EMV 101 with Datacard and Diamond
Post on 22-Jul-2016
218 Views
Preview:
DESCRIPTION
Transcript
EMV 101: Everything you need to know about EMV
E - B O O K
1
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
The Glossary of Terms provides a quick reference tool for navigating the many technical terms and abbreviations brought up when discussing EMV.
The Migration Timeline traces the history of EMVco standards, and outlines when migration steps will take effect in the US.
Lessons Learned provides a comprehensive look at economies around the world where EMV migrations are currently underway or are complete. Experiences from other countries can provide valuable insights for everyone involved in the US EMV migration.
Behind the Transaction provides a more in-depth look at why adding layers of security to our current payment ecosystem can benefit everyone within it.
Key Players takes a closer look at everyone who is involved in the US EMV migration, and how each group can be best prepared for the shift.
The EMV Checklist provides a step-by-step analysis to help you evaulate your current infrastructure and prepare for migration.
HOW TO USE THIS E-BOOK
Use this EMV chip graphic to jump to the in-depth chapter of any topic, or to go back
to the intro chapter.
IntroductionThis e-book breaks EMV down to six questions: who, what, where, when, why, and how. These topics can help you figure out what’s going on, who it will affect, when to expect changes, why this is all necessary, and how to get started. The introductory chapter, EMV 101: The Five Ws, goes through each “W” question in a brief overview, and each subsequent chapter goes in-depth on one question. Whether your EMV questions are general or specific, macro or micro, EMV 101 can get you answers.
This intro chapter is a brief introduction to all
things EMV, and answers the five classic questions:
Who? What? Where? When? & Why?
EMV 101: THE FIVE Ws
3
Where is the US payment card industry now?
Today, payment and identification cards of all types (credit cards, gift cards, loyalty cards,
membership cards, etc.) are encoded with the cardholder’s information on the back of the card
using a strip of magnetic tape, also known as the magnetic stripe.
When a consumer swipes a standard magnetic stripe card at a retailer’s point of sale (POS)
terminal, or inserts it into an ATM, the data on the magnetic stripe is captured for transmission to
an authorization system. Fraudsters have been able to put skimmers at these locations to capture
the data from the magnetic stripe, and in more sophisticated attacks, install malware on computers
connected to the POS terminal to capture the data. The prevalence of magnetic stripe cards in the
US makes card skimming and card copying easy and lucrative. In 2012, the US accounted for 47% of
global credit card fraud while only being responsible for 23% of total global credit card use.
Chip cards are different from traditional magnetic stripe cards in the way they communicate with
card reader devices. Rather than the classic swipe-to-scan method, chip cards have an embedded
integrated circuit chip which connects to the POS terminal’s chip card reader. This chip is a
EMV 101: THE FIVE Ws
23%
47%
US Share of Global Credit Transactions
US Share ofGlobal Credit Fraud
(Nilson Report, 2014)
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
4
microprocessor, which is essentially a very small computer, with the capability to encrypt transaction
data dynamically for each purchase. Because the card has a microprocessor embedded, it has the
ability to make some payment-related decisions without the need to connect to the network. That
is why this type of card is often referred to as a “smart card.” With over 1 billion cards in use, EMV is
already a burgeoning global reality.
Contact Chip Cards can be distinguished by their square metallic contact pads. These cards are
inserted into a POS terminal which has an integrated chip card reader; much like a microSD card
or flash drive is inserted into a computer. The card stays inserted in the POS terminal until the
transaction is complete. Chip cards are only activated when connected to a reader, which provides
the power source for communication. Chip cards do not have batteries and do not need to be
charged.
Additionally, Contactless Chip Cards do not require an internal power source. Embedded in the
plastic of a contactless card is an antenna. Using radio waves, the card communicates with a reader
that emits a specific radio frequency. This frequency is harnessed to power the electronic chip.
Contactless cards are especially advantageous for use as payment cards because they need only a
moment to tap or wave the card near a reader to complete the communication. Recent pilots and
rollouts indicate contactless chip cards will be widely utilized for transit payments.
Hybrid or Dual Interface cards include both a contact pad and an internal antenna. They can be
tapped, waved or inserted into many different chip card readers.
What is EMV?
EMV is an acronym for the founding companies who came together to build a common specification:
Europay (now part of Visa), MasterCard, Visa. These companies formed EMVCo in order to
Contactless Chip:EMV Card & Reader
Contact Chip:EMV Card & Reader
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
5
administer international standards to champion global interoperability for chip-based payment
cards. This includes, but is not limited to, card and terminal evaluation, security evaluation and
management of interoperability issues. Today, there are EMV specifications based on contact chip,
contactless chip, common payment application (CPA), card personalization and tokenization. These
specifications and requirements were developed with a mission to increase payment security and
efficiency, and to ensure global interoperability amid payment ecosystems. A globally accepted EMV
card with an associated PIN empowers cardholders to take out cash from an ATM in Hong Kong, buy
lunch at a deli in New York, or buy a train ticket from a Deutsche Bahn kiosk in Munich — all with the
same card. EMV specifications regarding chip size, card size, electrical use, and security features all
help make this possible. Chip cards are already widely used in Europe, Asia and other regions. The
transition of the US payment card market from magnetic stripe cards to chip cards is referred to as
the US EMV migration.
EMVCo is the association that manages, maintains and enhances EMV chip card specifications.
EMVCo has expanded its sponsoring organizations and is comprised of six backing members —
American Express, Discover, JCB, MasterCard, UnionPay, and Visa — and supported by dozens of
banks, merchants, processors, vendors and other industry stakeholders who participate as EMVCo
Associates.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
6
Who will be affected by EMV migration?
Cardholders will have to adapt to new ways of interacting with ATMs and POS terminals. Consumers
using contact chip cards will have to insert their card for the duration of the transaction, and those
using contactless cards will have to tap or wave their card over the designated area. Also, depending
on how the chip card is configured and the capabilities of the POS terminal, cardholders may have to
verify they are the actual cardholder by entering a PIN instead of verifying by signature.
Card Issuers will have their operation costs go up, as the new cards are more expensive to produce
and replace. They will also have to work with acquirers to update their payment processing and
authentication infrastructures.
Merchants will have to upgrade and certify their POS terminals so that they can communicate with
chip cards. As mobile payments rise in popularity, more and more apps will adapt to enable mobile
phones to communicate with POS terminals. Today, there are many apps and mobile phones which
can communicate with POS terminals.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
7
When is migration happening? Now, slowly but surely, major card providers in the US are beginning to offer chip-based payment
cards. Some cards are requiring PIN entry for cardholder verification, and others are requiring a
signature for cardholder verification.
The US is the last major economy in the world to implement chip-based payment technology, and
in an effort to encourage EMV deployment, the US card brands have instituted a fraud liability shift
beginning October of 2015. This means that after October 2015, all parties that make an investment
in EMV technology will be protected from being financially liable for any potential fraud losses. In
2016 this will include ATMs for MasterCard branded cards, and in 2017 it extends to automated fuel
dispensers, and ATM transactions with Visa branded cards. The liability shift is NOT a mandate.
Merchant Migration requires upgrading and certifying their point of sale devices, and training their
cashiers to use the new payment method.
Card Issuer Migration requires providing their cardholders with chip cards and educating the issuer’s
employees and their customers about the chip cards, what they are capable of, and how to use
them.
Cardholder Migration requires consumers to apply for chip cards, or request chip cards from their
current card provider. Over time, cardholders will receive chip cards as part of new card issuance or
through the normal renewal process. Cardholders will also have to adjust to new methods of using
their card with card readers.
OCT 2017Automated Fuel
Dispenser Liability Shift
OCT 2015Merchant FraudLiability Shift
APRIL 2014Acquirer Compliance
Accept Chip-BasedPayments
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
8
Why migrate now?
EMV provides better protection for cardholders. Card fraud is a huge problem in the US, largely
due to the prevalence of magnetic stripe swipe cards, which are easy to counterfeit. EMV cards
remove most opportunities for card skimming, where a magnetic stripe is scanned without the
cardholder’s consent for fraudulent use. Opportunities for card transplant fraud, where stolen
card information from EMV markets is printed onto a magnetic stripe card and used in non-EMV
markets, will be greatly reduced as more markets embrace EMV technology. In the event that data
is stolen from an EMV card, or during a transaction initiated from an EMV card, the value of that
data for counterfeiting purposes is greatly limited. Mobile markets are also on the rise, and the
current transition to chip cards will make the next transition to mobile payments safer and easier by
protecting and enabling consumers.
Today, fraud risk is making headlines like never before. Recent notable retailer data breaches have
affected millions of American consumers, and have brought credit security issues to the forefront of
public debate. Thieves have successfully stolen customer card information by observing and taking
advantage of how data is stored and moved between different areas of the payment environment.
Valuable cardholder information can be compromised not due to one weak link in the transaction
cycle, but due to joint weaknesses in the current payment system as a whole.
EMV chip card ubiquity in the US will dramatically decrease the options fraudsters will have to use
stolen account data, and it will enable cardholders to embrace new ways of making payments by
protecting and informing them. Updating the US payment system infrastructure to support EMV
will take time, investment and careful planning. It will require merchants, issuers, acquirers and
processors to evaluate and update their current security precautions. EMV Migration will not correct
every weakness within the US payment system, but it is the first clear step in a long process of
ushering the payment business into the digital age.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
This chapter provides some historical background
on EMV payment standards, and outlines major
dates and deadlines to come.
EMV 101: MIGRATION TIMELINE
10
EMV 101: MIGRATION TIMELINE
1995Europay, MasterCard and Visa issue the first EMV specification
2001-05
In an eort to improve security, a larger retailer partners with Visa to push for more
smart chip cards to be used in the US. Eorts halt due to cost management setbacks
1999Europay is acquired by MasterCard
2002
JCB (Japan Credit Bureau) joins EMVco
2005EU mandates fraud liability shift, placing pressure on card issuers and merchants to migrate to EMV
2008
Fortune 1000 Financial processor company card data breach aects 134 million accounts
2009American Express joins EMVco
2010Global circulation of EMV cards hits 1 billion
2010UK credit card fraud rates at lowest since 1999
2011MasterCard and Visa mandate fraud liability shift in CanadaEMVco publishes EMV specifications version 4.3
MasterCard, Visa and Discover announce roadmaps to bring EMV to the US
2012
US accounts for 23% of global credit card transactions and 47% of global credit
fraud. Analysts blame the shift in fraud towards the US on the comparative lack
of security in magnetic strip cards and terminals vs. EMV cards and terminals
2013Discover and China Union Pay join EMVco
US acquirer processors and sub-processor service providers are required to support, accept and process smart chip transactions
Visa, Mastercard and Discover introduce merchant/acquirer regulations
2015US implements fraud liability shift so that the party that has made an investment in EMV deployment is protected from financial liability for fraud losses
2014
Large retail customer data breach aects over 100 million
cards. Attention on US EMV migration heightened during
the aftermath
2017US fraud liability shift mandate extends to fuel dispenser machines
Visa liability shift for ATMs
2019Projected EMV ubiquity in the US
EMV 101: MIGRATION TIMELINE
Loss per £100
FRAUD LOSS RATE UK-ISSUED PAYMENT CARDS
2000£0.00
£0.02
£0.04
£0.06
£0.08
£0.10
£0.12
£0.14
2001 2002 2003 2004 2005 2006 2007 2008 2009 2010
CHIP AND PINDEPLOYMENT
2004
Europay, MasterCard and Visa form EMVco
2016
MasterCard liability shift for
ATMs
23%
47%
US Share of Global Credit Transactions
US Share ofGlobal Credit Fraud
2014
All regional debit networks to enter into agreements
with MasterCard and Visa to integrate data routing
2014-2015Regional debit networks conduct testing and certification
This chapter provides a more in-depth look
at economies around the world where EMV
migrations are currently underway or are
complete. Experiences from other countries can
provide valuable insights for everyone involved in
the US EMV migration.
EMV 101: LESSONS LEARNED FROM GLOBAL MIGRATION
12
National Migration, Global Results
Today, EMV card technology has fully replaced traditional magnetic stripe cards in virtually all
developed countries except the US. Most large economies are either fully migrated to EMV standards,
or are somewhere along a migration path. Throughout every major country’s EMV migration, each
domestic policy change affected fraud landscapes both at home and throughout the world.
As the US payment ecosystem gears up for a smart card migration, it is valuable to look back at how
other large economies made the shift, and compare how different migration patterns and policies
have affected fraud rates around the world.
Fraud 101
When measuring fraud-prevention methods, especially EMV standards, it is highly important to consider the effects EMV policies have had
on different types of fraud, and to understand the different ways card fraud is measured. This chapter will discuss global trends following
EMV migrations for several different types of card fraud, and different methods for measuring it:
FRAUD RATES are measured in incidences. Either one
fraudulent transaction, or one cardholder affected by a
fraudulent transaction equals one incident. Fraud rate is a
relatively inaccurate and sometimes deceiving method of
measuring fraud, but it is the favored method by journalists
and surveyors for its consumer-focused mass appeal.
FRAUD LOSSES are measured in currency. This statistic
totals all the money lost by cardholders, issuers, acquirers
and merchants due to fraudulent transactions over a period
of time.
FACE-TO-FACE FRAUD OR CARD-PRESENT FRAUD
consists of a fraudster finding a card, stealing a card, or
counterfeiting a card and physically using it at a store.
CARD-NOT-PRESENT (CNP) FRAUD consists of a fraudster
obtaining cardholder information, and using it to perform
fraudulent transactions without the use of a physical card.
Often, CNP fraud is performed online.
CROSS-BORDER FRAUD is where a card issued in one
country is fraudulently used in another country.
LESSONS LEARNED FROM GLOBAL MIGRATION
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
13
Cartes à Puces in FranceFrance was the first large economy to embrace smart card technology. In the mid-1980s, the fraud
rate in France was extremely high, and in response, French banks began issuing chip-embedded
cards in 1986. France’s major national card program is “Carte Bleue,” which is run by the six major
French banks in association with Visa. Beginning in 1992, Carte Bleue issued only smart chip cards
(cartes à puce). In the early 90s, France was the only country widely using smart cards, and the
immediate result was a drastic drop in overall fraud. When the UK began to embrace EMV standards,
France followed suit with a national rollout of chip-and-PIN in 2003.
Results: Migration to smart cards caused an immediate decrease in card-present fraud losses in
France. However, fraud losses have increased every year since the national shift to EMV standards
took place. Card-present losses stayed low, but card-not-present fraud losses increased in France,
and have continued to do so, with a significant spike in losses caused by non-domestic fraudsters.
CREDIT CARD FRAUD IN FRANCE 2003-2011
2003
Card-not-Present Fraud (CNP)
Card-Present Fraud
Other (Fraud Application, ID Theft. etc)
Note: Cards issued in France only.Smart card solution launched in 1992.
£0.00
£50.0
£100.00
£150.00
£200.00
£250.00
2004 2005 2006 2007 2008 2009 2010 2011
Frau
d Lo
sses
In
Mill
ions
EU
R
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
14
Chip and PIN in the United Kingdom Not far behind France, the UK was one of the first large economies to embrace EMV technology. The
banking industries in the UK and Ireland branded their migration efforts as “Chip and PIN” — “chip”
referring to the computer chip embedded into the new cards, and “PIN” referring to the personal
identification number that is required to authentically identify cardholders before each transaction
(requiring PIN authentication for a smart card purchase is an optional security feature, which
the UK largely favored.) After several successful trial programs launched in the mid-90s, APACS
(the Association for Payment Clearing Services) — a group of financial institutions and payment
companies — introduced a national EMV campaign in 2002, which gained serious traction in 2004. A
liability shift was put in place on Jan. 1st of 2005, and by the end of August 2006, the UK reached a
near-complete migration (99.8% of chip transactions were PIN-verified.)
Results: Overall, fraud losses in the UK have seen a significant decline. Card-present fraud loss has
decreased dramatically and stayed low, however, card-not-present (CNP) fraud loss has seen steady
increases since the EMV rollout. A large portion of UK CNP fraud is cross-border fraud, where UK-
issued cards are used in payment networks that do not require PIN verification.
CREDIT CARD FRAUD RATES IN THE U.K. 2001-2012
2006
EMV liability shift
0%
10%
20%
30%
50%
40%
70%
60%
2007 2008 20092001 2002 2003 2004 2005 2010 2011 2012
Card-not-Present
CounterfeitCard-Present
Lost/StolenCard-Present
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
15
EMV in AustraliaAustralia’s EMV shift resembles the US migration in its gradual and reluctant approach. Both
countries have seen massive spikes in fraud from abroad, due to the stricter EMV policies adopted
throughout Europe, and both economies have a complex payment ecosystem based on magnetic
stripe cards. Major financial institutions in both Australia and the US act without much influence
from a common governing body. Australian migration slowly began in 2007, and in 2009, a major
industry deadline to implement PIN-only transactions was missed due to fears over consumer
preparedness. Alongside the US, Australia has lately suffered a disproportionate share of global
fraud. Liability shifts were set for 2012 and 2013, and signature verification is currently being phased
out — with good results, so far.
Results: One result of the gradual migration approach in Australia is that positive results have been
modest in some categories, and non-existent in others. Card-present fraud is slightly down (about a
15% decrease from 2008-2010), but CNP fraud has surged (a 70% increase during the same period).
CREDIT CARD FRAUD IN AUSTRALIA 2006-2012
2006
Card-not-Present (CNP)
Card-Present
EMV Issuance ramped up
£0.00
£50.0
£100.00
£150.00
£250.00
£200.00
£350.00
£300.00
2007 2008 2009 2010 2011 2012
Frau
d Lo
sses
In
Mill
ions
AU
D
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
16
Chip Cards in CanadaInterac, the national PIN-debit network in Canada, allowed major banks and transaction processors
to work together throughout the migration process, which began in 2007 with a pilot program
launched in Ontario. This pilot program offered important insights, and is lauded as one reason why
Canada’s migration went faster and smoother, compared to other countries. The trial run alerted the
national migration effort to the lag in consumer readiness for contact cards — which was remedied
by embracing NFC-powered contactless mobile payments.
Results: Canada has seen triumphant results in reducing card-present fraud losses, especially those
produced by card skimming and cloning. In March 2013, fraud loss from skimming was at its lowest
since 2003. Like other migrated nations, however, Canada has also seen a spike in CNP fraud.
CREDIT CARD FRAUD IN CANADA 2008-2010
2008$0.00
$50.0
$100.00
$150.00
$250.00
$200.00
2009 2010
Card-not-Present
Card-Present
Fraud losses from counterfeit and lost or stolen credit cards is down 30% since the national rollout of chip-and-PIN in 2008.
Since the national rollout of chip-and-PIN in late 2008, card-not-present fraud on Canadian-issued credit cards is up 37%.Fr
aud
Loss
es I
n M
illio
ns C
AD
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
17
Lessons Learned
France’s experience displays an exaggerated trend seen in most countries after EMV migration: a
dramatic decrease in card-present fraud, followed by a significant move from card-present fraud
to card-not-present fraud alongside a shift from domestic fraud to cross-border fraud. The French
EMV migration shows us that EMV standards are very effective at eliminating certain types of
fraud, but are not a solution to eliminate fraud completely. France’s migration story also highlights
the importance of EMV ubiquity for maximum security and interoperability. If all economies had
migrated when France did, the opportunity for cross-border fraud would have been unavailable.
In the UK, PIN cardholder verification was an excellent policy for reducing card-present transaction
fraud, but fraudsters will look elsewhere for vulnerabilities, and a spike in card-not-present fraud will
likely follow a switch to safer cardholder verification measures.
Australia’s migration proves that the more you wait around, stall or disregard industry deadlines,
the larger the target on your back grows for fraudsters around the globe. As other economies crack
down on pushing for modernized cardholder verification methods, outdated methods become
weaker and weaker in comparison.
Canada can teach the US that — whether they are from a domestic pilot program, or from a deep
analysis of other country’s migration attempts — gathering as many EMV migration insights as
possible is an absolute must. Consumer and merchant education is of great importance for a smooth
migration. If brands come together and agree on common timelines, merchants will be more likely to
embrace EMV earlier on. Working together can greatly reduce unexpected migration setbacks.
Sources:
http://blog.unibulmerchantservices.com/
adoption-of-chip-based-credit-cards-pushes-up-e-
commerce-fraud/
http://digitaltransactions.net/news/story/Canada-
Puts-Down-Chip-Card-Roots
http://news.alaric.com/industry-news/payments/
closing-the-emv-gap-in-australia/
http://en.wikipedia.org/wiki/Chip_and_PIN
Chip-and-PIN: Success and Challenges in
Reducing Fraud
Douglas King
Retail Payments Risk Forum Working Paper
Federal Reserve Bank of Atlanta, January 2012
EMV Adoption and Its Impact on Fraud
Management Worldwide: A whitepaper prepared
exclusively for FICO
Mercator Advisory Group, Jan 2014
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
18
National EMV migration began in
2008
Between 2008 and 2010, fraud losses from lost/stolen
cards fell over
30%
CANADANational EMV
migration began in
2004
Between 2004 and 2010, card-present fraud fell
69%
UK
National EMV migration began in
2004
Between 2004 and 2010, card-present fraud fell
50%
FRANCE
From 2004-2010, the fraud rate
increased by over
70%Between 2007 and 2010, the
portion of fraud due to card-present fraud
increased by
20%
US
National EMV migration began in
2008
Between 2008 and 2010, card present fraud fell
15%
AUSTRALIA
EMV-Enabled Cards and Terminals by Region
Generally, a migration to EMV standards results in
a large reduction in card-present fraud.
Chip-enabled cards are very di�cult to physically
reproduce or misuse, so stolen and counterfeit
cards become significantly less valuable to
fraudsters in EMV dominant payment ecosystems.
This trend causes physical card fraud to move to
countries where EMV is less dominant.
One of the biggest advantages of EMV is the
convenience of global interoperability for card users.
For a cardholder abroad, performing a transaction
with a non-EMV payment card in a region where EMV
is dominant is more di�cult, slower to process, and
sometimes not an option at all.
41.1%CARDS
76.7%TERMINALS
CANADA, LATIN AMERICA & THE CARIBBEAN
94.4%CARDS
84.4%TERMINALS
EUROPE ZONE 1
68.1%CARDS
14.5%TERMINALS
EUROPE ZONE 2
75.9%CARDS
20.6%TERMINALS
51.4%CARDS
28.2%TERMINALS
EMV 101: EMV ADOPTION RATES BY REGION
This chapter takes a look at how EMV migration
will affect each party within the current
US payment ecosystem.
EMV 101: THE KEY PLAYERS
20
Key Player: The Industry Payment Network
The major US payment networks (Visa, MasterCard, American Express and Discover) are the main
drivers of the EMV migration. Europay (since acquired by MasterCard), MasterCard and Visa jointly
conceived the EMV specification, and have played major roles in EMV migrations all over the world.
The payment networks partner with many players throughout the US payment ecosystem, and
therefore are the ultimate champions of interoperability and cooperation. Their wide influence
makes them the go-to leaders in this large national migration push.
Key Player: The Cardholder
Cardholders will begin to receive new EMV chip cards in the mail as replacement cards to their
current magnetic stripe cards. It will be critical for issuers to educate their cardholders on how to
use the new cards at point-of-sale (POS) terminals. Other national EMV migrations (those in Canada
and Australia, for example) have experienced set backs and even missed big industry deadlines due
to concerns about cardholder readiness.
After the adoption of EMV, the way consumers physically use payment cards will be different. Not
all smart cards are the same; but they can be easily categorized into three main groups — contact
cards, contactless cards and dual interface cards. With contact chip cards, the chip is embedded into
the actual cardstock material, under a contact which is physically visible. Instead of swiping, contact
chip cards are inserted into the POS terminal for the duration of the transaction. The cardholder will
typically be required to verify their identity one of two ways: by entering in a PIN number, which
must be memorized, or by providing a signature. With contactless chip cards, the chip is embedded
into the actual cardstock material and is not physically visible. Contactless chip cards are tapped or
waved over or near a receptor space marked on the POS terminal to complete the transaction, which
only takes a moment. Cardholders might be required to verify identity by entering their signature
for contactless chip transactions. Many times now verification will be required. Dual interface
KEY PLAYERS
BANK
0000 0000 0000 0000
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
21
cards include both contact and contactless technologies and can therefore be used to complete
transactions through either inserting the card or waving the card over the POS terminal. Not all card
programs will require that their cardholders use a PIN to verify their identity, but in terms of overall
security, PIN verification is the best practice.
As the US begins its shift to EMV, all of the smart chip cards issued will also have a magnetic
stripe on the back. This way, should a cardholder encounter a POS terminal that has not yet been
upgraded by the merchant to support EMV; the cardholder can simply swipe their card the way we
do today. One of the primary goals of the switch to EMV standards is interoperability. We want to
enable all payment cards to safely work with all POS terminals across the globe.
Key Player: The Card Issuer
Financial card issuers are vital to a smooth EMV migration. Throughout the entire migration process,
educating cardholders and merchant clients about the EMV system and its standards will fall
largely on issuers’ shoulders. Becoming well versed in EMV specifications and migration education
strategies is in every issuer’s advantage.
EMV will not only change the way we physically use cards; it will change the way card programs
run behind the scenes as well. Each step in the payment process — from a card starting out as a
plain piece of plastic, to being a list of successful transactions on a statement — will include new
security features and processes. For each of those steps, issuers will need to evaluate their current
technologies and infrastructures, and invest in the necessary upgrades including hardware and
software to manage the chip card personalization, issuance, delivery and operational processes.
BANK
0000 0000 0000 0000
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
22
Key Player: The Merchant
To most merchants, the switch to EMV seems like a costly technology upgrade that their businesses
will not directly benefit from. POS terminals will need to be upgraded to meet EMV specifications,
and back-end systems must be updated and certified to be able to accept payments from the new
cards. Employees will also need to be trained to use the new technology.
These integral steps come at no small cost, and generally, merchants are the least eager key
players to migrate. Financial pressures such as card brand-enforced fraud liability shifts aim to get
merchants more on board. EMV upgrades will directly benefit their customers, which makes them a
good investment; however, EMV can also introduce many new (and potentially lucrative) payment,
loyalty, marketing and mobile commerce opportunities into the shopping landscape — possibilities
that merchants should assess and leverage early on to stay competitive in the transforming
payment market.
Key Players: The Card Manufacturer and The Software Developer
It’s up to software developers and card manufacturers to make EMV cards as efficiently and cost-
effectively as possible. Applications for the card chips, POS terminals, processors, ATMs and mobile
devices will have to be written and maintained to ensure secure, reliable interoperability across
channels to meet EMV standards.
BANK
0000 0000 0000 0000
BANK
0000 0000 0000 0000
BANK
0000 0000 0000 0000
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
23
Key Players: The Acquirer & Payment Processor
The US migration to EMV means that the entire industry is taking some time to evaluate current
payment processing and authentication infrastructures, in order to make plans and upgrades for
meeting EMV specifications. Because the market is on the cusp of a major transition, industry
leaders like Visa and MasterCard are spearheading efforts that can make the payment ecosystem
even more secure, on top of the security benefits that will come with EMV implementation. One
example of this is the possible implementation of tokenization technologies alongside EMV
upgrades. Tokenization is a practice that removes important cardholder data (i.e. the PAN) from the
servers of retailers, while still allowing them to access it if required (for a return, or a subscription).
Tokenization removes the incentive for hackers to steal card information in the thousands from
retailers, because the tokenized data which the hacker might capture would be meaningless to
them. To learn more about it, read our next chapter.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
EMV 101: BEHIND THE TRANSACTION
This chapter traces the path that payment data
will take under the new EMV standards.
25
The adoption of EMV payment systems has proven to be a worthy card fraud deterrent for
card-present transactions in every region where it has been embraced. In 2004, the UK
launched a vigorous, nationwide “Chip and PIN” card program, and 2010 marked a ten-year
low in UK payment card fraud losses. In recognition of positive EMV fraud-reduction rates
elsewhere, the major card brands have declared EMV as one way to move forward and secure
the US payment infrastructure. The US is the largest payment market where EMV has not
been adopted, making it a target for card fraud opportunities that are not viable elsewhere.
Anatomy of an EMV Chip Card Payment Transaction
There are three distinctive aspects of an EMV transaction which if implemented helps
secure different aspects of that transaction: card authentication, cardholder verification
and transaction authorization. EMV payment processes can happen online (processes are
performed by computers elsewhere on the payment network) and/or offline (processes are
performed between the point of sale (POS) terminal and the card’s chip).
EMV 101: BEHIND THE TRANSACTION
Loss per £100
FRAUD LOSS RATE UK-ISSUED PAYMENT CARDS
2000£0.00
£0.02
£0.04
£0.06
£0.08
£0.10
£0.12
£0.14
2001 2002 2003 2004 2005 2006 2007 2008 2009 2010
CHIP AND PINDEPLOYMENT
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
26
ISSUER
PAYMENTBRAND
24
AR
QC
AR
PC
AR
QC
AR
PC3
4
4
1
5
PAYMENTTERMINAL
Card authentication ensures that a payment card is not counterfeit. There are two ways a chip card
can be verified for authenticity; online or offline.
Online card authentication transactions carry dynamic data that is sent to the card issuer’s
authorization system which checks the authenticity of the card. Offline card authentication uses
chip-stored, risk assessment logic to determine if a card is authentic.
Cardholder verification ensures that the card user is the legitimate cardholder. Cardholder
verification requests that the card user provide either a signature, a valid PIN (Personal
Identification Number), or in some cases (e.g. contactless transactions) no verification is required.
Like card authentication techniques, PINs can be stored for verification either online in an issuer
authentication server, or offline on the chip.
Transaction amount authorization ensures that a purchase does not exceed the cardholder’s issued
credit limit and is within other specified limits (e.g. domestic or international purchases). As with
card authentication and cardholder verification, this authorization can also be processed online or
offline. Offline risk assessment logic offers chip cards unique protections against fraud and credit
overruns.
Within the current US payment system, merchants are the primary targets for fraudsters, who covet
the large amounts of cardholder data used, moved and stored through merchant POS devices,
networks and central servers. A truly formidable payment security standard will protect sensitive
cardholder data in each of its three states: data at rest, data in use and data in motion.
1. Based on issuer qualifications, risk assessment is performed by both the POS terminal and the chip on the card. A dynamic ARQC (Authorization Request Cryptogram) is written.
2. The ARQC is sent via the acquirer to the payment brand.
3. The payment brand then sends the ARQC to the issuer.
4. The issuer makes an authorization decision to validate the request, and responds with an ARPC (Authorization Response Cryptogram), which goes through the same channels back to the point of sale device.
5. If the chip’s request is validated, the POS terminal will request verification from the cardholder in the form of a signature, entry of a PIN, or in some cases no verification.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
27
Within a payment ecosystem, data at rest is cardholder information stored in central servers by
card issuers, for card functionality and reissuance, but also by merchants, for use in refunds, returns,
recurring charges and sales reports. Data at rest can be protected by tokenization, a process where
a payment card’s personal account number (PAN) is replaced with surrogate “token” values, and
stored with reduced risk. A stolen or breached token number cannot be used to perform an outside
transaction, but can be used by the merchant for returns, future charges, etc.
Data in use refers to the data that occupies a computer’s (or POS terminal’s) RAM (Random
Access Memory) at any given time. This is the space a computer uses to store data that it will
need to perform a task. Data in motion is data being sent from one point in a payment network to
another. Data in use and in motion can be protected with encryption, where computer algorithms
transform information from readable plain text to unreadable cipher text. Encryption does not
altogether prevent information theft, but it does reduce the likelihood that the thief would ever be
able to successfully use the stolen information. To decrypt the message, the reader must use a key
algorithm, without which the data cannot be used.
Encryption and tokenization are two security measures that collaborate with and complement EMV
security standards for protecting cardholder data in every stage of its use cycle.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
29
Migration Action Checklist
EMV is the future of payment; and migrating your offerings to include EMV is key to
remaining relevant in the payment card market. We want to help you capitalize on the
changes ahead. Not sure where to begin? Start by taking a phased approach to your
migration.
Phase one of any EMV migration should focus on getting familiar with EMV standards
at every level. There’s a whole new landscape of technologies, security features, best
practices and interoperability standards out there, and understanding all of your options and
constraints is key. Solid comprehensive knowledge of EMV can be leveraged to make smarter
strategic decisions about how and when to migrate.
This strategic planning makes up the focus of phase two. Evaluate your current card portfolio
and technology infrastructure. Which programs would benefit from EMV first? Which card
layouts are affected? What are your budget constraints leading up to the liability shift? Are
your solutions EMV-ready?
Phase three is all about action. It’s the time to make all the necessary upgrades to start
bringing the benefits of EMV to your cardholders. If you’re an existing Datacard® CardWizard®
software customer, use this checklist as your phase three itinerary, and Entrust Datacard as
your trusted guide. If you’re migrating central issuance operations or starting from scratch,
you’ll find the answers you need from one of our global EMV consultants.
EMV 101: MIGRATION ACTION CHECKLIST
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
30
1. Assess your technology infrastructure
Perform an audit of your existing hardware and software versions. EMV card programs
require the latest upgrades to prepare for everyday issuance.
• What version of Datacard® CardWizard® software are you running?
• What Windows operating system do you have installed?
• How many remote locations do you need to track and does every device you own have a
license for EMV card personalization?
2. Review your card gallery
Many card designs need to be altered to accommodate the placement of the chip. EMV
standards will require redesigns and layout changes within your card setups.
• What card designs will you carry over for your new program?
• How will the chip impact existing designs?
3. Evaluate your data center Migrating to EMV card issuance will likely introduce changes within your IT infrastructure.
EMV card issuance might require changes to your host and/or switch environment to
handle the additional data, security protocols and processing.
• Will EMV-related data elements be transmitted between your host and CardWizard®
software?
• Will CardWizard® software send EMV-related data to your switch?
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
31
4. Determine if you have the right Hardware Security Module (HSM)
Ensure the latest version of CardWizard® software works with your HSM since this is a
critical step in the production process.
• What is the model of your HSM?
• Is it internal or external?
• Is it FIPs Certified?
5. Upgrade your instant issuance systems
Not all instant issuance systems are EMV-ready. EMV issuance will require an instant
issuance system equipped with a contact and contactless smart card encoder.
• Which card personalization systems do you currently use?
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
EMV 101: GLOSSARY OF TERMS
This chapter defines a set of standard terminology
and enable clear understanding of all things EMV.
33
SOURCES
http://blog.unibulmerchantservices.
com/adoption-of-chip-based-
credit-cards-pushes-up-e-
commerce-fraud/
http://digitaltransactions.net/news/
story/Canada-Puts-Down-Chip-
Card-Roots
http://news.alaric.com/industry-
news/payments/closing-the-emv-
gap-in-australia/
http://en.wikipedia.org/wiki/Chip_
and_PIN
Chip-and-PIN: Success and
Challenges in Reducing Fraud
Douglas King
Retail Payments Risk Forum
Working Paper Federal Reserve
Bank of Atlanta
January 2012
EMV Adoption and Its Impact on
Fraud Management Worldwide:
A whitepaper prepared exclusively
for FICO, Mercator Advisory Group
Jan 2014
INDUSTRY TERMS
Acquirer
The acquirer is the party recognized by the network as the financial sponsor for a merchant
(typically a regulated financial institution like a bank). The network holds the acquiring
processor financially responsible for transactions processed by the merchant and helps ensure
that the merchant operates under the rules laid out by the network. Examples: Bank of America
Merchant Services, First Data, Wells Fargo, Vantiv, SHAZAM/ITS Inc.
Acquiring Processor
Acquiring Processors are third-party service providers that acquire and process payment
transactions for merchants, manage the relationship with the global and regional payment
networks on the merchant’s behalf (including interchange qualifying, chargeback disputes and
fees to networks and issuers), and manage the transaction database. The acquiring processor
connects merchant transactions to payment networks by (1) providing the POS device; and/or
(2) securely routing the transaction from the POS device or from the POS payment gateway to
the payment network; (3) managing transactions from authorization to clearing to settlement.
Application Authentication Cryptogram (AAC)
A cryptogram generated by the card at the end of offline and online declined transactions.
It can be used to validate the risk management activities for a given transaction.
GLOSSARY OF TERMS
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
34
Application Cryptogram (AC)
A cryptogram generated by the card in response to a
GENERATE AC command, providing the card decision on
the transaction. The AC is used to validate that the card has
genuinely generated the response.
The three types of cryptograms are Transaction Certificate
(TC), Authorization Request Cryptogram (ARQC), and
Application Authentication Cryptogram (AAC). The
creation and validation of the cryptogram enables dynamic
authentication.
Application Identifier (AID)
Application Identifiers are data labels that differentiate
payment systems and products. The card issuer uses the data
label to identify an application on the card or terminal. Cards
and terminals use AIDs to determine which applications are
mutually supported, as both the card and the terminal must
support the same AID to initiate a transaction. Both cards and
terminals may support multiple AIDs. An AID consists of two
components, a Registered Application Identifier (RID) and a
Proprietary Application Identifier Extension (PIX).
Authorization Response Cryptogram (ARPC)
Used during online issuer authentication, the ARPC is
a cryptogram generated by the issuer and sent in the
authorization response back to the terminal. The terminal
sends this cryptogram to the card, which allows the card to
verify the validity of the issuer response, and go ahead with
the transaction. (See ARPCs in action in EMV 101: Behind the
Transaction)
Authorization Request Cryptogram (ARQC)
This cryptogram is also used during online card authentication.
It is generated by the card and sent to the issuer in the
authorization or full financial request. The issuer validates the
ARQC to ensure that the card is authentic and card data was
not copied from a skimmed card. (See ARQCs in action in EMV
101: Behind the Transaction)
Cardholder Verification Method (CVM)
Different cards use different methods to authenticate that
the person presenting the card is the valid cardholder. EMV
supports four CVMs: offline Personal Identification Number
(PIN) (offline enciphered & plain text), online encrypted PIN,
signature verification, and no CVM.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
35
Certificate
An electronic document binding some pieces of information
together, such as a user’s identity and public encryption key.
The digital certificate is used to prove to the data recipient the
origin and integrity of the data.
Certificate Authority (CA)
A trusted central administration that issues and revokes
certificates and is willing to act as a guarantor for the identities
of those to whom it issues certificates and their association
with a given key.
Certificate Authority Public Key (CAPK)
In order to support data authentication or offline enciphered
PIN, the terminal must store one or more public keys for each
RID. When required, the card will supply a CAPK index which
is used to identify which of these keys should be used for that
transaction.
Contact Chip Card
A chip card is a card that communicates with a reader through
a contact plate. The plate must come into contact with a
terminal, usually through a chip reader into which the card is
inserted. Communication is defined by ISO 7816.
Contactless Chip Card
A chip card that communicates with a reader through a radio
frequency interface, usually through a wave or tap of the card
on the designated area on the terminal. A contactless chip card
will have an antennae embedded in the card’s plastic.
Data Encryption Standard (DES)
Data Encryption Standard is a symmetric-key algorithm for
encryption of electronic data.
Dual Interface Chip Card
A chip card that has both contact and contactless interfaces,
enabling a payment transaction with either interface.
“Dynamic” vs. “Static”
“Dynamic” data has the ability to change or update. For
example, a dynamic card security code changes for each
transaction. “Static” or “persistent” data is unchangeable.
For example, the personal account number programmed
into a smart chip card cannot be changed after the card is
personalized.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
36
Electronically Erasable Programmable
Read-Only Memory (EEPROM)
EEPROM is digital memory that can be erased and reused,
but does not require electrical power to maintain data.
It is used to store information that will change, such as
transaction counters. It is possible to load new data elements
and applications into EEPROM after a card has been
issued. Generally after personalization and issuance, limited
application data can be updated. This is linked to card
security requirements.
EMV Migration Forum (EMF)
The EMV Migration Forum is an independent, cross-industry
body created by the Smart Card Alliance to address issues
that require broad cooperation and coordination across many
constituents in the payments space to promote the efficient,
timely, and effective migration to EMV-enabled cards, devices,
and terminals in the United States.
EMV (Europay, MasterCard, and Visa)
Developed by Europay, MasterCard, and Visa, EMV refers to a
body of specifications set to ensure interoperability between
payment chip cards and terminals. Formally known as the EMV
Integrated Circuit Card Specifications for Payment Systems and
owned by EMVCo.
EMVCo
EMVCo was formed in February of 1999 by Europay
International, MasterCard International, and Visa International
to manage, maintain, and enhance integrated circuit card
specifications for payment systems. EMVCo is currently, and
equally, owned by American Express, Discover, JCB, MasterCard
Worldwide, Union Pay and Visa, Inc.
GlobalPlatform
A cross-industry membership organization created to advance
standards for multiple application smart card growth. A major
goal of GlobalPlatform is the definition of specifications and
infrastructure for multi-application smart cards, including cards,
terminals and back-end host systems. The GlobalPlatform
Specifications are based on the Open Platform Specifications,
which were donated to the consortium by Visa.
International Standards Organization (ISO)
The ISO is a global institution that maintains over 13,000
international standards for business, government and society.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
37
Issuer
Issuers are the entities that issue payment cards to customers
and perform many activities that could include, but are not
limited to, the following list. It is important to note that the
issuer may choose to outsource some, or all, of these activities:
• Cardholder customer service
• Data preparation
• Configuration set-up
• Fulfillment of personalized chip card, with all paper inserts;
preparation for mailing to customer
• Define card profile, including risk parameters
• Receive and manage card records and keys to form a
personalization record
• Generate personalization script
• Key management activities for EMV, CVV/CVC, and PINs
between card manufacturer and personalization bureau and
between issuer and personalization bureau.
Issuer Action Codes (IACs)
IACs are codes placed on the card by the issuer during card
personalization. These codes indicate the issuer’s preferences
for approving transactions offline, declining transactions offline,
and sending transactions online to the issuer based on the risk
management performed.
Issuing Processor
Issuing processors facilitate card issuance activities on behalf
of an issuer, such as process payment transactions, card
enrollment, preparing and sending the card personalization
information to the card vendor, and maintaining the cardholder
database. The issuer processor may provide other ancillary
services as well (e.g., web front-end administrative and
cardholder account management applications, customer
service, settlement and clearing, chargeback processing)
Liability Shift
When card fraud occurs, one party involved in the transaction
(the cardholder, merchant, issuer, processor, etc.) is found
liable, or at fault. A liability shift is a change in the rules that
guide which party is liable for card fraud, should it occur. Each
brand defines the rules around their liability structure.
Magnetic Stripe Card
These plastic payment cards use a band of magnetic material
to store data. Data is stored by modifying the magnetism of
magnetic particles on the magnetic material, which is read by
“swiping” the magnetic stripe through a mag stripe reader.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
38
Near Field Communication (NFC)
NFC is a standards-based wireless communication technology
that allows data to be exchanged two ways between devices
that are a few centimeters apart. NFC-enabled mobile phones
incorporate smart chips (called secure elements) that allow
the phones to securely store the payment application and
consumer account information and to use the information as a
“virtual payment card”.
“Offline” vs. “Online”
In the context of an EMV transaction, “offline” refers to actions
and processes that are performed by the card’s chip and the
point of sale terminal alone, using applications stored on one/
both devices. An “online” action or process includes data that is
sent out to other computers managed by payment processors,
issuers, or card brands.
Payment Card Industry Data Security
Standard (PCI DSS)
PCI DSS is a framework developed by the Payment Card
Industry Security Standards Council for developing a robust
payment card data security process — including prevention,
detection and appropriate reaction to security incidents.
Payment Network
A payment network provides POS and ATM services for
credit, debit, ATM and prepaid card issuers and corresponding
transaction acquirers. It establishes participation requirements,
operating rules and technical specifications under a common
brand(s) for the purpose of receiving, routing, securing
authorization for, settling and reporting domestic and
international payment transactions. Each payment network
determines the types of transactions, payment devices and
terminals that are permitted in its respective network.
Personalization
Personalization is the process by which the elements specific
to the issuer and cardholder are added to the payment card’s
magnetic stripe and/or chip.
Personal Account Number (PAN)
Often referred to as the primary account number, or the bank
card number. The PAN is often embossed onto the front or
back of a credit or debit card. The PAN is commonly 16 digits,
but can be up to 19 digits in length.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
39
Personal Identification Number (PIN)
A PIN is an alphanumeric code of 4 to 12 characters that is
used to identify cardholders at a customer-activated PIN
pad. PINs can be verified “online” or “offline”. Online PIN
verification occurs when the PIN is securely transmitted to an
issuer’s authorization system during a transaction, with that
authorization confirming whether or not the entered PIN is
correct. Offline PIN verification occurs between the chip and
the POS terminal.
Point of Sale (POS)
A point of sale terminal is a machine where card-present credit
transactions occur. POS terminals come in many varieties, and
are often embedded into automated vending machines.
Random Access Memory (RAM)
RAM is a direct-access form of computer storage. When data is
required to perform a computational task it is moved into RAM
for the duration of the task.
Read Only Memory (ROM)
ROM is permanent memory that cannot be changed once it is
programmed. It is used to store chip operating systems and
permanent data.
“Static” vs. “Dynamic”
“Static” or “persistent” data is unchangeable. For example, the
personal account number programmed into a smart chip card
cannot be changed after the card is personalized. “Dynamic”
data has the ability to change or update. For example, a
dynamic card security code changes for each transaction.
Transaction Certificate (TC)
TCs are cryptograms generated by the card at the end of all
approved transactions. The cryptogram is the result of card,
terminal, and transaction data encrypted by a DES key. The
TC provides information about the actual steps and processes
executed by the card, terminal, and merchant during a given
transaction and can be used during dispute processing.
Triple DES (TDES, 3DES)
TDES is a sophisticated implementation of DES, in which the
procedure for encryption is the same but repeated three times.
First, the DES key is broken into three sub keys. Then the data
is encrypted with the first key, decrypted with the second key
and encrypted again with the third key. Triple DES (sometimes
abbreviated TDES or 3DES) offers much stronger encryption
than DES.
EMV101
WHAT
WHEN
WHO
WHERE
WHY
HOW
top related