A new service from Visa Inc. will help issuing banks get a security boost from chip cards without the costly and time-consuming technology investments that normally would be required.
Visa cards that use the EMV chip standard have a special code called an iCVV, which is submitted with each transaction to prove the card's legitimacy. This code serves the same purpose as the card verification value written to a magnetic stripe card, but it has a different value so the bank systems designed to handle regular CVVs cannot normally handle iCVVs in their place.
Visa's iCVV Convert service, which it is expected to announce Feb. 6, is designed to save U.S. banks time and money as they shift to the EMV chip card standard common in other countries. Visa's service converts the iCVV to a CVV before sending it to the issuer.
Issuing banks "don't have to worry about the added complexity of supporting keys to generate and validate another CVV value. They can just use the same CVV system that they're using today," says Stephanie Ericksen, Visa head of authentication product integration.
"It's faster, there's less development time, … and it's much less expensive for them to do," she says.
Visa also is updating its Chip Authenticate service, which validates a separate cryptogram used by EMV cards. Visa has offered a version of this service for about 10 years, and most EMV card issuers that enroll in the service stay with it, Ericksen says.
State Employees' Credit Union, one of the few issuers of EMV cards in the U.S., uses the Chip Authenticate service. Visa would not say which other issuers use the service. Visa requires the use of an iCVV code with EMV cards issued in the U.S.
In the past 18 months, a million Visa EMV cards have been issued in the U.S. Most EMV cards issued to U.S. citizens are offered to travelers to use in countries where the standard is widespread.
Merchant acceptance of EMV cards in the U.S. remains low. Visa has set deadlines for merchant acceptance, though merchants have expressed some concern over whether the cards will use the same level of security in the U.S. as they do overseas (see story).
EMV cards are called chip-and-PIN cards because they are commonly used with a PIN. However, Visa and MasterCard have said that a PIN is not necessary in the U.S., and even though U.S.-issued EMV cards are meant to be used in chip-and-PIN territories, some issuers have already forgone PIN codes with their cards (see story).
MasterCard last week issued new EMV rules that might resolve this concern (see story). Although MasterCard does not explicitly require a PIN, it plans to enforce a "liability hierarchy" that states that the party using the least effective card-security method will pay for any fraud. This policy might push more issuers and merchants to support the chip-and-PIN approach, which is at the top of the hierarchy.
Visa's EMV-issuance services address one of the key remaining obstacles to widespread use of the EMV standard in the U.S., says Avivah Litan, a vice president and distinguished analyst at the Stamford, Conn., market research company Gartner Inc.
"The card issuers have been very reluctant to upgrade anything with the card authorization systems and even the fraud detection," she says, so Visa's new services are "a big deal for the banks because they don't want to rip anything out and modify it."
The services also benefit Visa, and not just because they help the card network in its push for a more secure card format, Litan says.
With Visa's services, "it's easier for the banks now" to issue chip cards, "but it makes them more dependent on Visa's systems," she says.
What do you think about this? Send us your feedback. Click Here.