How an EMV-Ready Payment Gateway Can Support Migration to Chip EMV and the Changing US Payments Landscape

11  Download (0)

Full text

(1)

How an EMV-Ready

Payment Gateway Can

Support Migration to Chip

EMV and the Changing US

Payments Landscape

April 2013

(2)

Contents

Contents

Introduction

03

EMV Migration

04

The Migration Route

06

EMV-Ready

08

Payment Gateway

Best Practice Tips

09

(3)

How an EMV-Ready

Payment Gateway Can

Support Migration to Chip

Contents

The payments industry has evolved considerably in

recent years. A combination of consumer demand and

technological innovation continues to impact how

transactions are initiated and processed. Merchants

have had to deal with the constantly changing face of

point-of-sale, while banks have had to invest in the

infrastructure and processes to support the increasing

volume of electronic payment transactions. With

contactless and mobile offering the next wave of

opportunity, attention is also focused on keeping pace

with innovation and achieving competitive advantage.

The US market in particular has faced some tough

challenges. Those across the payments ecosystem,

including merchants, integrators, Value-Added

Resellers (VARs) and processors, have had to contend

with business downturns, the ongoing controversy

over interchange fees and increased regulations. One

example is the Durbin Amendment, which created

waves across the market by capping interchange fees

and seeking to increase competition in the processing

of payments.

Against this backdrop, the US payments sector now

has a plan in place for the migration from magnetic

stripe (mag-stripe) cards to EMV. EMV is a global

standard for credit and debit payment cards based on

Chip card technology, covering the processing of

credit and debit card payments using a card that

contains a microprocessor chip at a payment terminal.

Ultimately, EMV has changed the payments landscape

- it is to mag-stripe what an iPod is to a vinyl record.

One of the main drivers behind EMV migration is the

fight against fraud. In addition, it promotes

standardi-zation, global interoperability and paves the way for

new applications and possibilities.

As one of the last major economies to tackle this

transition, deadlines for the US are imminent and the

technology shift is inevitable. However, while there is

the imperative to comply, there are considerable

opportunities available.

This guide looks at the challenges ahead. It offers

advice and best practice tips on how organizations

can tap into industry expertise around EMV, overcome

the technology hurdles and deploy a payments

infrastructure for the future.

Introduction

EMV has changed the

payments landscape –

it is to mag-stripe what

an iPod is to a vinyl

record.

(4)

EMV Migration

The Story So Far

Since EMVCo published its first version of the EMV

specifications in 1996, several regions have already deployed

EMV Chip-enabled cards and payment systems.

Worldwide EMV Deployment and Adoption*

According to EMVCo, the organization that manages the EMV standards and associated compliance processes, there were 1.62 billion EMV-compliant payment cards in use worldwide as of Q4 2012.

So far, Europe (zone 1) has led the way with 81 percent of its cards and 95 percent of its terminals Chip-enabled as at Q4 2012. Canada, Latin America

and the Caribbean have also made good progress, with 49 percent of cards and 79 percent of terminals meeting the standard.

Other regions, such as Africa and the Middle East, and APAC, have begun the transition, though are still in the early stages, with 29 percent of cards and 77 percent of terminals and 27 per cent of cards and 51 percent of

terminals respec-tively. So, with its migration plan in place, what does the US stand to gain from the transition to EMV?

Source: EMVCo, Q4 2012. *Figures reported in Q4 2012 and represent the latest statistics from American Express, JCB, MasterCard and Visa, as reported by their member financial institutions globally. **Figures do not include data from the United States.

Region EMV Cards Adoption Rate EMV Terminals Adoption Rate

Canada, Latin America and the Carribbean Asia Pacific Africa & the Middle East Europe Zone 1 Europe Zone 2 United States** 401M 372M 50M 755M 46M 49.2% 26.7% 28.6% 80.7% 15.5% 5.6M 5M 0.6M 11.7M 0.9M 78.5% 50.5% 76.7% 94.5% 73.2%

TOTALS

1.62B

44.9%

23.8M

75.7%

(5)

How an EMV-Ready

Payment Gateway Can

Support Migration to Chip

The geographical

migration of fraud

Regions already utilizing EMV Chip-enabled cards, combined with a PIN, have dramatically reduced fraud, simply because cards are much more difficult to copy. The US stands to benefit consid-erably from these anti-fraud measures. Industry-wide statistics on fraud losses in the US are scarce. Figures from The Nilson Report in 2011 estimated US payment card fraud losses at $3.56 billion – almost half of the reported global fraud losses. In January 2013, American Banker reported that card issuers had seen a dramatic rise in recent years. Discover Financial Services reported losses in fiscal 2012 of $93 million, a 70 percent jump from only two years earlier. Capital One Financial (COF) also reported a 20 percent increase between 2010 and 2011.

The US will also be able to close the loop on fraud migrating from regions that have already adopted EMV. In April 2013, a report from the European ATM Security Team (EAST) indicated that five European countries have seen an increase in the number of “skimmers” found attached to ATMs and other payment terminals. By capturing data from the mag-stripe on

users’ cards and obtaining PIN numbers from miniature CCTV cameras, fraudsters create cloned cards. However, these cards will only work in ATMs in non-EMV countries, such as the US. As a result, there is the ongoing risk of fraud migrating to parts of the world that still allow cash to be withdrawn using the mag-stripe card.

The impact of this is apparent, with 20 states reporting a rise in ATM fraud through skimmed cards in 2012 (source: http://ficousfraudmap.com). Plastic card fraud in the US, using UK cards alone, reached almost $25 million (£16.3 million) in 2011, according to Financial Fraud Action UK. Moreover, history has shown that card fraud migrates cross-border to non-EMV domains and with Canada and Mexico well advanced with EMV this opens up further threats to the US. Those behind card fraud are often part of large organized crime units. In February 2013, federal agents cracked down on a card fraud ring that reportedly amassed at least $200 million using 7,000 fake identities. The criminal operation spanned dozens of states and numerous countries and used stolen money to stock pile cash, purchase millions of dollars in gold, and fund a lavish lifestyle.

Time to act

While the US migration is now underway, why is it taking over ten years for all the industrialized nations to adopt EMV? The answer is probably the scale and cost of implementation, requiring every single terminal to be modified or replaced, and every credit and debit card to be re-issued by the banks. This is why it’s easier for smaller countries such as the UK to make the change and have their fraud transferred elsewhere as a consequence. What we do know is that in the thankfully diminishing mag-stripe world, it’s going to be extremely costly to be the last man standing.

There are a variety of important dates and deadlines for EMV card acquisition in the US. Organizations must define their plans now if they are to have the systems and processes in place.

The US will also be able

to close the loop on

fraud migrating from

regions that have

already adopted EMV.

August 2011 Visa announced

its path toward EMV contact and contactless Chip technology in the US.

October 1, 2011 Visa expands its Technology Innovation

Program (TIP) to US merchants.

April 1, 2013 The deadline for developing the processing infrastructure

for acceptance of Chip. This requires merchants, integrators and processors to ensure their

systems can pass contact Chip data or dynamic data

from the acquirer system.

October 1, 2015 The deadline to establish a fraud liability shift. This will see merchants

take on responsibility for fraud from non-EMV

(6)

The Migration Route

With the move from mag-stripe to Chip-enabled cards, the payments industry must

tackle multiple moving parts. These range from hardware and software to transaction

types and host systems and can be broadly categorized into two key stages:

The challenges

On the frontline of payments, merchants are looking to their device manufacturers

and integrators for the necessary EMV-ready technology. They face penalties from

the fraud liability shift if they do not comply, so many are prioritizing rapid, low-cost

solutions that they can easily implement within the timeframes available.

Integrators and VARs

To meet demand, integrators and VARs need to propose the necessary EMV upgrades to their merchant customers. They will also need to provide upgrades to the terminal-to-acquirer host interface, paving the way for EMV messages to get from the POS application to the

processor itself. The challenge here is not just one of implementation but also of expertise. They will need ways to bridge the EMV knowledge gap and access the right expertise and skills that cover the extensive EMV requirements. n terms of the POS devices, integrators and VARs must provide or source the necessary PIN-pads incorporating EMV Level 1 and Level 2 Kernels along with the necessary PA-DSS and PCI DSS

compliance. They must then tackle the testing and certification process, an important and extensive stage in EMV compliance.

The testing and certification will depend on how each terminal is being used, whether for offline or online payments, and which configuration of EMV is required. It also requires the integrator or VAR to take their solution to the acquirer processor to conduct the necessary end-to-end testing. Once approved, the application will need to go through an integration cycle to connect the terminal to the processors. All of this calls for a review of legacy software, which will need to be upgraded or replaced to meet the EMV requirements.

Acquirer processors

For processors, the main impact is from the potentially huge volume of testing and processing requests from the integrators and VARs. As such, they need efficient ways to meet this demand and also to offer solutions that will support their customers. In this competitive market, those that fail to deliver an EMV-ready solution risk losing business to processors that are faster to market.

Point-of-sale (POS) or payment device hardware and applications:

These require contact and contactless devices and their applications to be implemented and behave correctly according to the specifications. This also extends to mobile POS devices. Where application developers or VARs

are writing or integrating EMV Kernels, the application must be implemented according to the EMV functional specifications. The integration of the POS or terminal and acquirer host system must also be validated.

Acquirer processors:

Organizations must test the integration of the terminal and acquirer processor. This covers the terminal application, user interface, the connection to the acquirer host and the acquirer host system.

(7)

How an EMV-ready

Payment Gateway can

support migration to Chip

A typical testing

and certification

cycle can extend

to 16 weeks in a

mature EMV

market.

Source: EMV Co , April 2013

The role of testing falls to a fairly small number of approved laboratories. Once the units are tested and approved, they can be certified by EMVCo. However, there are two main bottlenecks in this process.

The first is that the labs themselves must be approved by EMVCo. The rigorous selection criteria could result in a shortage of labs in the US to do the work.

The second bottleneck is the approved labs themselves, which generally cannot turn around the testing for vendors in short order. Testing can take a few months, depending on the number of terminals the labs have to test.

Processors may be able to shortcut these timeframes with in-house pre-testing and investment in test

automation tools. However, at the processor, a typical testing and certifi-cation cycle can extend to 16 weeks in a mature EMV market. It is the sheer number of these tests that will put a strain on resources. There are as many as 8.5 million merchants in the US, many of which will be using tier one retail payments solutions. Just a small percentage of this community multiplied by 16-week cycles

represents a vast requirement for time and resources.

One way to alleviate this burden is to utilize precertified solutions that do not need to be tested when deployed to the customer. These enable

processors to minimize the number of certifications they need to complete by using a third party and effectively bringing merchants to the table already approved. For the integrators and VARs, the ability to create an

EMV solution, without also having to tackle the testing process, can save valuable time.

Approved EMVCo Labs Worldwide

The EMV certification bottleneck

EMVCo not only oversees the EMV standards but also has the task of ensuring the

correct implementation and interoperability between all of the EMV cards and

terminals around the world. To this end, EMVCo has a set of test requirements that,

once passed, allow EMV terminals to be EMV-certified.

(8)

EMV-Ready

Payment Gateway

When reviewing the integration of systems with the processors, integrators and

VARs are often faced with multiple interfaces, each with different characteristics. In

addition, many US processors are only recently becoming EMV complaint. Those

with existing payment interfaces will need to review and update them as well as

update their certification processes to facilitate EMV messages. This is a major

undertaking and one that calls for significant investment.

This benefits players across the EMV migration process as a whole, including integrators, VARs and processors. Specifically, it provides integrators and VARs with a compre-hensive, single interface for

multiple processors. As such, it requires only one phase of integration with one interface. It also enables processors to side-step long and labor-intensive upgrades and certifications, offering a quick-to-market, pre-certified solution.

The growing community of independent sales organizations (ISOs) also stand to benefit. These ISOs look to add value to merchants with affordable off-the-shelf solutions that simply plug into an existing gateway. One of the arguments for non-adoption of EMV in the US is a perceived lack of available solutions. This has become a particular concern as organizations consider the multitude of component parts involved. However, pre-certified solutions that bundle common

components, such as PIN pads with an EMV-ready payment gateway, can deliver an approach that benefits the entire EMV process, from processor to end customer. In a competitive market, it also provides a lifeline to organi-zations vying to meet the deadlines and achieve an all-important first mover advantage.

An alternative approach

to enable an easier

transition is to use an

EMV-ready payment

gateway.

(9)

How an EMV-ready

Payment Gateway can

support migration to Chip

Work with people

who have done this

before

Aside from the actual implementation, one of the main challenges in EMV migration is the scale of education and awareness required. There is a vast set of information and protocols that needs to be understood in the context of EMV transactions. Rather than dedicate time towards upscaling internal knowledge and resources, organizations would do well to partner with established experts and providers in the field. A benefit of the US being one of the last regions to adopt EMV is that it can capitalize on expertise gathered elsewhere. As such, organi-zations should make use of proven approaches that have already delivered success in the rest of the world.

Don’t reinvent the

wheel

While aging legacy systems pose a problem, there are already a number of solutions on the market to facilitate EMV migration. As such, there is no need to start from scratch and, instead, integrators and VARs can deploy off-the-shelf solutions that come with the necessary precertified components. They can then focus resources on the integration of these with their own merchant solutions.

Deploy third party

multi-platform, low

footprint Kernels

An EMV Level 2 Kernel is one of the most critical elements of the EMV Chip technology standard. For integrators and VARs, one of the most common decisions is whether to develop or buy-in this technology component. Those that opt for third party Kernels can benefit from a quicker route to market and avoid the need for in-house development expertise and expense. With numerous operating systems and processors in use in terminals today, one EMV Kernel cannot fit all.

Therefore, it is important to find one that works across all common platforms, including Windows, Windows CE and Java.

Use tools and

expertise in testing

and certification

Integrators and VARs should look for a fast track to having a clean certified EMV solution for their applications. With a fully certified solution, including EMV Kernels and an EMVready payment gateway, these organizations can effectively outsource the entire certification piece. In the case of EMV Kernels, the supplier should use the same test tools as the EMVCo

certifi-cation laboratory before submitting the Kernel for EMVCo certification. This will increase the likelihood of the Kernel passing the formal EMVCo certification first time, ensuring the project remains within budget and on time.

Explore EMV

in the cloud

One approach that is already achieving success is EMV in the Cloud. Here, the EMV Kernel resides in a Cloudbased server while other terminal features can be provided via a Web service. The advantage of this is that the terminal has less software and less complexity. It also allows instant software updates, roll-backs and EMV configuration changes and simplifies data handling and management with transaction data stored in the Cloud.

While there are limitations with this approach, such as slower transaction times and limited support for contactless transactions, for many this is proving a viable and agile approach. With over 100,000 devices already deploying EMV in the Cloud, this could be the future of payment technology.

1

2

3

4

5

The process of EMV migration is complex. With imminent deadlines,

organi-zations across the payments ecosystem cannot afford to be complacent. While

the challenges are significant, there are tried and tested best practice approaches

to help organizations through the transition.

(10)

ATM Mobile & Online

EMV Migration

mPOS

Parking Ticketing Vending POS Transport

About Creditcall

Creditcall makes card acceptance simple from any device, anywhere. Whether

attended, unattended, online or mobile payments, our award-winning EMV-ready

payment gateway and EMV Migration solutions are at the very heart of our clients’

businesses, ensuring payments flow – all day, every day.

Founded in 1996 and with over 14 years of EMV experience, Creditcall has a proven track record in providing payment gateway services and offers EMV Migration solutions that are tried and tested.

Our EMV Migration solution, ChipDNA, is a rapid EMV Migration SDK for Windows, Linux, iOS and Android. It greatly helps ISVs transition from older magnetic stripe technology to EMV and Chip technology. ChipDNA is the easiest and most cost effective way of adding EMV payment functionality into an attended or unattended Point of Sale (POS) application.

We were the first EMV-ready Payment Gateway in the U.S., and completed our EMV certification in April 2014.

Our Chip-based EMV Level 1 and EMV Level 2 Kernel software is used globally in contact and contactless environments such as ATMs, mPOS, card readers, PINpads and other POS devices.

We are the first EMV-compliant mPOS solution to allow businesses accept Chip and PIN cards ‘on the go’ via smartphones and tablets.

Millions of users and billions of transactions depend on Creditcall EMV technology each and every day. Creditcall works collaboratively with companies across Europe, North and South America, South Africa and Asia-Pacific to deliver

business-critical payment solutions. Clients include ATOS, DHL, Elavon, Hilton Hotels & Resorts, Toyota, Wayne (a GE Company) and Westfield.

(11)

Creditcall Europe

Merchants House North, Wapping Road, Bristol, BS1 4RW, United Kingdom

T: +44 (0)117 930 4455

F: +44 (0)117 930 4477

E: hello@creditcall.com

W: www.creditcall.com

Registered No: 3295353.

VAT Registered No: 713 0076 80.

Creditcall North America

1133 Broadway, Suite 706, New York, NY 10010, USA

T: +1 (800) 868 1832

F: +1 (212) 300 8006

E: hello@creditcall.com

W: www.creditcall.com

Regional Offices

Figure

Updating...

References

Related subjects :