Today, at least some of the cards in your wallet are probably sporting EMV chips, and a growing number of payment terminals are inviting you to dip your card instead of swipe. As the year unfolds, however, you can expect more chips and dipping.
What the payment industry calls the EMV (Europay Mastercard Visa) liability shift is now in effect, urging issuers and merchants to adopt EMV chip-card technology. This is what you can expect in the coming months:
The switch won’t be instantaneous
October 2015’s liability shift is not a hard break between the old way (swiping magnetic stripe cards) and the new (dipping EMV chip cards). Instead, it’s an incentive to get issuers to upgrade their cards and merchants to upgrade their equipment to facilitate EMV.
Right now, issuers are financially responsible for any counterfeit fraud that takes place. Starting October 2015, whichever party (the issuer or the merchant) is responsible for a transaction going through as a magnetic stripe transaction rather than an EMV transaction will be held responsible by the card networks (Visa, MasterCard, etc.) if it turns out that transaction was fraudulent.
“If the merchant has not installed an EMV-compliant device and tested it with their acquirer, and a chip card shows up at their store, and it is a counterfeit card, the merchant would be liable for that transaction,” says Philip Andreae, vice president of field marketing for Oberthur Technologies. “Conversely if the merchant does install an EMV-compliant device, gets it certified and turns it on, the issuer retains the same liability for any transaction at that device.”
If both parties upgrade, the issuers remain responsible, although EMV does give them increased protection from counterfeit fraud and, if the PIN is enabled, from lost and stolen fraud too, Andreae notes.
The shift also factors into the growing issue of data breaches. Because EMV transaction data is unique to each transaction, it’s practically useless to thieves who want to use it to make counterfeit cards, explains Stephanie Ericksen, vice president of risk products for Visa. Magnetic stripe data is more counterfeit-friendly. Because cards with EMV chips are still being manufactured with magnetic stripes as well, your chip card data could still be vulnerable at merchants who need you to swipe because their terminals don’t speak EMV yet.
|Stats: EMV outlook for the U.S.|
“If I use a chip card as a mag stripe card at a merchant that hasn’t yet upgraded to EMV, that’s going to be mag stripe data stored in their system,” Ericksen says. “If that data is stolen, a fraudster may be able to make a counterfeit mag stripe card. In that situation, the issuer is protected because it’s a chip card. And the merchant would be liable.”
So, while the change to EMV won’t be immediate, the liability shift gives issuers and merchants a powerful motivation to limit their exposure and upgrade. By the end of 2015, the Payment Security Task Force (PSTF) predicts roughly 575 million payment cards (about half the cards in circulation) will have EMV chips. Broken down into credit and debit, 70 percent of credit cards and 41 percent of debit cards will be converted before 2015 draws to a close, according to the Aite Group.
In fact, issuers are getting chipped cards to market more quickly than expected. Oberthur predicted normal reissuance (issuers replacing cards as they expire).
“Instead, what we are seeing is accelerated and mass reissuance,” Andreae says, meaning issuers are busy replacing all cards within a three-to-18-month time table.
Merchants won’t be far behind: About 47 percent of merchant locations will be converted to EMV by the end of 2015, according to the PSTF.
Consumers have to get used to new behaviors
The swipe-and-put-it-back-in-your-wallet routine has become pretty ingrained for U.S. shoppers. However, EMV terminals require you to leave your card in the slot for the duration of the transaction, meaning some consumers may forget to take their cards home, says Andreae.
“In every market, we’ve had the same problem,” Andreae says. “The consumer is used to swiping and putting the card back. Now they have to dip it and leave it. Consumers forget their cards a couple times, and the clerks get used to saying, ‘please don’t forget your card.'”
You’ll have to swipe at some terminals, dip at others
During the EMV transition, some stores will have EMV-capable terminals, while some won’t. And just looking at the terminal may not be enough to tell the difference. About a third of the terminals already in the U.S. market have EMV slots, Ericksen says, but they don’t necessarily have the software enabled to accept chip transactions.
“So there may be some merchants that look like they have chip-capable terminals, but the reader might not be activated,” Ericksen says.
That might be confusing to consumers who won’t know when to dip and when to swipe.
“As more of those terminals become activated with software, consumers just need to know to follow the prompts on the terminal,” Ericksen says. “If they try to dip it and nothing happens, they can still swipe it. They shouldn’t assume there’s something wrong with their card.”
Video: Watch how to use your chip card in a variety of scenarios.
So which merchants are likely to implement EMV the soonest? Big-box retailers (designated as level 1 merchants by the card networks) will likely be “100 percent compliant by the October 2015 liability shift,” Andreae says. On the opposite end of the spectrum, the small mom-and-pop operations (level 4 merchants), which have what the industry calls “stand-alone” payment devices, will likely have their limited equipment swapped out by their acquirer or independent sales operator fairly rapidly before and after the shift.
Lagging behind will be all the merchants in between – the level 2 and 3 merchants. Such merchants likely have customized software that interfaces with their point-of-sale devices for add-on capabilities, such as sending restaurant orders back to the kitchen or applying discounts. And those software creators are just beginning to understand EMV and how to upgrade to support it, according to Andreae.
“There are thousands of them floating around the United States, ranging from Brother Bob who built something for his relative who owns a chain of stores, to the larger organizations with thousands of terminals,” Andreae says. “So, on the merchant side, especially those located in middle of America, and the medium-sized organizations, are the ones that are going to be most challenged [by EMV].”
Debit will lag behind but catch up
The first cards in the U.S. market sporting chips were credit cards (travel rewards cards in particular), rather than debit cards. Part of the reason, Ericksen says, was issuers’ desire to cater to their globe-trotting clientele.
“The earliest issuance of EMV cards was to consumers who travel internationally frequently, so they’d benefit from the improved acceptance experience of having a chip card,” Ericksen says.
Yet the main reason debit is lagging behind is the complexity of integrating EMV into the 16-plus debit networks in the United States. Other countries have national networks, but in the U.S., there are regional networks, Andreae explains. The Durbin Amendment, passed in 2010 as part of the Dodd-Frank Wall Street Reform and Consumer Protection Act, requires that debit cards support multiple unaffiliated debit networks (in addition to whichever one – Visa or MasterCard – is branded on the front). Turn your debit card over, and you might see which networks it supports.
The network used to process a transaction affects how much the merchant pays, and the Durbin amendment seeks to preserve network competition and the merchant’s ability to choose. Yet “all that choice creates confusion,” Andreae says, given that EMV wasn’t designed with the need to support routing card transactions through more than one payment network at the same merchant.
“Whether those unaffiliated networks are ready to support EMV is a factor,” Ericksen says. “Issuers are dependent not only on the primary network (Visa and MasterCard), but on the networks that they need to support and their readiness time frame.”
EMV debit is pushing ahead, though, with all parties involved working together to enable EMV debit transactions “with the objective of getting there by October,” Andreae says. There are EMV-compliant terminals that already support debit, he says, and networks that support EMV debit transactions as well. Bank of America, meanwhile, began issuing chipped debit cards in October 2014.
The U.S. is on target
While the U.S. is behind other countries in adopting EMV, now that it’s started, its migration won’t necessarily be slower.
“There’s a lot of really good progress happening in the U.S.,” Ericksen says. “We certainly have a very large market we’re moving to EMV, but in many ways we’re very much on par with the pace of migration we’ve seen in other major markets throughout the world.”
That’s an impressive feat, considering the United States is the oldest market in the world, in terms of having an electronic payments foundation. While other countries’ electronic payments infrastructures evolved with EMV, the United States didn’t have that benefit. Andreae compares implementing EMV in the U.S. to putting a water dispenser on a refrigerator built before the concept of water-dispensing fridges even existed.
“The later you are to market, the easier it is to embrace to today, while the earlier you are, the harder it is,” Andreae says. “Your children understand computers, and your mother is having problems. It’s a similar issue.”
So how long until EMV becomes the norm? It took four to five years in Australia, Canada and Brazil (markets that have already adopted EMV) for 90 percent of the payment volume to be conducted as EMV transactions, says Ericksen.
“That’s very much what we should expect in the U.S.,” Ericksen says. “Some momentum toward the liability shift date, and then a few years after the shift for gradual penetration and migration.”