The day when the United States joins many other large markets globally in converting to EMV chip-and-PIN cards from magnetic stripe versions will not occur any time soon. But it will come eventually, one observer predicts.
"At this point it's a matter of when, not if, we'll see EMV in the United States," George Peabody, director of the emerging technologies advisory service at Mercator Advisory Group Inc., a Maynard, Mass.-based firm, tells ISO&Agent. He acknowledges, however, that mag-stripe technology has many years left. "It's inexpensive. It's ubiquitous."
Discussion of how the U.S. payments industry focuses mostly on a series of what-if scenarios, there is no denying that change is afoot, and that change eventually will affect ISOs and acquirers. Merchants one day may need updated terminals, and their employees would need to understand how EMV works. ISOs and acquirers also would have to understand the technology they are selling to merchants.
Indeed, with approximately 983.4 million mag-stripe cards carrying the Visa Inc., MasterCard Worldwide, American Express Co. or Discover Financial Services brands on issue in the U.S., a sweeping metamorphosis of the U.S. payment scheme would affect every element of the payment system. And paying attention to the future today could prepare ISOs and acquirers for change, whether it comes in the form of another card, a contactless chip or inside a mobile phone.
Such a change almost occurred a decade ago in the U.S. when Visa and Target Corp. issued cobranded chip-and-PIN cards, but the retailer has since dropped the initiative. Elsewhere in the world, the number of nations adopting chip cards adhering to the EMV standard continues to grow.
EMV is an international standard for chip-based payment card transactions that requires a PIN to authenticate the cardholder, and it provides some security advantages over signature-based mag-stripe cards. The chips in an EMV card and the point-of-sale terminal engage in a two-way authentication procedure, which is especially important in offline transactions in which the merchant does not secure issuer authorizations, Peabody says.
Those payments organizations already operating where EMV is accepted will be able to draw on that experience. Those that are not would need to reprogram their systems to accommodate the new data format, Peabody says.
"The merchant would be looking at a 'forklift' upgrade," Peabody says, alluding to the replacement of many terminals. Most of the terminals the majority of point-of-sale terminal makers sell have smart card readers, and they can be outfitted with contactless readers.
Over time, the U.S. may move to a chip-and-PIN-based system, more likely as a reaction to challenges associated with international acceptance and standards than to domestic factors, Joby Orlowsky, Discover vice president of strategic initiatives, tells ISO&Agent. Discover already is rolling out chip-and-PIN products through its Diners Club International brand, he says.
Like many in the payments industry, Orlowsky maintains that mag-stripe technology has many useful years left, but alternate means of payment will evolve, such as contactless and mobile. "Convenience, security and technological innovations are likely to be key drivers behind this move," he says.
Other issues, such as external pressures, may prompt some U.S. issuers to consider chip cards, says Jack Jania, vice president and general manager of secure transactions at Gemalto North America, a unit of France-based Gemalto NV. He suggests that card-not-present fraud increasingly will migrate to the U.S. Moreover, U.S. cardholders traveling in EMV nations will experience card-acceptance problems, especially when using automated kiosks for transit transactions and other purposes.
"These factors will drive U.S. issuers to offer an EMV product," Jania says.
Thanks to a well-developed telecommunication infrastructure that makes landline telephone use inexpensive, U.S. bankcard issuers can require online authorizations of transactions made with their cards at the moment of purchase, something many countries, even in Europe, consider too expensive.
Often EMV does not require online authorization at the time of the transaction because the chip in the card authenticates itself to the point-of-sale terminal and vice versa. This means merchants can batch their transactions for transmission to processors when telephone rates are the least expensive.
U.S. issuers and merchants also likely will balk at conversion costs. As such, EMV adoption is a long-term prospect, says Cliff Gray, an associate at The Strawhecker Group, an Omaha, Neb.-based consultancy.
Eventually, payment schemes will encrypt transactions from the time the card is swiped until it reaches the issuing bank, he says. Current measures encrypt transaction data from the merchant to the processor, leaving a gap from the processor to the issuer, Gray says.
EMV would be one component of this advanced payment scheme. "From the card itself, an encrypted credential will pass through smart, safe merchant devices and only be decrypted at the issuer," Gray says. "That is the real long-term eventuality."
For now, however, advanced fraud-protection measures will help ensure the longevity of the mag-stripe card, suggests Kim Fitzsimmons, senior vice president at First Data Corp. in Atlanta. "With the introduction of tokenization and encryption, the current mag-stripe payment method has a life into the foreseeable future," she says.
Fraud-prevention efforts will be an important factor in determining how U.S. card technology evolves, Fitzsimmons says. "Issuers, acquirers and merchants are going to continue to look for fraud-mitigation options to further reduce risks with the current payment scheme in the United States," she says.
A U.S. conversion to EMV would require a massive effort. "This would require enhancements to our processing systems, updated POS equipment, refinement of plastic [card] manufacturing, aggressive merchant and cardholder education, and merchant POS solution upgrades over an extended period," Fitzsimmons says.
Global Payments Inc. similarly would make the necessary changes to accept payments no matter the technology behind them, says Tony Abruzzio, senior vice president at Atlanta-based payment processor.
Abruzzio's job at Global Payments is to track emerging payments, and he doubts EMV, especially as a contact smart card, will arrive anytime soon in the U.S., at least not until the nation is completely surrounded by EMV-issuing nations and fraudsters have wrecked havoc on the U.S. payment system.
Today's efforts to develop tokenization protocols, in which sensitive transaction data are replaced with a code, and encryption of payment details throughout the entire transaction cycle can complement EMV, Mercator's Peabody says. EMV, encryption and tokenization operate in different parts of the payment cycle, he says.
"End-to-end encryption and tokenization are techniques to look after the card data from the terminal," he says. EMV protects the card data between the card and the terminal. "Security is about layered defenses," Peabody says, noting EMV adoption would make it extremely difficult for fraudsters to create cards with stolen card data.
The payment industry's advanced security efforts are cascading off into many directions. Heartland Payments Inc., a Princeton, N.J.-based payment processor, is working on its own advanced POS terminal and encryption protocol. Other processors are working with various companies on encryption, and one payment-terminal maker, VeriFone Holdings Inc. of San Jose, Calif., has its own encryption software.
Moving forward on transaction security will take a unified approach, some insiders suggest.
At Global Payments, the hope is for an industrywide standard for advanced encryption and tokenization techniques, Abruzzio says. "We really want a ubiquitous type of solution," Abruzzio says. "We don't want one particular vendor's technology."
At First Data, security enhancements, including "continued focus on security to mitigate counterfeit fraud, including broad [Payment Card Industry Data Security Standard] compliance, tokenization and encryption," will help extend the life of mag-stripe transactions, Fitzsimmons says.
WHAT COULD HAPPEN?
Though adoption of EMV, as a contact card, is not imminent, other measures, such as contactless and mobile payments, are.
"We are beginning to see adoption of chip technologies in the United States through contactless-payments technology like Visa payWave, where the consumer simply waves their card in front of a contactless payment terminal," a Visa spokesperson says. "Chip technologies can add an important security layer and offer additional benefits for cardholders and retailers like convenience and speed."
Contactless payments rely on chips, too. Visa says its payWave 2.0 standard is based on EMV and provides similar cryptographic security.
"Standard mag-stripe cards, including credit, debit, and prepaid cards, can be enhanced by adding a contactless feature," Visa says. "Visa believes the trend of combining standard mag-stripe technology with advanced features like Visa payWave will continue to drive value to consumers, deliver additional layers of security, and enable new merchant segments, such as transit, vending and small ticket."
At Discover, the convergence of contactless and contact chips is a real possibility, says Orlowsky.
"Trends suggest that there will be a convergence of contactless and EMV in the future," he says. "PIN authentication, whether at the device or within the payments stream, has the ability to enhance security and potentially drive changes to signature requirements. The dynamic card verification component inherent to contactless adds a layer of enhanced security over traditional mag-stripe transactions." Contactless transactions generate unique identifying information for each transaction before payment approval.
But contactless payment for transactions of all sizes may not be the way to go, suggests Gemalto's Jania. "Yes, contactless cards have chips. However, they are designed for fast transactions," Jania says. "They don't address online-transactions security due to the lack of a consumer or PC-based reader."
The real issue with contactless adoption is terminalization because there are virtually no consumer or PC-based products that can read smart cards, Jania says. In Europe, where EMV is common, smart card readers are available for consumers to use at home to make online purchases or to log on to their bank's website.
Still, the U.S. payment scheme will adopt chip cards over the long term, Jania says, noting he sees mag-stripe technology one day relegated to low-security, single-use applications, such as closed-loop gift cards as a potential use for the venerable technology.
Abruzzio, like others, believes the traditional payment card itself may move to another form factor. The likely candidate is the mobile phone, he says.
Several companies are writing payment software for mobile phones, many to make payments and some to accept payments. The omnipresent nature of mobile phones is enabling this, but no one really knows how the situation will pan out, Abruzzio says.
"The whole mobile technology aspect is up in the air right now," he says.
Besides an abundance of different mobile-phone payment technology, questions also linger over the role of telecommunication companies that control the networks, he says.
"The telcos want to participate a little more than the card schemes are allowing them," Abruzzio says.
Mercator's Peabody similarly is paying attention to mobile payments. "It's a challenging picture for everybody," he says. "Merchants will be looking around and have different [choices] on how to invest their resources."
With parts of the payments industry in flux right now, keen observation and a learned approach to studying potential changes may help ISOs and acquirers the most. Changes in the U.S. payment industry are coming. It is the when, what and how that remains uncertain.
From the May/June 2010 issue of ISO&Agent magazine.