15 March, 2007
category: Contactless, Financial, Library, NFC
Andy Williams, Contributing Editor
With Canada and Mexico rapidly moving towards EMV deployment, witness the world’s largest player in the credit card market, the United States, left out in the cold. Some say it’s not a matter of if, but when, the U.S. will implement EMV. One reason: once its northern and southern neighbors are EMV-complaint, crooks may find much easier pickings in the U.S.
Canada began its march towards an EMV world a couple years ago when those highly secure chip cards started showing up as they were in much of Europe and the rest of the world. Mexico began its EMV rollout in 2002, albeit slowly. In the past year implementation has picked up tremendously and the country is expected to be nearly 100% EMV compliant by next year.
EMV still stands for Europay, MasterCard, Visa even though Europay International was absorbed by MasterCard in 2002 and became MasterCard’s Chip Center of Excellence. Also, Japanese credit card giant JCB has joined the network. The three also make up EMVco that was formed in 1999 to manage and maintain EMV standards. Ensuring worldwide interoperability is one of its major goals. EMV also carries the nickname “chip and pin” because every card contains a chip. The card must be inserted into the reader and left there during the transaction. And, users typically must enter a pin number before the transaction can be completed.
“The whole (Canadian) marketplace expects 100 million cards to be deployed by 2010,” said Jack Jania, vice president and general manager, financial services, for card provider Gemalto. The company just recently received its Interac certification to support the personalization of contact smart cards for Canada’s financial community. It has also achieved ISO/IEC 27001 MasterCard and Visa certifications.
Catherine Johnston, president and CEO of ACT Canada, the country’s Advanced Card Technology Association, said, “things are progressing well (with EMV migration). It’s an interesting market because the financial institutions can migrate at their own pace up until 2010, so there is not a need for all to go live at the same time.” The original 2010 deadline for EMV implementation was originally set by Visa and later agreed to by MasterCard, she added.
She and her organization have been talking up EMV a lot. “We want to show stakeholders how to be involved, everyone from credit unions to regulators. We’re doing a consumer research piece on Canadians’ use of smart card chips and applications such as EMV … and we’re finalizing a book on the payment landscape which takes into account the complexity of introducing EMV.”
“In Canada today and as the U.S. studies this move, there is a need for strategic visionary planning at the executive level. It’s not just a technology upgrade,” said Ms. Johnston.
‘Fraud migration’ drives the Canadian move to EMV
The major force behind EMV in Canada has been the Interac Association, the country’s national ABM (automated banking machine) and POS debit sale network. Fraud prevention is reason for the revamping of Canada’s financial infrastructure.
“We have seen in Canada the past few years increases in debit card fraud; skimming; etc.,” said Kirkland Morris, assistant vice president, strategic policy and programs for Interac. “Our decision to commit to EMV migration is in providing for long-term security. EMV reflects the best long term solution to skimming fraud.”
He added: “We do see ourselves in Canada joining a global EMV migration that’s gaining momentum. The risk of international fraud migration is real. We took quite seriously the risk that the fraud could migrate to North America and Canada in particular. (It is) a decision that affects both issuers and acquirers; everybody has something to gain from that migration, and to capitalize on new product innovation.”
“It boils down to a conversation about what’s happening in our market,” explained William Giles, vice president, emerging technology for MasterCard International’s Chip Center of Excellence in Toronto. “Some issuers make a business case based on fraud or government mandates, like Malaysia, some on the telecom costs. In Canada, it’s based on fraud migration. Fraud migrates from region to region and brand to brand.”
“We’ve been working pretty hard for more than 18 months laying the technical groundwork, the technical specifications,” said Mr. Morris of Interac. “EMV provides a fairly broad menu of choices as to how you’ll use certain functions. We’ve been completing all the work we have to do as a payment network, implementing rules, upgrading equipment; laying the groundwork. We’re now looking to our members on both the implementation and acquiring sides to move forward.”
First Canadian trial scheduled for later this year
While EMV cards are already in use, the first major trial of the technology won’t take place until later this year in the Kitchener/Waterloo area about 90 minutes west of Toronto.
A multilateral task force created by the issuers, the major acquiring processors and the associations, has been created to, among other things, “coordinate the activities of the (Kitchener-Waterloo) launch,” said Philip Andreae, a former Europay employee who runs a consulting firm in Canada aimed at helping companies reach EMV compliance. He said all major banks would be represented in the trial, including Royal Bank of Canada, Scotia Bank and Toronto Dominion. “They’ve done trials there before – it’s reasonably close to Toronto and there isn’t a lot of inbound and outbound human traffic.”
A seven to eight year horizon …
The 2010 deadline is by no means the culmination of the EMV effort in Canada. “We’re looking at a time line that spans seven to eight years,” said Mr. Morris.
After Dec. 31, 2012, “Interac will no longer be able to transact business” at ABM machines unless it’s through an EMV card, he explains. “After Dec. 31, 2015, (this moratorium) will take effect for POS sales. These deadlines were chosen to acknowledge the substantial work required in upgrading the card payment system.”
Mr. Andreae said the Canadian EMV plan stresses backward compatibility. “The terminals will be hybrid devices (capable of reading mag stripe and chip cards).” What Canada will try to avoid is what happened in the United Kingdom during the EMV rollout.
“The store clerk (in the UK) was expecting the card to have a chip. If it didn’t, the clerk refused the card. After that became well known, training documents went out to all stores telling clerks that the whole world hasn’t gone to a chip card yet and you’ll still get regular mag stripe cards,” said Mr. Andreae. “They were able to reduce the problem but I doubt if they were able to eliminate it.”
That’s one reason, that consumer education is so important to card issuers. MasterCard has already “started to educate the public on the use of the cards,” said Mr. Giles. “The biggest change is the introduction of the PIN. But all our customers use Interac so they’re fairly accustomed to using the PIN. The U.S. market doesn’t PIN as much.”
Moving south to the United States …
While the U.S. hasn’t yet committed to an EMV product, what it has done is push contactless technology.
“There is a lot of interest in the Canadian market in contactless,” said Mr. Morris of Interac. “We’re active in exploring the contactless space (because) we see contactless technology and EMV as complementing each other over the long term. EMV really solves the security issue. When we start to look at contactless technology, you’re interested in the speed of the transaction. I think we see some different business drivers behind contactless.”
He said vendors are making available chips “that include both. It will be up to the acquirer or the merchant to decide what to deploy.” Parking, he added, is “well-suited for contactless. It’s really about finding the business drivers that would lead you to a contactless version of EMV.”
Is this how the U.S. will eventually join the rest of the EMV world?
“I really do see this (EMV) as a global phenomenon; regardless whether it’s in contactless form,” said Mr. Morris. “I do think the U.S. will be going the chip migration route at some point.”
EMV consultant Andreae says two things must happen. “Debit fraud is beginning to become an issue in the U.S. with people skimming the password and details at ATMs. The numbers aren’t big, but the rate of increase is alarming.”
Second, as equipment is replaced, the new readers are likely to be EMV-compliant which erases some of the infrastructure costs which may be holding back the U.S. market, he said.
Also, with the “deployment of PayPass (and other contactless programs), the next evolution of the (EMV) card (may have) contact and contactless using the same chip. The prices for those cards are expected to drop to the $1.50 level in the next 18 months. As contactless grows, the U.S. has the opportunity for deploying the right infrastructure over an extended period of time … As the price of (dual interface) cards comes down to the price of the contactless card, you take away the financial burden of EMV.”
He thinks that by 2012, “fraud will migrate south. If you look at 2012 when Canada reaches critical mass, that’s about the time when fraud will begin to migrate to a significant degree,” he added. “That’s when it will begin, not when it will end.”
Gemalto’s Jania sees the contactless/EMV convergence scenario as about the only way EMV will come to the U.S. “If you’re looking from a technology perspective; when will it come to the U.S., that will be determined by the amount of risk the financial institutions in the U.S. are willing to bear,” said Mr. Jania. “In North America, the contactless deployment is well underway. Contactless will lead in North America, followed by EMV. Right now it appears convenience is driving North American products and security is driving the Canadian market; do I see those markets converging? Yes.”
Regarding that convergence, he said it’s “more about how you want to use the card. EMV can be used to secure online payments. Contactless is really more for payments under $25. I can see, moving forward, a card (with both capabilities) would be very valuable.”
Others are more definitive regarding an eventual U.S. migration to EMV. Matt Landrock, managing director at Cryptomathic, a Germany-based security solution provider involved with EMV migrations in Europe, said categorically that the U.S. will switch over to EMV sooner or later. “The market internationally is quite ripe. It’s like a set of dominoes. What we’re seeing in Canada, it wouldn’t surprise me if it doesn’t spill into the U.S. since many of the providers in Canada are American companies. I’m quite confident this will begin in 2007 even if slowly.”
He said there are challenges holding EMV back. “Many banks and credit card providers have been saying they don’t want to upgrade their infrastructure right now (because) the costs are higher,” he said. There’s also the “cultural difference. Chip cards haven’t been that widely used in the states as compared to Europe. People (in Europe) are used to working with chip cards for about 10 years; whereas in the U.S. it hasn’t been a thing the consumer would think about.”
“They haven’t gone there (to EMV) yet, but the operative word is ‘yet,’ ” said Ms. Johnston of ACT Canada. “It’s inevitable they’ll go for two reasons: The richness of the opportunity exists equally for American stakeholders, so you’ll want to play in that arena. Second, fraud will play a factor in two ways. Companies that have converted will ultimately want to eliminate mag stripes from their cards; so pressure will be brought to bear in terms of higher fees where mag stripes still exist and, additionally, fraud will continue to migrate to those countries which haven’t gone to chip. Consumers will start to ask for it and bring pressure on issuers.”
Real-time authorization works against EMV in the U.S.
But, and it’s a big ‘but,’ even though it appears that convenience seems to trump security in the U.S., there is another more overarching reason that the U.S. may be dragging its EMV heels.
As Visa’s Brian Triplett explained it, the U.S. is ahead of many other countries in “real time authorization” of credit card transactions. “We can provide in-flight real time analysis of each and every authorization of a transaction. Telecommunications capabilities (in other countries) aren’t the same as in the U.S. Not all regions can support this type of real time authentication, so they were pushed to authenticating it at the terminal. That’s fundamentally why some regions were pushing hard for EMV chips.”
Patrick Gautier, senior vice president of New Product Development at Visa USA, emphasized this point in a prior interview with SecureIDNews: “The traditional driver (for EMV implementation) is fraud and the U.S. doesn’t have a fraud problem. So the reason to go to chip here are different and centered around differentiation and value add services. Fraud in the U.S. is just 5 cents per $100 spent. That is a historic low at a time when usage is expanding. The reason is that we have great authorization systems that make use of information and customer data to combat fraud.”
In the same interview, he reiterated what Mr. Triplett said: “The U.S. telecom infrastructure is cost-effective and expansive to the point that over 99.5% of transactions are authorized. And it is only getting better. With DSL at the point of sale … we have achieved round-trip authorization times of 1.4 seconds in the United States.”
But while fraud levels in the U.S. may be acceptable today, an EMV-protected world could leave the country as an unprotected island.
Fraud migration is real, not just anecdotal, said Dr. Toni Merschen, head of MasterCard International’s Chip Center of Excellence in Waterloo, Belgium. “Malaysia, migrated to EMV in a very short period of time because fraud was going through the roof. It proved that EMV works because fraud was reduced by more than 90%. However, neighboring countries like Thailand and Indonesia took the hits. We’re seeing increased (fraud) activity there. So, fraud migration is real. We’ve seen it in other regions.”
While he can’t say when, or if, the U.S. will become EMV-compliant, he does see fraud migrating there from other regions, “When the rest of the world has migrated to EMV.”
Right now, real time online credit card authorizations are keeping fraud low in the U.S. But, he added, crooks are becoming more savvy in their use of stolen cards. Banks can usually shut down a card once it detects supposedly fraudulent transactions after the card is used two or three times. But of late, it appears that “stolen or compromised cards are being used just once. They (the crooks) make a big enough hit one time, then walk away,” he said.
Another scenario, explained Dr. Merschen, is that a bank’s high-end users are usually the ones who frequently travel abroad. If they start experiencing problems with their mag stripe cards being accepted overseas, as happened in the U.K. case, a bank may decide to issue chip cards to those customers.
Could contactless be the driver for EMV in the U.S.?
Another EMV-foot-in-the-door scenario is possible now with a convergence between contactless and EMV. But any change to the U.S. payment infrastructure takes time due the sheer mass of cards and terminals.
“The U.S. has about1 billion payment cards in circulation,” said Mr. Gautier. “5.6 million merchants accept Visa payments and over 13 million POS terminals are deployed. Compare this to the U.K. which has just 70 million cards in market and took over 10 years to make the transition to EMV.”
“We see the EMV chip and other chip programs like contactless and NFC (near field communication) to have interoperability,” said Mr. Triplett of Visa. “We’re working on that right now. When we first launched contactless, we did it for local programs for small dollar transactions. Given the success and adoption of contactless, even in markets that have implemented EMV, we have adopted a global standard for contactless and EMV cards. At that level, we’re taking both the speed and convenience to the next generation level of performance and security. By doing that, we’re not going to the lowest common denominator (which is, everything working from the same basic infrastructure).”
Will there be an EMV card in the U.S.? “I can’t answer that, but the contactless chip will be EMV-compliant,” said Mr. Triplett.
Contactless/EMV convergence is a reality today, Dr. Merschen agreed. “We’ve developed an EMV- based contactless card in Europe for PayPass and this is something that could make its way into the U.S.”
Unlike in the U.S., where the card is online authorized, “the authorization is taken over by the chip in an offline mode. That opens up offline scenarios like parking meters and vending stations in a more secure way. These cards are interoperable so the U.S. PayPass card will work in the contactless (mode),” said Dr. Merschen.
“There is still a cost associated with migrating a huge market like the U.S. But if you look at the trend on the cost side, it’s going the right way. Card costs have come down dramatically and (some) readers installed in the U.S. already have the chip reading hardware integrated,” said Dr. Merschen.
“A couple years ago, (banks and acquirers) didn’t know how to spell chip or EMV. But they’ve had to implement EMV now. They had to support chips in Europe and Asia specifically. Even if it is not on the same system platform, they have the knowledge and experience to do it,” he added.
As to a full-fledged EMV implementation in the U.S., Dr. Merschen said it is strictly “a business decision to be made by U.S. banks. They’re not sleeping. They’re looking at all the various aspects and will make a decision when they feel it’s time.”
Added Ms. Johnston, ACT Canada: “Sometimes, it (EMV migration) is very straight forward. For others it can be very complex. But it offers rich opportunities for stakeholders if they understand their options.”
Near Field Communications News and InsightExplore more developments dealing with the implementation of Near Field Communications, a short-range wireless technology that promises to revolutionize contactless identification, payment, access, and more. Click to visit NFCNews.
