In reply to Philip Cohen.

Throughout the world, there are both options, but in the US it is far more popular than elsewhere to have fully-integrated systems where, as a merchant, you own your hardware. In other countries, the acquiring banks supply the terminals for all but the largest retailers. This is one of the biggest barriers to EMV adoption in the US. Merchants don't want to invest in security, as they don't see it as beneficial to them. In fact, I dare say that if it weren't for the Target breach, EMV probably never would have happened in the US. The retailers would have got some Senator who is clueless about payments and security but thinks merchants are god-like (e.g. Dick Durbin) to pass a bill outlawing the EMV liability shift and requiring banks to always take liability, and that would have been that. Thus why we're so close to the liability shift date and merchants are scrambling - and most aren't ready. I believe most merchants believed EMV never was going to happen in the US, and I think many are shocked that it is. In that sense, Target was actually GOOD for security in the long term because they raised awareness and prevented merchants from doing anything to keep the system insecure long-term.