ATM fraud as well as a 24% drop in fraud carried out at point of sale terminals. Similarly, the national roll-out of Chip and PIN in Canada in 2008 had a dramatic impact on fraud. Losses from card skimming in Canada fell from CAD$142 million in 2009 to CAD$38.5 million in 2012, according to the Interac Association.

Despite these figures, some retailers in the U.S. have questioned the cost of migrating to EMV. Some believe they would have to pay more to replace systems than they would to cover the cost of fraud losses if they continue accepting mag-stripe cards. The real issue, however, is that the payments ecosystem, and therefore payment fraud, is global. This means that the fight against fraud must be dealt with on a global scale.

The U.S. has experienced fraud migrating from mature EMV regions as fraudsters take advantage of loopholes in the international payment security landscape. A report from the European ATM Security Team in April 2013 found that five European countries had seen an increase in the number of “skimmers” attached to ATMs and other terminals. However, fraudsters can only use the cloned cards in non-EMV regions, where ATMs and merchants still accept the mag-stripe standard. This is probably why the recent ECB statistics also showed that in 2011, 78% of the total fraud with counterfeited cards was carried out in non-SEPA countries – such as the U.S. This figure is up from 61% in 2010.

[See Also: MasterCard, Visa Team Up on EMV Chip Technology]

Tackling the technology shift

It is understandable that the U.S. has taken its time to confront the transition. This is a huge undertaking, with organizations having to overcome many technology hurdles. The U.S. has a larger payments ecosystem than most, so it faces a migration project on a vast scale.

The move affects both hardware and software, including every card payment system, device and application. Merchants must upgrade, modify or replace every terminal, so manufacturers and integrators will need to understand the EMV requirements so they can provide the right solutions that meet this demand. An important deadline is the liability shift in October 2015, which will see responsibility for fraud pass to merchants. Failure to be EMV-ready in time could mean that merchants will bear the burden of fraud losses carried out on mag-stripe cards if everyone else in the payment chain is already compliant.

Banks will also need to reissue their payment cards while processors will have to deal with the huge volume of testing and certification requests from merchants. The various stages of testing and certification are enforced by EMVCo to ensure a common standard between all the EMV cards and terminals. They include end-to-end testing, covering the payment gateway through to the payment processor, as well as the EMV Level 1 and Level 2 testing at the card reader. This entire process is time consuming and costly, with resources in short supply.

However, while there are some major challenges, there is a real opportunity here for the payments industry to deploy a consistent, collaborative and global approach. The U.S. is now in the advantageous position of being able to deploy tried and tested approaches. Once its migration is complete, the entire international payments industry stands to benefit – and that includes banks, merchants and, ultimately, the customers.

Jeremy Gumbley is CTO of CreditCall