Until a few months ago, much of the talk about emerging payments involved conversations around which mobile technology would surface as the leader – Near Field Communication (NFC), QR codes, or some other technology. That changed, however, when Visa and MasterCard ended all speculation on whether they might push back their EMV chip card liability-shift deadlines after the recent major data breaches at Target, Neiman Marcus and some other retailers.
With those deadlines, which American Express and Discover also support, all non-petroleum merchants must be able to accept a presented EMV card as of October 2015 or face being held liable for any subsequent counterfeit fraud committed with that card. The same mandate takes effect two years later for petroleum merchants, whose more complex card-acceptance systems require more time to upgrade.
“You hear a lot more talk about EMV than you hear about NFC, and that's just the reality of the marketplace that we're doing business in today,” Ed Gilligan, president of American Express Co., commented during a recent Sanford C. Bernstein Strategic Decisions Conference.
DEBATE AFTER DEBATE
As a result of the liability-shift mandates, much of the EMV conversation has shifted to debates, such as whether a 30-year-old concept to counter card-present fraud can withstand today’s more sophisticated types of criminals.
“EMV bears a cost to many parties and will help reduce quite a bit of fraud, however we shouldn't stop there, as the fraud will shift to areas like card not present. Issuers and merchants alike should concurrently focus on ways to combat CNP fraud with things like dynamic chip authentication methods, tokenization, and multi-factor authentication,” Mark Raleigh, VP IT at CoreCard, told PYMNTS.com recently.
Chip card proponents, including Randy Vanderhoof, executive director of the Smart Card Alliance, counter that the EMV technology continues to evolve, as do the security specifications behind it. Moreover, no other viable alternative is as broadly available, so ignoring EMV and doing nothing while waiting for something else to emerge would be irresponsible, Vanderhoof noted in a PYMNTS.com interview.
Also controversial is the type of authentication EMV cards should support. The National Retail Federation is pushing Congress to require a strictly chip-and-PIN-based EMV system, but Visa and MasterCard issuers in particular believe a chip-and-signature alternative is the best immediate solution. The card networks contend not enough retail merchants support PIN-based purchases, and the transition costs would be much lower with signature authentication. (Issuers also get higher interchange revenue from signature-based purchases.)
DUAL-INTERFACE, OR NOT?
How many cards will support dual-interface contact/contactless EMV chips remains unknown, though some analysts have projected about half will. Vanderhoof says it’s too early to tell because not enough issuers have yet rolled out EMV cards. JPMorgan Chase recently stopped issuing mag-stripe cards supporting contactless payment, and the bank wasn’t clear on what its plans were for EMV cards once it issues them en masse.
If banks are to include contactless functionality in their EMV chips, both they and merchants should emphasize the faster transaction times and other benefits the chips provide. Such knowledge was lacking when contactless chips were added to mag-stripe cards, so use of the contactless functionality was minuscule. That’s one of the reasons why Chase chose to stop supporting the technology.
As consumers find the time to conduct EMV contact card transactions is longer than that with mag-stripe cards, they may start demanding a faster contactless alternative, especially when shopping at merchants that sell low-ticket items.
NFC’s future in helping that education along also seems in doubt. Apple Inc. during its annual investor conference again did not mention NFC as an upcoming technology it would support. To many in the payments industry, where Apple goes, they’ll go. So where it doesn’t, they won’t, though some may get tired of waiting and move along their own path.
NUMBERS TELL THE STORY?
The transition will be huge, and expensive. The eventual card-conversion tab will be $4.2 billion, while merchants ultimately will pay a combined $2.6 billion, not including software, training and maintenance, according to Javelin Strategy & Research.
Target has committed $100 million alone for its own EMV rollout, which includes cards and terminals. And on June 4, Sam’s Club announced it’s official switchover to EMV cards in conjunction with GE Capital, which issues the Sam’s Club MasterCard. Private-label store cards, as a rule, however, likely will be among the last to convert to EMV because of their relative limited and regional use, Vanderhoof tells PYMNTS.com.
As a nation, some 1.2 billion cards and up to 12 million POS terminals ultimately must be enabled to support EMV transactions. However, only about half of either will be ready by the time the shift in liability occurs, according to the Smart Card Alliance. Other analyst projections, however, are much more conservative.
The alliance says that, as of the end of 2013, financial institutions had issued 20 million EMV cards, mostly to commercial customers. It believes that total likely will rise to more than 100 million by the end of this year and to more than 450 million by October 2015 as they also reissue cards to their consumer customers.
The average contact-only EMV card costs issuers between $1 and $1.50, depending on volume, for cards with 4 to 8 kilobits of memory, according to the alliance. Javelin puts the per-card estimate at $3.50, with dual-interface cards that also support contactless payment costing about $1 more.
Javelin also offers a more conservative forecast. It says by the end of next year, some 166 million EMV credit cards (29 percent and 105 million debit and prepaid cards (17 percent) will be in circulation, or a total of 271 million out of 1.2 billion. It puts the total POS terminal count at 8 million, with only about 20 percent of small merchants being EMV-ready today.
The Smart Card Alliance’s Vanderhoof believes many mom-and-pop merchants will awaken to the EMV reality closer to the liability-shift deadline, by which time it will take longer to convert because of the lengthy lines that will exist by then in production queues.
In general, however, re-terminalization will grow quickly, to 4.5 million EMV-capable machines by the end of 2014 year from 2 million at the end of 2013. By October 2015, some 7 million U.S. POS terminals will be capable of supporting EMV transactions, the alliance says. Javelin says half of merchant terminals will be EMV-ready by the end of next year
But while the terminals may be capable of accepting EMV cards, the necessary software to use them must be activated. Expect retailers to do so as the liability-shift deadline draws closer.
Apple’s hesitation to support NFC, perhaps, also is contributing to the strong EMV card push today instead of mobile alternatives. Apple has yet to see viability in NFC, which, unlike the contactless functionality in cards, can support two-way communication with other EMV chips so they can upload coupons, rewards and other data from chips in merchant terminals. Again, few consumers, or merchants, understand NFC’s benefits, which also signifies the educational gap that plagues many newer technologies.
How long it will take for both issuers and merchants to complete their respective EMV rollouts is anyone’s guess. Amex’s Gilligan believes the transition could take up to four years, while Javelin says it could take until the end of 2018 before EMV cards reach “ubiquity.”
Visa CEO Charlie Scharf echoed the sentiment that it will take time for EMV rollouts during a recent JPMorgan Global technology conference call. “I don’t know how long it is going to take,” he said. “But as best we can tell, people are behind it and we are behind it and that, in conjunction with what we are doing in the card-not-present world, we think is good for the payment systems in terms of ‘derisking’ the activities.”
On an earlier JPMorgan Global call, MasterCard CEO Ajay Banga expressed surprise that it is taking so long for EMV to be implemented in the U.S. “The fact that the U.S. was the only country left holding onto mag-stripe is kind of an invitation saying, ‘come and take me kind of thing; I am here for fraudsters,’ which is just not a smart place to be,” he said.
DELAYS AT THE ONSET
The Durbin amendment to Dodd-Frank helped slow the process by requiring at least two unaffiliated point-of-sale network marks on U.S. debit cards. This presented a problem because no other EMV country has such a requirement, so determining how to properly route EMV debit purchases became a challenge. The networks eventually resolved the issue – not surprisingly, after considerable debate – by agreeing to use common application identifiers to route debit transactions across multiple networks from the same chip.
To help speed up the EMV-transition process and help clarify market direction, all of the major card brands are talking with merchants to help resolve issues as they arise. The EMV Migration Forum also is helping with that task as well.
The chip-and-PIN versus chip-and-signature issue is especially problematic. “It's a big question that's still looming – does the U.S. [support] chip and signature, meaning you insert your chip card into a reader, a receipt comes out and you sign it, versus, say, in Europe, you insert your card into a reader and you key a PIN into the terminal? Gilligan said on the Bernstein call. “PINs are more secure, but only slightly more secure. There's a big expense for the industry if it goes to chip and PIN versus chip and signature, which is why I believe Visa and MasterCard set the standard at chip and signature.”
Discussion on which EMV-authentication method to support will continue over the next few years. The chips Amex has started including in its cards being issued at an accelerated pace will work in both signature and PIN environments. “So we've thought about this ahead of time to make sure we have the right technology on the card and then we move with the industry standard as we see fit,” Gilligan said.
The Smart Card Alliance’s Vanderhoof said whether to support PIN-based EMV will be up to individual issuers. “It’s so early in the issuer cycle, it’s hard to predict what the trends will be when we get to that saturation point,” he said.
One of the chief issues in the PIN-versus-signature debate is card authentication, and vendors are looking to fill that hole. SmartMetric Inc., for example, offers EMV debit and credit cards that activate for a transaction only after a successful fingerprint match on the card. Merchants would be able to accept the biometric card like any other EMV card, but issuers would have to deem the cards worth the extra cost.
For merchants, EMV represents just one fraud-protection tool, with tokenization and encryption also helping to protect customer databases on the back end.
When smart cards first were discussed and tested as a U.S. option about two decades ago, speculation swirled around what other functions the chips might support. The discussion today, however, is focused mostly on getting the chip infrastructure in place for cards and terminals, according to the Smart Card Alliance.
It’s possible the added functionality may rest with EMV chips and application software in smartphones instead of cards, though some applications, such as transit access, might work well with both phone and card interfaces.
One would think with the U.S. being the last of the major economic powers to convert to EMV that many of these issues would have been resolved by now. Even that contention, it appears, is open to debate.