EMV Mandate: Why U.S. Retailers Must Get Ready
Your customers are not liable for credit card fraud by federal law. U.S. credit and debit card companies have been paying the tab for fraudulent charges. But that ends on Oct. 1, 2015, thanks to the 2015 EMV (Europay, MasterCard, and Visa) Compliance Mandate.
Lowdown on EMV Compliance and Liability
Pushed by mounting fraud costs, credit card companies expect U.S. retailers to switch to sophisticated readers needed to accept EMV “smart cards,” which have an embedded microchip. The updated technology reduces fraud-related chargebacks, increasing protection from card skimming, magnetic strips, as well as has dynamic authentication possibilities.
In less than five months, U.S. retailers that don’t have the mandated chip-compatible card readers will be held liable for some fraudulent transactions when a loss occurs from accepting payments through a magnetic stripe card reader. While there isn’t much time left to get EMV-compliant, it’s in U.S. retailers’ best interests to reduce their risks.
“If you look at the most recent research, (Ponemon Institute’s annual study) the global average for a data breach is more than $3.8 million ($165 per stolen record). However, some of the more notorious breaches are significantly higher, including Target (which stated their costs would be $148 million) and Home Depot ($70 million and counting),” said Erik Bilicki, national retail practice leader for Insight.
“But the biggest factor isn’t the expense — it’s the loss of trust with the consumer and the subsequent revenue loss from the diminished spending. Not every impacted consumer will continue to shop at affected retailers.”Tweet This!
U.S. Is Last in EMV Line
The United States is one of the last countries to migrate to EMV chip technology, although it has been in use around the world since the early 2000s. According to Creditcards.com, cost is the No. 1 reason U.S. retailers haven’t switched, including $200-600 per terminal, possible upgrades to point-of-sale (POS) systems and employee training.
American Express, Discover, MasterCard and Visa have started moving to a chip-based payments infrastructure in the U.S., joining 80 countries globally. Australia, Canada and countries in Latin America, Europe and Asia have largely implemented these EMV-compliant cards with fraud reduction being the chief rationale. Unfortunately, U.S. chip-enabled credit cards may not be as safe as in Europe — yet.
Chip-and-PIN vs. Chip-and-Signature Cards
In Europe, they use “chip and PIN” cards. The chip gives one level of security by creating exclusive codes for every transaction, making it difficult for counterfeiters to copy your card. Also, customers must enter a PIN number for each purchase, providing an extra layer of security.
Since the UK deployed EMV chip-and-PIN cards in 2004, overall card fraud in that country has dropped significantly. Between January 2013 and June 2013, fraud losses on UK cards totaled $216.1 million — 29% less than in the equivalent period in 2008, when fraud was at its peak, according to the most recent figures from the UK Card Association.
In the United States, most of the EMV-enabled cards are “chip and signature,” which U.S. banks have opted to issue instead of chip-and-PIN cards. The second layer of security is simply the purchaser signing on the dotted line, which any fraudster can do if the card is stolen. However, the new chip-encoded cards do offer better security than swipe-and-signature cards. And bank industry officials say the new generation of credit cards will solve this.
“In addition to the security features of the cards themselves, it will now be standard practice for the consumer to never lose sight of their card,” explains Kelly Long, Apple partner champion at Insight. “At restaurants, for instance, how often do we hand over our cards to waiters with no hesitation? When in reality, they could easily go to the back, write down the card information and make a purchase before you even leave a tip. Terminals will have to be mobile with the new process. Luckily for my team, there are plenty of iPad POS cases available that don’t only accept chip cards, but Apple Pay as well. And with iPad Minis weighing in at .75 pounds, it beats lugging a whole register around.”
Here’s what you need to know now about EMV cards:
1. Start Planning
You need to be proactive about considering the best solution for your business, as systems take four to five months to set up. It’s important to note that chip-and-signature cards will still have magnetic strips, and most EMV terminals have mag stripe, tap-and-go, Apple Pay and EMV technology.
2. Implications for U.S. Retailers
Javelin Strategy & Research forecasts U.S. to reach global parity in EMV by 2018. “Before the shift can take place, the industry needs to focus on primarily educating consumers and merchants, while in tandem developing a roadmap for retiring the magnetic stripe from card payments,” said Nick Holland, senior analyst, payments for Javelin Strategy & Research.
3. The Exception for Gasoline Retailers
With more intricate and expensive technology, gasoline retailers are granted a lengthier timeline, allowing them to make the switch by October 2017. After that, they’ll also be responsible for fraud loss if it’s due to not being able to accept chip-and-signature cards.
As you work hard to become compliant with the EMV mandate, Insight is here to help implement a fully integrated, cost-effective EMV solution — from consultation and deployment to maintenance.
Here’s an infographic of the key takeaways of the mandate to guide your EMV-compliance activities.