RSS feed Get our RSS feed

News by Topic

BizReport : Ecommerce archives : October 19, 2016

Retailers: What you need to know about EMV 1 year in

One year after the EMV switch in the US, but still many retailers haven't made the switch. One expert explains why, and how retailers can take that step.

by Kristina Knight

Kristina: What is the difference between traditional credit cards, chip and sign cards, and chip and pin cards? Which forms are more secure than the others?

Michael Petitti, SVP Global Alliance, Trustwave: Traditional credit cards use a mag stripe that contains the information required to process a transaction including the primary account number (PAN), name, expiry, etc. In recent years, unauthorized third parties (i.e. hackers) became adept at accessing this information during and after the transaction. The chip cards - both PIN and sign - reduce the risk associated with unauthorized access of this data due to the unique, one time code generated by the chip during the transaction. This one-time code can't be used again for purchases in a "card present" point of sale environment, which renders the information meaningless after its initial use. Chip + PIN and chip + sign both rely on the EMV protocol, but the authentication methods vary. The chip + PIN cards require the user to enter a PIN at the time of purchase; chip + Sign require a signature at the time of purchase. The chip + PIN is the most secure form of card present transactions because the correct PIN validates that the card is in possession of the cardholder at the time of purchase.

Kristina: Chip-and-Pin is now a year old - what trends are you seeing? Have merchants, for the most part, made the switch?

Michael: Merchant adoption of EMV remains a work in progress. There are millions of merchants in the U.S., which is the largest payments market. There is a cost to migrate to EMV for merchants. Additionally, old habits are hard to break: consumers and business have grown accustomed to swiping cards. We don't keep official statistics on EMV adoption, but some industry sources show as many as 2 million merchants in the U.S. are currently accepting EMV. Other sources project that approximately 50% of the merchants will be EMV-enabled by end of 2016.

Kristina: Is chip-and-pin helping brands better control fraudulent purchases?

Michael: Yes, some industry sources point to a reduction in fraud in markets where EMV has been adopted. Additionally, EMV better protects information from unauthorized access due to the one-time use of the data in a card present point of sale, which means that information is less valuable to unauthorized third parties. For example, in markets where chip + PIN has been implemented, we see much fewer instances of card compromise at card present point of sale.

Kristina: What can merchants do better with chip-and-pen?

Michael: Maintain course to continue the rollout. In the U.S., chip + sign is the first step in the migration to EMV. In a few years, issuers and merchants will be moving to chip + PIN to complete the rollout. The issuers were quick to get chip cards in the hands of consumers, which means EMV is here to stay.

Kristina: By not meeting the deadline, how are noncompliant businesses held liable in the event of a breach?

Michael: The fraud is absorbed by the party that has the lesser technology implemented. If a merchant has not migrated to EMV and is accepting transactions with a fraudulent card, that merchant is responsible for the fraud. Merchants also can be levied with investigation and remediation costs should a breach occur.

Tags: ecommerce, ecommerce trends, EMV, retail, trustwave

Subscribe to BizReport



Copyright © 1999- BizReport. All rights reserved.
Republication or redistribution of BizReport content is expressly prohibited without the prior written consent.
BizReport shall not be liable for any errors in the content, or for any actions taken in reliance thereon.