What Small Businesses Should Know about the EMV Fraud Liability Shift on Oct. 1, 2015
By Mary Hughes
The U.S. is the last developed country to migrate from magnetic-stripe (“mag-stripe”) cards to EMV¹ or chip cards. This migration will affect credit, debit and prepaid cards issued by U.S. financial institutions.
The biggest benefit of chip card technology is the potential reduction in card fraud due to counterfeit and lost and stolen cards for card-present transactions (where the card is physically present at the point-of-sale). Chip card transactions offer enhanced functionality in card authentication, cardholder verification, and transaction authorization, thus providing better security than magnetic-stripe cards. A chip card has an embedded microprocessor chip (it looks like a small, metallic square on the front of the card) that stores information securely and performs cryptographic processing during the payment transaction.
When a financial institution issues a chip card, the chip is encoded with security credentials that are extremely difficult to counterfeit. Plus, chip cards create dynamic data that are unique for each transaction and cannot be used again. Because of these security features, countries that have implemented chip cards have seen a reduction in card-present fraud rates.
Traditional mag-stripe cards, in comparison, carry static data that doesn’t change from one transaction to the next. Criminals can steal the data from the mag-stripe and use it to create fraudulent transactions. For example, criminals may install devices to skim card data at automated fuel pumps or ATMs and then use that card data to make fraudulent purchases.
The U.S. migration to EMV cards is in the news lately because of the October, 2015 fraud liability shift. On this date, the party (card issuer or merchant) that has invested in chip technology is protected from financial liability for card-present counterfeit or lost/stolen fraud. The four major card brands (Visa, MasterCard, Discover, and American Express) have announced rule changes that employ a carrot-and-stick approach designed to accelerate adoption through merchant incentives (such as PCI audit relief), upgrading of payments processing infrastructure to support EMV transactions, and fraud liability shifts affecting merchants, acquirers, ATM operators, and issuers. Effective October 1, the card issuer or merchant that does not support EMV chip card technology will assume liability for counterfeit point-of-sale card transactions (for Visa, MasterCard, Discover and American Express cards) and for lost or stolen fraud for MasterCard, Discover, and American Express cards. If neither or both parties are EMV compliant, fraud liability remains the same as it is today.
What if a customer presents a chip card to make a purchase and the merchant does not possess EMV-capable terminals and thus is not able to process the chip transaction and instead processes the payment via magnetic-stripe technology? If the card turns out to be lost/stolen or counterfeit, then the merchant (rather than the card issuer) is liable for that fraudulent transaction.
While a large retailer may be able to make a business case for investing in chip card technology at the POS, a smaller retailer may not be able to do so as readily. Smaller merchants with relatively low card transaction volumes may find that the expenses associated with upgrading equipment to accept chip cards are greater than simply accepting liability for the low levels of fraud they might experience from fraudulent mag-stripe transactions.
Many POS terminals purchased in recent years are already EMV-capable, but that functionality is not turned on; it is necessary for merchants to get the necessary software installed, tested, and certified before they can process chip card transactions. There is currently a long wait for installation, testing, and certification services.
As a small business, is it advisable for you to invest in new point-of-sale terminals or upgrading your current equipment so that your business can accept chip cards? Investment in chip card acceptance equipment may be worthwhile if:
• You accept card payments today in “card-present” situations or you plan to do so in the near future
• A significant portion of your sales is to strangers (versus people you know and trust), making your business more vulnerable to counterfeit and lost/stolen card fraud
• Card payments are a significant percentage of your total sales
° However, if your card transactions tend to be telephone orders or internet purchases (called card-not-present transactions), it may not be cost-effective for you to invest in chip card equipment as EMV technology does nothing to protect against card-not-present fraud.
Another consideration is that certain merchant categories have higher counterfeit fraud rates than others. Fraud rates are five to ten times the average in stores that sell electronics, computers, hobbies and games, music, drugs/pharmacy, apparel, and wire transfer and money orders. In contrast, counterfeit fraud rates are orders of magnitude lower than average among doctors and dentists, religious organizations, dry cleaners, auto-body shops, and lawn-and-garden stores.
A business should assess its experience with fraud, both in the past and projected in the future, and evaluate the costs and benefits associated with accepting chip cards. Also consider the time and resources needed to train staff members to process chip transactions.
It is important to realize that all chip cards (whether issued in the U.S. or elsewhere) will continue to carry mag-stripes for the foreseeable future, and the U.S. payments infrastructure will continue to support mag-stripe technology for many years to come. Thus, merchants will still be able to accept card payments (and process them with mag-stripe technology) even if their sales terminals are not equipped to accept chip card transactions.
¹EMV, which stands for Europay, MasterCard and Visa, is a global standard for integrated circuit or chip cards. The EMV specifications define a set of requirements that ensure global interoperability among chip-enabled cards and terminals.
Mary Hughes is a member of the Remittance Coalition’s Small Business Payments Toolkit Work Group. The opinions expressed are those of the author and not those of any other entity.