FAQs About EMVs
By SIENNA KOSSMAN
The nationwide shift to EMV is well underway.
EMV — which stands for Europay, MasterCard, and Visa — is a global standard for cards equipped with computer chips and the technology used to authenticate chip-card transactions. In the wake of numerous large-scale data breaches and increasing rates of counterfeit card fraud, U.S. card issuers are migrating to this new technology to protect consumers and reduce the costs of fraud.
“These new and improved cards are being deployed to improve payment security, making it more difficult for fraudsters to successfully counterfeit cards,” said Julie Conroy, research director for retail banking at Aite Group, a financial industry research company. “It’s an important step forward.”
For merchants and financial institutions, the switch to EMV means adding new in-store technology and internal processing systems and complying with new liability rules. For consumers, it means activating new cards and learning new payment processes. Most of all, it means greater protection against fraud.
Here are some frequently asked questions to help explain the changes.
Why Are EMV Cards a More Secure Option?
That small, metallic square you see on new cards is a computer chip, and it’s what sets apart the new generation of cards.
The magnetic stripes on traditional credit and debit cards store contain unchanging data. Whoever accesses that data gains the sensitive card and cardholder information necessary to make purchases. That makes traditional cards prime targets for counterfeiters, who convert stolen card data to cash.
“If someone copies a magnetic stripe, they can easily replicate that data over and over again because it doesn’t change,” said Dave Witts, president of U.S. payment systems for Creditcall, a payment gateway and EMV software developer.
Unlike magnetic-stripe cards, every time an EMV card is used for payment, the card chip creates a unique transaction code that cannot be used again. If a hacker stole the chip information from one specific point of sale, typical card duplication would never work “because the stolen transaction number created in that instance wouldn’t be usable again and the card would just get denied,” Witts explained.
EMV technology will not prevent data breaches from occurring, but it will make it much harder for criminals to successfully profit from what they steal. Experts hope it will help significantly reduce fraud in the U.S., which has doubled in the past seven years as criminals have shied away from countries that already have transitioned to EMV cards, Conroy said. “The introduction of dynamic data is what makes EMV cards so effective at bringing down counterfeit card rates in other countries.”
How Do I Use an EMV Card?
Just like magnetic-stripe cards, EMV cards are processed for payment in two steps: card reading and transaction verification. However, with EMV cards, you no longer have to master a quick, fluid card swipe in the right direction. Chip cards are read in a different way.
“Instead of going to a register and swiping your card, you are going to do what is called ‘card dipping’ instead, which means inserting your card into a terminal slot and waiting for it to process,” Conroy said.
When an EMV card is dipped, data flows between the card chip and the issuing financial institution to verify the card’s legitimacy and create the unique transaction data. This process isn’t as quick as a magnetic-stripe swipe.
“It will take a tiny bit longer for that transmission of data to happen,” Witts says. “If a person just sticks the card in and pulls it out, the transaction will likely be denied. A little bit of patience will be involved.”
Some EMV cards can also support contactless card reading, also known as near-field communication (NFC). Instead of dipping or swiping, NFC-equipped cards are tapped against a terminal scanner that can pick up the card data from the embedded computer chip.
Will I Still Have to Sign or Enter a PIN?
Yes and no. You will have to do one of those verification methods, but it depends on the verification method tied to your EMV card, not if your card is debit or credit.
Chip-and-PIN cards operate just like the checking-account debit card you have been using for years. Entering a PIN connects the payment terminal to the payment processor for real-time transaction verification and approval. However, many payment processors are not equipped with the technology needed to handle EMV chip-and-PIN credit transactions. So it is not likely you will have to memorize new PINs anytime soon, according to Conroy.
“There aren’t going to be many issuers requiring a PIN,” she said. “A vast majority will be issuing chip-and-signature cards, which aren’t all that different from how credit cards work now.”
As with a magnetic-stripe credit card, you sign on the point-of-sale terminal to take responsibility for the payment when making a chip-and-signature card transaction.
U.S. chip-and-PIN cards will be transitioned in slowly, according to Ferenczi. “The card production demand today is really based on chip-and-signature cards. It will probably take two to three years to fully convert to chip-and-PIN.”
Despite a slow transition overall, those who get chip-and-PIN cards will be able to use them right away. “If a terminal doesn’t have the ability to accept a PIN, it will then step down to accepting a signature,” said Randy Vanderhoof, executive director of the Smart Card Alliance. “There will always be a secondary option.”
If Fraud Occurs, Who Is Liable for the Costs?
Today, if an in-store transaction is conducted using a counterfeit, stolen, or otherwise compromised card, consumer losses from that transaction fall back on the payment processor or issuing bank, depending on the card’s terms and conditions.
Following an Oct. 1, 2015 deadline created by major U.S. credit card issuers MasterCard, Visa, Discover, and American Express, the liability for card-present fraud shifted to whichever party is the least EMV-compliant in a fraudulent transaction.
Consider the example of a financial institution that issues a chip card used at a merchant that has not changed its system to accept chip technology. This allows a counterfeit card to be successfully used. “The cost of the fraud will fall back on the merchant,” Ferenczi said.
The change is intended to help bring the entire payment industry on board with EMV by encouraging compliance to avoid liability costs.
Today, any parties not EMV-ready could face much higher costs in the event of a large data breach. Automated fuel dispensers will have until 2017 to make the shift to EMV. Until then, they will follow existing fraud liability rulings.
Is the Transition to EMV Technology Complete?
Not exactly. Although the deadline was strong encouragement for all payment-processing parties to become EMV-compliant as soon as possible, not everyone has made the transition yet.
“It’s going to take a little time to adapt,” said Doug Johnson, vice president of risk management policy for the American Bankers Assoc.
EMV debit cards in particular are rolling out at a slower pace. While 90% of financial institutions began issuing EMV debit cards in 2015, only 25% of U.S. debit cards (about 71 million cards) were expected to be chip-equipped by the end of 2015. The percentage of EMV debit cards in consumers’ hands is expected to reach 73% by the end of 2016 and 96% by the end of 2017.
So far, the large majority of chip cards going into the hands of cardholders are coming from larger issuers like Bank of America and Chase, according to the Federal Reserve Bank of Chicago. The cost of this EMV transition is causing smaller banks to convert their cards more slowly.
EMV debit cards may be issued at an even slower pace as banks have to prep their software to accept those new cards as well, according to Ferenczi.
“Different companies will have different rollout strategies,” Johnson said. Some will base their actions on card expiration dates; others will work to get chip cards into consumers’ hands as soon as possible.
Can I Use My Card at a Retailer That Doesn’t Support EMV Yet?
Yes. The first round of EMV cards — many of which are in consumers’ hands — will be equipped with both chip and magnetic-stripe functions so consumer spending is not disrupted and merchants can adjust. If you find yourself at a point-of-sale terminal and are not sure whether to dip or swipe your card, have no fear. The terminal will walk you through the process.
“For example, if you enter a card into the chip reader slot but the reader isn’t activated yet, it will come up with an error and you’ll be prompted to swipe the card in order to use it,” Vanderhoof said.
And vice-versa. “If a consumer tries to swipe a chip card instead of inserting it, an error will appear, and they will be prompted to insert the card for chip processing instead,” Vanderhoof said.
If chip-card readers are not in place at a merchant at all, your EMV card can be read with a swipe, just like a traditional magnetic-stripe card. “You can still conduct transactions, you just lose that extra level of chip security,” Johnson said.
Many large retailers, such as Walmart, Target and Costco, have upgraded their POS terminals and are activating them for chip-card acceptance, but smaller businesses may be lagging when it comes to upgrading their payment technology.
Will I Be Able to Use My EMV Card Outside the U.S.?
Yes and no. The U.S. is the last major market still using the magnetic-stripe card system. Many European countries moved to EMV technology years ago to combat high fraud rates. That shift has left many U.S. consumers who have magnetic-stripe cards looking for other forms of payment when they travel.
Since many foreign merchants are wary of magnetic-stripe cards, consumers who hold some type of chip card may run into fewer issues than those without one, according to Ferenczi.
However, chip-and-PIN cards are the norm in most other countries that support EMV technology. So consumers with chip-and-signature cards may find some merchants who are unwilling or unable to process their card, even though it does have an embedded chip.
Still, despite any difficulties in the transition, Ferenczi says the change is a step in the right direction.
“Nobody likes to think that his or her card is being secretly used for other purposes,” he says. “So I think regardless, there is a level of comfort knowing that it will be far more difficult to counterfeit EMV cards.”
Sienna Kossman is a staff reporter for CreditCards.com. Copyright 2016, CreditCards.com, all rights reserved, reprinted with permission.