EMV, Tokens And The Cloud

EMV has long been a traditional, predictable technology. We know what the components are, we know who the vendors are, and we know what software to implement, says Michelle Lehouck, EMV Product Director at Bell ID. But unpredictable, non-traditional companies like Apple and Samsung, she said, are stirring up the established EMV space – and that’s something to watch. Lehouck spoke one-on-one with MPD CEO Karen Webster at the PYMNTS office to share her insights on how tokenization and cloud-based payments relate to EMV, what the key players are up to and how mobile-money-to-hard-currency schemes in places like Africa fit into the EMV environment.

EMV has long been a traditional, predictable technology. We know what the components are, we know who the vendors are, and we know what software to implement, says Michelle Lehouck, EMV Product Director at Bell ID. But unpredictable, non-traditional companies like Apple and Samsung, she said, are stirring up the established EMV space – and that’s something to watch. Lehouck spoke one-on-one with MPD CEO Karen Webster at the PYMNTS office to share her insights on how tokenization and cloud-based payments relate to EMV, what the key players are up to and how mobile-money-to-hard-currency schemes in places like Africa fit into the EMV environment.



KW: Let’s talk about EMV in the context of some interesting trends that are happening in the space. Apple Pay, tokenization and cloud-based payments are what everyone talks about. How do all of those things relate to EMV?

ML: What I’ve seen is that EMV is a traditional, predictable technology. We know what the components are, we know who the vendors are, where to buy things, and what software to implement. In my opinion, EMV is really on its own path. The other technologies are growing, evolving and making it more exciting in a space with financial payments. But EMV is very predictable.

 

KW: Is there an advantage because EMV exists and banks have now more widely adopted tokenization as a strategy to create a more secure transacting environment?

ML: The area where it’s most obvious to me is the card-not-present (CNP) space. Over the years we’re seeing more payments happening over the Internet or via mobile phones. So absolutely, because of the nature of that – the person is not present, the card is not present – you need a way to authorize that transaction. Tokenization is the best means to secure the entire transaction, whether it’s an EMV transaction or not. It’s a way to enable tracking transaction and the participant to make sure they are authentic. That strengthens EMV, but I don’t think there are too many gaps in EMV – it’s been a workhorse over the past 15 years.

 

KW: So you talked about the ecosystem of EMV. Take a step back and walk us through the ecosystem of EMV. Who are the players, and what do they do?

ML: They’re really the same players in the magstripe environment, they just have to go in and reassess what types of clients they have, and what their market share looks like. In some cases, direct issuers want to follow the EMV migration, and then you have people who are managed by someone like a processor or a bureau – the large portfolios that are managed on behalf of a financial issuer.

The stakeholders are still the same, it’s just the means of issuing another plastic, or a mobile digital wallet for their phone, that’s different. The participants in the scheme are still present; it’s just different levels of certification – things in the EMV scope that involve expiration. The chip itself, the software housed on it and the OS and financial applications for credit and debit, all of those things expire. So it’s managing vaults of silicon inventory, making sure that software application is still active and live, and that Visa, MasterCard, Amex or Discover has indicated how much longer they have until it expires.

Then there’s the whole management of after the card has been personalized – that’s something people really lose touch with. For a magstripe card, once you have it in your pocket, you just use it – and you sign or enter a PIN. But with an EMV card, you can actually manage the lifecycle of that card after it’s in the field for about three years. So you can send messages to the card, kill the card, or wake up dormant apps on the chip already. It’s being able to take the scope of an EMV chip and realize that it has a life. When you start to initiate the card, you have to think, what might we do in two or three years? Do we want to start with a signature, and then maybe in 18 months I want to wake up a PIN?

Those kinds of things require groups to understand what they have as a project and what you can do with that chip. They are paying more, but it gives them more. They’re able to use it a lot more in the field for different things.

 

KW: Why didn’t the U.S. adopt PIN with chip?

Some people are doing it. It’s kind of like a split house. Some people are steadfast on the signature, but in some environments, they don’t feel like it’s 100 percent EMV if it doesn’t have a PIN involved. For a long time it was just a misunderstanding that PIN is a lot more expensive – it’s not, it’s just understanding how to manage it globally. It’s more about knowledge than cost.

 

KW: In places like Africa where the mobile money schemes are really developed by the operators, what they’re doing is mobile and then cash – or whatever the currency is of the country. It then evolves to prepaid cards or cards at some point, but the whole personality of the user is very different. There are mobile devices, and then there is hard currency. What is your experience with this and what is your thinking in that environment?

ML: Earlier in my career, I was covering Africa. One of the projects I was working on was a government project for pensioners. There were about 30 million pensioners they were targeting to have a salary card because they’d go to collect their pension money every month, they would give them a little less than they were supposed to get. That was something that was caught by the government, and they thought a smartcard would therefore be good.

So I think there are other projects that aren’t necessarily financial – healthcare, government, IT, transit – that further drive smart payments. You still see a stream of it – it might not be a traditional debit card with a dual interface chip, but you’ll see the stream because in the end, what they’re mainly used for is tracking security and fraud.

 


Michelle Lehouck
EMV Product Director, Bell ID

Michelle has over 15 years of payments knowledge, gained previously with companies such as STMicroelectronics and CPI Card Group. With practical experience of migrating European banks to EMV chip payment technology, she has significant expertise of all aspects of EMV market strategy. This includes understanding the impact of implementing EMV on a bank’s infrastructure as well as the critical success factors which need to be met when managing such a project.