ABCs of EMV
Credit card security upgrades weigh heavily on Columbia’s retail industry.
Riding my bike home from the store on the MKT Trail a few months ago, I lost my Chase debit card. The plastic bag hanging from my handlebars had a hole in it, and somewhere during the ride, my card had wormed its way to freedom. I looked around once I had realized it was missing, but I didn’t look too long; Chase Bank had sent me a letter a few days before that said a new card was being sent in the mail, and should be arriving any time. The letter said something about a new chip embedded in the updated card, which was supposed to offer me greater protection from fraud. Perfect timing.
I skimmed over the letter once I had made it home and canceled my lost card. Having been a victim of credit fraud before, I wanted to know a little bit about this new chip card that the letter called “EMV-ready.” A few years ago, an unidentified thief used my debit card information to take out a $600 car ad in The New York Times classifieds, so I was intrigued by the chip technology, and what it had to offer me. But what exactly is EMV, and what does it mean?
What does EMV mean for cardholders?
EMV stands for Europay, MasterCard and Visa, the three companies that developed the framework for the new technology. EMV encompasses a complex set of specifications and technological advancements in credit cards and credit card payment devices to better protect consumers from card-present transactional fraud. Card-present means the buyer uses their card at a payment terminal, like at the grocery store or ATM, and does not include online purchases. The migration to EMV technology in the United States officially began on Oct. 1, when a credit liability shift between banks and merchants went into effect. More than 80 countries around the globe have partially or fully made the transition in the past decade, according to EMV-connection.com. Credit card issuers like American Express, Discover, MasterCard, NYCE Payments Network, Accel, Visa and more are all taking part in the move. The most important change for consumers is the addition of microprocessors, embedded in credit and debit cards, that make the holder’s information more difficult to counterfeit as compared to traditional magnetic-stripe-only cards.
EMV-connection.com says that more than 2.3 billion chip payment cards are in use around the globe, that 99.9 percent of payment terminals in Europe are chip-capable, and 84.7 percent of terminals in Canada, Latin America and the Caribbean are EMV-ready. The U.S. just became the final major world market to make the switch to EMV. Because America has been so adept at catching fraud in the past, the transition to the new technology hasn’t really been necessary until now.
“Basically, fraud has become more sophisticated in recent years,” said David Shipper, vice president of payment products at Landmark Bank. “In the United States, it’s not a requirement to make the switch to EMV, but both banks and merchants are encouraged to move their cards from typical mag-stripe cards to ones that have the chip. Those transactions that are processed with the chip are more secure…unless somebody actually stole your card, they wouldn’t be able to just take the information off the chip and make a fake card with it.”
So the shift to EMV technology for banks and merchants is not a legal requirement – it’s more of a security suggestion.
This is exactly the danger of magnetic-stripe cards, as it has become relatively easy for criminals equipped with specialized counterfeit equipment to steal a person’s card information and create a duplicate. According to 2013 statistics from the Nilson Report, the United States accounted for nearly half of all global payment card fraud losses, despite only generating 23.5 percent of the global sales volume. Gemalto, a world leader in digital security, revealed that around 1,500 data breaches in 2014 led to more than one billion data records being compromised last year alone, with data breaches up 49 percent from the previous year. Information security is a huge problem that affects millions of people worldwide every year, and the hope is that EMV technology can give consumers some peace of mind. Shipper says it’s important to remember that the consumer will always be protected, either by the merchant or by their bank, from credit fraud, whether they have an EMV card or not.
What does this mean for business?
For retailers and business owners, fraud liability under EMV has undergone some big changes since Oct. 1.
In the past, it was the bank’s responsibility whenever card-present fraud arose, and the card issuer would work with the consumer, eating the fraud charges and protecting the cardholders from thievery. Now that the EMV migration has begun, U.S payment networks have shifted fraud liability in some instances, so it is now the business’ responsibility – not the bank’s – to handle fraudulent transactions. This affects any business that accepts physical credit card transactions, even if they use a point-of-sale system like Square or ShopKeep. If a criminal fraudulently uses a chip-enabled card at a payment terminal that is not EMV-compatible, the business owner is responsible for the fraud.
EMV chips add a new layer of protection by creating a unique authorization code every time the card is processed at a terminal. In order for the chip technology to be utilized, the point-of-sale terminal owned by the merchant needs to be chip-compatible. Instead of swiping, buyers with EMV cards will “dip” their card into a special slot in the terminal and leave it in the machine for the duration of the transaction, which can take up to 20 seconds.
Ron Catalano is the co-owner of Missouri Restaurant Solutions, a full-service dealer that sells point-of-sale equipment and software to food, beverage and hospitality companies. He explained that, depending on what equipment and software a business has used in the past, the update process could include purchasing new point-of-sale hardware, like register terminals or card readers, as well as upgrading the software that connects the business to a credit card processing company.
It varies from business to business, but many independent retailers are now faced with purchasing thousands of dollars of new equipment to become EMV-compliant and protected from fraudulent transactions. “The machines are swapped out for EMV-capable machines,” Catalano says. “If you wanted to integrate with your point-of-sale, so you don’t have to batch out your POS and your credit card machine, then the software has to be EMV-capable too. And there are quite a number of standards and qualifications that have to be met in order to integrate with EMV.”
The new terminals range anywhere from $50 to $1,000, not including the cost of software updates, and every business must also undergo an EMV certification process to become officially compliant. Depending on how many point-of-sale terminals a business has, these costs can add up quickly.
Brendan Coughlin, a recent MU graduate, started a business in July 2015 to help business owners negotiate fair rates with credit card processing companies. The result was AllianZ Consulting Solutions, a Columbia-based, two-man firm aimed at helping small-to-medium-sized retailers negotiate the Wild West that is the credit card processing industry. For many small business owners, the EMV migration has just become one more complex issue in an already complicated affair.
“All businesses who want to accept cards at their stores must have one of these processing companies, and they pay these huge corporations thousands and thousands of dollars each year,” Coughlin says. “It’s costing companies literally thousands and thousands of dollars, and these are the small, independent businesses in town that are struggling the most. If businesses are paying their processors and their banks thousands of dollars a year, you would think the new equipment might be free. That’s not the case.”
Coughlin says that business owners have the option to rent or buy their EMV equipment, and that they can work with point-of-sale merchants to figure out the most affordable and appropriate plan. But it’s also important to remember that there is no law that states a business must transition to EMV technology. For business owners, the decision comes down to a cost-benefit analysis: does it cost more to become compliant or does it cost more to be responsible for fraud?
What do businesses think?
This is a decision each business owner will have to make themselves, and it varies largely from merchant to merchant. For example, a car dealer who handles big-money transactions on a regular basis would have more to lose from a fraudulent transaction than a local bookstore or bar, where sales amounts are low.
“Take a typical sports bar,” Catalano says. “We’re looking at a breach being per check, per transaction, and given that it’s the big, huge check items like a television or furniture or jewelry, those are the folks that have to be very concerned because one transaction is a big one. Whereas if you’re a sports bar, and one transaction is a few beers and some chicken wings for $32.50, it’s not that big of a deal. If a criminal has a fake credit card, they’re typically not going to bounce around town and go to a couple restaurants, they’re going to buy big ticket items.”
Even so, Catalano suggests that small business owners take the EMV liability shift seriously and consider the benefits of protecting themselves by becoming compliant.
Andrew DuCharme, Lakota Coffee’s general manager, became EMV compliant before the Oct. 1 deadline, and he says there’s a learning curve for the employees and customers with the new system. Instead of updating an entire point-of-sale system, DuCharme says Lakota has independent chip card readers that are connected to the register terminals. In order to run a transaction, the customer has to insert their chip cards into the reader before the order total is manually typed in and the transaction goes through.
“It’s pretty smooth, it just takes forever to run through,” DuCharme says. “If you were to swipe a card, it takes about three seconds. If you are to input it with the new chip reader, it takes about 15 seconds, so it’s slowed down our transaction times dramatically. [The customers] hate it.”
DuCharme sees the switch as a hassle to his business and his customers; one that doesn’t add any protection to his store and has slowed down his service time. He isn’t alone in his frustration.
James Kanne, owner of 9th Street Public House, is in the beginning phases of making the EMV transition. It wasn’t until a few weeks ago, when he got his personal chip card in the mail, that the actuality of the migration hit him. “I’ve been looking into it as much as I can,” he says, “and I don’t know too much about it other than the fact that I have to buy new hardware that can read these chips.”
Kanne says he’s waiting for more information about EMV cards, and he might be waiting a while. Even though the liability shift has been in full swing for two months now and banks have been issuing cards to their customers, Kanne and other business owners still feel confused about the whole deal. He wonders why his card processor and his point-of-sale supplier haven’t talked with him about the update more.
“It’s just feeling totally like a hassle to me, like there’s something conspiratorial about it,” Kanne said. “I feel like I’ve been forced into a system and have to pay more now, and nobody’s told me why except that it’s more secure. This stuff is really expensive — really expensive — and that was a huge expense when I started two years ago. And now it’s outdated.”
Kanne was happy to hear that the new cards are supposed to be more secure for his customers, though he seemed upset by the news that the new readers can take up to five times longer to complete a transaction than before. As an owner of a business where transaction speed plays a huge role in day-to-day success, Kanne was shaken by the news.
“That’s a huge problem,” he says. “On a busy night, a 20-second sale times three — that’s a whole minute — that’s a huge amount of time when my bartenders are all standing at the same terminal waiting for a sale to go through. That’s terrible.”
Increased transaction times affect the consumer as much as the business owner, as customers might get frustrated at having to wait longer for their chip-card sales to go through. Consumers tired of plodding EMV transactions might prefer to use more traditional payment methods, or even mobile applications like Google Wallet or Apple Pay. Kanne says he hopes to have some sort of mobile payment system for his bar in the future, so that patrons could establish a gratuity when they walk in, track their purchases on their phones, and close their tabs without ever having to use a credit card or cash.
Lydia Melton, owner of the European gastropub Günter Hans, currently uses the iPad point-of-sale ShopKeep to handle her restaurant’s transactions. The cloud-based service is not yet EMV-ready, though they’ve assured Melton that any chip-card related fraud would be taken care of by their company until the new systems are available. Melton is generally happy with the update though, and she’s happy her customers will now have extra protection from fraud. She currently has the new card readers, but they aren’t ready to be put into use — though once they are, Günter Hans will be compatible with both EMV and Apple Pay.
“It was an expensive transition,” Melton says. “Those card readers aren’t cheap — especially considering I can’t even use them yet. I do think though it’s really nice for my guests, especially being in the bar and food industry, it’s great because it really does protect the consumer. It makes me feel good as an owner knowing that my customers will be protected.”
All told, the EMV transition is a multi-tiered affair. It affects consumers who will have to change the way they shop at brick-and-mortar stores. It affects business owners who count on easy transactions and avoiding fraudulent charges. It affects point-of-sale providers and credit card processors looking to push the United States into an updated commerce world. Moving forward, business owners will need to evaluate whether or not the costs of updating are worth it for them — and which way the retail landscape is shifting.