& Programs

Contact an Expert

Migration to Chip & PIN Payment Cards Shifts Burden of Liability to Retailers

Retailers who have not brought in point-of-sale terminals capable of reading and verifying chip credit cards should consider making the investment now. Without this technology, they will be liable for any fraudulent purchases starting next fall.

Retrofitted or new POS terminals and ATMs have to begin processing credit cards in compliance with “EMV,” which stands for the three companies that developed the inter-operability standard intended to stem fraud: Europay, MasterCard and Visa.

The credit card companies have warned retailers that they need EMV-compliant software and terminals in place by October 1, 2015, to have future liability for fraud covered by card companies. If retailers and card processors do not update their technology to EMV they will be liable for any fraud committed in transactions.

“The policy assigns liability for counterfeit fraud to the party that has not made the investment in EMV chip cards (issuers) or terminals (merchants’ acquirers). The policy encourages wider deployment of EMV cards and terminals,” according to a 2011 Visa Bulletin.

Visa and MasterCard Incentives
The chip cards – or integrated circuit payment cards – are called “chip and PIN” because POS terminals read the chip instead of the magnetic strip. To close the purchase, customers enter a PIN number or sign a sales receipt.

Called “dynamic authentication,” EMV offers a higher level of security because each transaction carries a unique cryptographic message. While Europe and other parts of the world have more fully adopted chip cards, the U.S. has been slow to warm up to the technology until now, as real deadlines loom.

Visa and the other two card companies have created incentive programs for merchants to adopt POS terminals and technology. In October 2012, Visa eliminated the requirement stating that eligible merchants had to validate compliance with the PCI Data Security Standard. Instead, the new requirement dictates that at least 75 percent of transactions must originate from chip-enabled terminals.

The terminals must accept NFC-compliant contact and contactless payments in order to quality. Chip-only or contactless-only payments will not be covered, however. Additionally, merchants cannot store security codes, PINs or track data, nor can they continue to follow PCI DSS standards.

MasterCard offers a similar set of incentives; among them relief from PCI audits and a 50 percent reduction in data breach liability for card-reissuance and fraud costs. To qualify, merchants must process at least 75 percent of their transactions on EMV-capable terminals. The relief will increase to 100 percent in data breach liability if merchants process 95 percent or more their transactions using EMV technology.

Behind The Push
The reasons for putting EMV into wider use is easy to understand. In 2012 global credit and debit card fraud cost $11.27 billion in the U.S., according to an August 2013 brief from Nilson Report. Of that total, 67 percent came from counterfeit cards used at the point of sale, with the loss incurred by card issuers.

Merchants absorbed the rest of the losses mainly through Web-based, call-center or mail-in transactions during which the card was not present and the numbers had been stolen.

The result is that Visa and MasterCard, which pay for the majority of the cost of fraudulent transactions, have opted to introduce a more secure system and shift the burden to merchants. Their losses will be reduced while merchants will have to pay closer attention to transactions, as well as implement improved technology to hold up their part of the bargain.

The liability shift provides incentive enough for merchants to invest in EMV-capable terminals.  If you are a merchant and you have not upgraded your POS system, start discussions immediately with your provider to assess the cost of upgrading to chip technology or buying new terminals. Talk to your POS software provider about compliance and upgrades as soon as possible.

Look to future-proof the system by ensuring any new terminals and software can be upgraded to manage new security innovations. Manufacturers in the field are looking to ensure their components can transition to any new technology that may be on the horizon.

While the liability shift may be disconcerting to merchants, they can still enjoy the many benefits that come with EMV. Transactions will be more convenient, customers will feel more secure, and check-out lines will move faster. Some POS systems will even send out mobile offers that can be redeemed on smartphones. In fact, EMV will pave the way for greater adoption of contactless smartphone payments in the future.

Thieves have plundered the credit card market for far too long. EMV will not solve all the problems of fraudulent card transactions, but it should make millions of transactions that occur every day much more secure.