SURVEY OF CARD PRODUCTS & CLEARING...Global standard for chip-based debit and credit card transactions Over the last decade, fraud #’s have increased significantly in the U.S. Europe

The Payments InstituteJuly 21-24, 2019 • Emory University, Atlanta GA

SURVEY OF CARD PRODUCTS & CLEARING

Jennifer Stadler, CPPVice President Marketing, Strategy &

Communications

Disclaimer

This material is derived from collaborative work product

developed by PaymentsFirst ─ a member of the Regional

Payments Associations.

This material is not intended to provide any warranties or legal

advice, and is intended for educational purposes only. The

information in this document and discussed during this

presentation is the exclusive property of PaymentsFirst. It may

not be copied, disclosed, or distributed, in whole, or part, without

the express, written permission of PaymentsFirst.

Agenda

• Card Payments Ecosystem

• EMV

• Zero Liabilities/Error Resolution

• Managing Disputes/Fallback Transactions

Card Payments Ecosystem

• Barter System exchange

• Cash Pooling (bank accounts and deposits)

• Cashless payments credit cards, checks, e-wallets

• Goods to Grain

• Metal Coins to Paper

• Bank Accounts to e-wallets

• Money’s various forms


• Rapid pace, new providers, new platforms, new payment tools daily

• Buying in a store, online or mobile device, the shift of consumer behavior drives retailers to adapt toward fast, simple & secure mobile payments.


Evolve….Adapt….Transform• Technology

• Regulatory Oversight

Consumers Define Market• When, where, how they bank

and pay for goods and services

Online - Expectations• Customer Data Analytics

• Customize Experiences

• Retail Banking High Demand

Merchant’s Bank Customer

Merchant Bank’sProcessor

Credit Card Network

Issuing Bank

THE

CREDIT CARD PAYMENT

PROCESS

Merchant’s Business

InternetWeb Payment

Software9

Standard Terminology

Copyright 2019 PaymentsFirst. All Rights Reserved. This Presentation is for education purposes only and current to date.

Merchant GatewayRisk

Management Processing

AcquiringCredit Card

Assoc’s/NetworkIssuer Consumer


Governing body of Financial Institutions (Merchant Acquiring Bank)

ISO’s & MSP’s, working together to support credit card processing. Interchange fees, qualification guidelines, improvements to network and brands, arbiter between Visa and MC.

Non Financial InstitutionDo Not Issue CardsDo Not Issue Merchant Accts.Clearing house for respective card brand.


Determine how cards may be usedUnderwriting, Risk Management, Customer Service, Technical Support done internallyDetermine rates, fees, processing rules for respective card brand

Financial InstitutionIssue CardsIssue Merchant Accts.

Card Payments EcosystemVisaMastercardThe Federal Trade Commission (FTC)The Consumer Financial Protection Bureau (CFPB)The United States Federal Communication Commission (FCC)The Office of Comptroller of the Currency (OCC)The Federal Deposit Insurance Corporate (FDIC)The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)The Internal Revenue Service (IRS)The United States Department of TreasuryThe Office of Foreign Asset Control (OFAC)The Financial Crimes Enforcement Network (FinCEN)


CARD BRAND 2014

Visa 43.6%

MasterCard 24.9%

American Express 26.6%

Diners 4.9%

CARD BRAND 2017 Credit 2017 Credit Debit

Visa 53% 60%

MasterCard 22% 25%

American Express 21% 13%

Diners 4% 2%

2018 Nilson Report


Credit Card

Standard Credit Card

Secured Credit Card

Reward Credit Card

Charge Credit Card

Specialty Credit Card

Prepaid Credit Card


• MCC (Merchant Category Code)• Retail• Supermarket• Restaurants• Hotel/Lodging• Rental• Automated Fueling• Direct Marketing• Electronic Commerce


• Open Loop Visa and MasterCard• Closed Loop American Express and Discover• Consumer Credit Protection Act• The Fair Credit Billing Act• Electronic Funds Transfer Act• The Patriot Act• The Card Act of 2009• Card Association Operating Rules• Card Network Rules

Card Payments Ecosystem• Signature Debit Transaction: • PIN Debit Transaction:• Merchant fees • ACCEL, AFFN, Interlink, Maestro, JEANIE, NYCE, Pulse,

Shazam, Star are all debit card networks• Standard Debit Cards: Draw funds directly from cardholders

bank account• Electronic Benefits Transfer (EBT): Issued by the state and

federal agencies allowing qualified users benefits to make purchases

• Prepaid Debit Cards: Access to bank account to make electronic purchases up to a certain amount which is pre-loaded on a card


• Cardholders may authorize debit card purchases using either PIN or signature

• Transactions are authorized with PIN process on PIN debit network

• Transactions authorized through signature are processed on credit card network

• Running debit card as a ”credit”, means run on credit card network

• Subject to debit card rules, not credit card rules (credit card regulations often list exclusions for debit cards)

• Minimum charges are not allowed for debit card purchases (commonly mistaken for minimum charge restrictions credit cards have)


• A business cannot permit surcharging for debit card transactions, even through 41 states allow it for credit cards. A debit card ran as “credit” is not an exception to this rule, only credit cards have this ability under certain conditions

• Subject to interchange or PIN debit network fees

• Cheapest authorization method varies on a couple of factors, such as transaction size, and: Regulated: debit cards issued

by FI with $10 billion or more in assets; capped cost similar for PIN and signature

Unregulated: debit cards issued by FI less than $10 billion in assets; PIN debit transactions are least

expensive for larger amounts, signature debit transactions are least for smaller amounts


• Deposit Account – No credit approval• Global Acceptance ATM• Daily ATM & POS limits apply• Regulation E• Electronic Funds Transfer Act• Regulation II Durbin Amendment• The Card Act of 2009• Card Association Operating Rules

VISA, MasterCard, STAR, CO-OP, Plus, Cirrus, NYCE, AFFN, etc

• Patriot Act

EMVEuropay, MasterCard & Visa

Embedded Microchip

Microprocessor chip turns the card into a smart card enabingcommunication of secure data

Embedded Antenna

Antenna connects embedded microchip, communicates secure EMV transaction data to point of sale terminal

Global standard for chip-based debit and credit card transactionsOver the last decade, fraud #’s have increased significantly in the U.S.

Europe and Canada’s adoption of EMV decreased fraud at the POS (Point of Sale). As fraud decreased abroad, U.S. fraud increased Card

networks began pushing U.S. merchants in the U.S. to upgrade payment solutions to accept EMV chip card transactions.

EMV

• 2014 U.S. fraud accounts for 76% of breaches worldwide. Next in line was the United Kingdom (8%), Canada (4%), Australia (2%), Israel (1%) and China (1%).

• According to Barclays 2015 research: U.S. responsible for 47& of world’s card fraud despite only 24% of total worldwide card volume.

• 2014 Cross-Border transactions • U.S. credit card fraud rises 31.8 million up 3 times

from the previous year

EMV

Visa MasterCard American Express Discover

October 2015 Party that is cause of contact chip not occurring are financially liable for any resulting card present counterfeit losses. Doesn’t include AFD.

MC Account Data Compromise (ADC) relief takes effect 100%. On this date if at least 95% of MC transactions originate from EMV POS terminals the merchant is relieved 100% of account data compromise penalties.

Will include fraud liability shift (FLS) policy that will transfer liability for certain types of transactions away from the party that has most secure form of EMV technology.

Will include FLS (U.S. Canada & Mexico). This FLS policy will be risk based payments hierarchy that benefits the entity that leverages the highest level of available payments security.

October 2020 Deadline for AFD to comply.

MC liability hierarchy takes effect fuel dispensers.

FLS takes effect for transaction generated from FD.

FLS takes effect for transactions generated from AFD.

October 2017 Liability Shift in U.S. for ATMs

October 2016 Liability Shift in U.S. for ATMs

EMV

Chip & Pin Chip & Signature

Token/Cryptogram

Dynamic/Static

EMV

Can a card be both chip and signature and chip and pin?

Yes

Most credit cards are signature priority few are pin preferredTarget RedCard and Diners Club Cards

EMV

• Liability for card fraud falls upon the least EMV compliant party

• Prior to October 1, 2015 Issuer liability

EMV POS Counterfeit Fraud Liability

Chip Capability- Card Chip Capability- POS Counterfeit Liability

Magnetic Terminal Not Contact Chip Enabled

Issuer

Magnetic Contact Chip Enabled Issuer

Chip Card Contact Chip Enabled Issuer

Counterfeit Mag Stripe with data copied from chip card

Terminal Not Enabled for ContactChip

Acquiring BankMerchant


Contact Chip Enabled Issuer

EMV ATM Counterfeit Fraud Liability



Issuer





ATM Acquirer



Lost or Stolen Fraud Card Present Contact Transactions: Amex, Disc & MC


Magnetic Any terminal type Issuer

Chip card, PIN-preferringCVM (online or offline)

Terminal not Enabled for Contact Chip

Acquiring Bank/Merchant

Chip Card, signature preferred Terminal Not Enabled for Contact

Issuer

Chip card, signature-preferred Contact Chip Enabled SignatureNo Pin Capability

Issuer

Chip Card, PIN preferred Contact Chip Enabled SignatureNo Pin Capability

Acquiring Bank/Merchant

EMV AFD Counterfeit FraudChip Capability- Card Chip Capability- POS Counterfeit Liability


Issuer





Accel, AFFN, CU24, Discover, MC, NYCE, Pulse, Shazam Star, Visa(before October 1, 2020American Express (before October 16, 2020)



Visa Zero Liability

Visa liability policy is a guarantee that cardholder will not be held responsible for fraudulent charges made by Visa card or account info.

Limitations Include

Applies: only to cards issued in US

Excludes: ATM transactions, PIN based transactions, Commercial Visa and transactions not processed by Visa, Anonymous Prepaid Card Transactions

MasterCard Zero Liability

MasterCard does not hold cardholders responsible for “unauthorized transactions made in store, over telephone or online, including ATM and PIN based transactions.Liability Limitations Account must be in good standingExercising reasonable care in safeguarding card from theftPromptly report loss or theft Does not include commercial cards, or unregistered prepaid cards/gift cards

Error ResolutionRegulations• Dodd-Frank Wall Street Reform and Consumer

Protection Act: 2010, Requires the Federal Reserve Board was required to develop a set of rules on debit card interchange fees and network routing restrictions by card networks and financial institutions

• Regulation II: October 1, 2010 1. Provision capped interchange fees 2. Prohibited “network exclusivity” arrangements between financial institutions and networks and 3. Gave more control to merchant over routing debit card transactions

• Fair Credit Billing Act: Implemented by Regulation Z, the law limits liability on stolen cards to $50 and if the loss is reported before card is used, you’re not responsible for charges

• Card Associations: make modifications to rules and processes twice a year

Error Resolution

Regulation Z (Truth in Lending Act)• Under 12 C.F.R.S1026.13(a): Issuers must investigate and

resolve certain billing errors• The appearance on a periodic statement of a purchase when

the consumer refused to take delivery of the goods because the goods did not comply with the contract;

• Delivery of property or services different from that agreed upon;

• Delivery of the wrong quantity; • Late delivery; or• Delivery to the wrong location• The error does NOT apply to dispute relating to quality of

goods and or services where consumer accepts

Error Resolution

Regulation E: Rules established by federal banking regulators carrying out Electronic Fund Transfer Act, providing consumer rights when cardholder uses banks electronic funds transfer system, used by financial institutions to generate debit card transactions. It provides the protections for cardholders using debit cards

Error Resolution

Regulation Terms

Access Device: A Card, code or other means of account access used by a consumer to initiate electronic funds transfer

Pre-Authorized Electronic Fund Transfer: An electronic fund transfer authorized in advance to recur at substantially regular intervals (authenticated by consumer)

Error ResolutionTiming of Consumer Notice to Financial Institutions

Maximum Liability

Within 2 business days of learning of loss or theft

Lesser of $50 or total amount of unauthorized transfers

More than two business days after learning of loss or theft up to 60 days after transmittal of statement showing first unauthorized transfer made with access device

Lesser of $500 or the sum of:1. $50 or the total amount of

unauthorized transfers occurring in the first 2 business days, which is less, and

2. The amount of unauthorized transfers occurring after the 2 business days and before notice to the financial institution

Error ResolutionEvent Timing of Consumer Notice to

Financial InstitutionsMaximum Liability

Loss or theft of access device

More than 60 calendar days after transmittal of statement showing first unauthorized transfer made with access device

For transfers occurring within the 60-day period, the lesser of $500 or the sum of: 1. The lesser of $50 or amount

of unauthorized transfers in the first two business days whichever is less, and

2. The amount of unauthorized transfers occurring after two business days

For transfers occurring after the 60-day period, unlimited liability (until the financial institution is notified).

Unauthorized transfer (s) not involving the loss or theft of an access device

Within 60 calendar days after transmittalof the periodic statement on which the unauthorized transfer first appears

No liability

Error Resolution

DO NOT

Share

your PIN #

DEBIT

Family member given access to use debit card and misuses or abuses account, if given the PIN #, transaction is not considered unauthorized use.

Error Resolution

Visa states provisional credit within 5 business days of notification, but FI may withhold provisional credit to extend allowed under applicable law

• Prepaid cards

• Debit cards (consumer and commercial)

• Credit Cards (consumer and commercial)

Mastercard provides no suggested guideline, therefore Mastercard issuers should follow Reg E and other applicable Regs

Error Resolution

Chargeback Rights Do Not Apply

• Violation of card brand regulations occurred.

• Violation not covered by chargeback rights.

• Member experienced financial loss because of violation.

Error Resolution

• MasterCard, Visa, American Express and Discover are eliminating the need to sign receipts for credit and debit sales April 14th

• Merchants in U.S. decide whether or not to require signatures

• Visa requires merchants to either have EMV chip or contactless chip-enabled readers to opt out of signatures

• Fraud capabilities have enhanced greatly• Checkout process more streamlined• Multi-factor authentication is not accomplished with

signatures

Managing Disputes Fallback Transactions

• ”Dipping” your card, rather than sliding card through card reader.

– Card Reader is unable to readcard when inserted, after second attempt, card falls back to swiped for authorization.

Managing DisputesFallback Transactions

• In-store fallback transactions (excluding manual key entry)

Appropriate indicators identifying fallback

Issuer bears liability if approved

AFD fallback transaction

Appropriate indicators identifying fallback

Issuer bears liability if approved

Except for lost-stolen Visa transactions

• Manual Key Entry: Merchant is liable for fraudulent transaction


Enable better fallback monitoring Turn off Fallback Capability/Decline except in

urgent cases ATM’s must improve software and terminal

configurations Block all magnetic fallback transactions on ATM Non-Member/Non-Customer block all magnetic

fallback authorizations Block all Key-Entered fallback authorizations

across all devices and cards


Adopt EMV on 100% debit cards, credit cards, in branch POS and ATM’s

Once 100% EMV issued cards, block fallback magnetic transactions

Block Fallback Transactions outside of state footprint

Block Fallback Transactions at the pump

Block Fallback Transactions in excess of $ amount


Visa Claims Resolution : A Global Solution

• Merchant response 30 days

• Certain Chargebacks Rejected

• Two Workflows for all Chargebacks

• 22 Reason Codes into 4 dispute categories

• Issuer response 120 days

• Merchant ONLY fraud and authorization with Compelling evidence


Old Term New Term

Chargeback (CB)RepresentmentCB ReversalRepresentment

DisputeDispute ResponseDispute ReversalDispute Response Reversal


Fraud Authorization Processing Errors Consumer Disputes 35 CNP Transactions One Account Workflow stops invalid CB responses from

Merchants Shorter timeframes for dispute resolution Simplified dispute process due to fewer clearer

reason codes


• High Risk Current Standard = 1,000 or more disputed transactions & 2% dispute to transactions ratio

• October, ratio reduced to 1.8% through 1,000 dispute count remaining

• Visa’s Fraud Monitoring Program• Current: $75,000 or more in fraudulent transactions

per month and fraud to sales volume ration of 1%• Revision: $75,000 threshold fraud sales volume ration

0.9%• Acquiring Banks 1% transaction to sales ration reduced

to 0.75%


MasterCard Phase 1• October 12, 2018• 4831 Incorrect Transaction Amount• Point of Interaction Error• Cardholder Disputer• Cardholder Does Not Recognize

• Mastercard requires more information prior to filing chargeback, including evidence from cardholder.


MasterCard Phase 2: April 12, 2019Issuers may submit CB, even if merchant initiates a return• Merchants should not fight CB and then issue refund to

resolve problem with customer directly

• Chargeback Filing Timeframe• 120 days to 90 days when 4834 Point of Interaction

Error• No longer valid 4840 Fraudulent Processing of

Transactions• No longer valid 4863 Cardholder Does Not Recognize


MasterCard Phase 4: April 17, 2020

• 4837 Fraud

• 4853 Cardholder Disputer

• 4834 Point of Interaction Error

• Mastercard will no longer accept second chargebacks pertaining to these reason codes. They now require pre-arbitration response similar to Visa Claims Resolution.


• Merchants must provide supporting documentation such as email conversations with customers, for reason code 4863 (Cardholder Does Not Recognize)https://www.mastercard.us/content/dam/mccom/en-us/documents/rules/chargeback-guide.pdf

2020: MDRI, Mastercard plans to eliminate arbitration chargeback cycle. Pre-arbitration will need to be filed for most disputes.

https://www.mastercard.us/content/dam/mccom/en-us/documents/rules/chargeback-guide.pdf


April 12 change to Mastercard’s negative option billing process• MCC 5968 Subscription Merchant: Retailers

collecting information for start a trial, subscription services after trial, must obtain• Explicit permission prior to charging the card• Inform cardholders of total transaction amount, date of

transaction and merchant’s name on billing statements• Provide direct link to cancel service. • Trial period begins once sample is received• Customer’s requesting cancellation must receive written

confirmation subscription has been terminated


12.613.1 12.7 13.1

15.4

16.7

0

2

4

6

8

10

12

14

16

18

2012 2013 2014 2015 2016 2017

Million of U.S. Fraud Victims

Column1

Javelin Study and Research


22.1

19.3

16.415.5

16.216.8

0

5

10

15

20

25

2012 2013 2014 2015 2016 2017

Fraud Losses (U.S. billions of dollars)

Column1


1. 2017, 6.64% of consumers victims of identity fraud. Existing non-card fraud and account takeover

2. Account takeover $5.1 billion, 120% increase from 2016

3. Online shopping greatest fraud opportunity. Card not present fraud is 81% more likely than POS fraud

4. Fraudsters are more sophisticated. 1.5 million victims existing account fraud, intermediary account opened under first name. 200% greater than previous numbers 2018 Identity Fraud Study

Educate Consumers Better Protection

1. Turn on two-factor authentication; use strong passwords2. Secure devices; secure online & mobile devices with

screen locks,encrypting data stored on device , avoid public Wi-Fi, install anti-malware

3. Place security freeze: Shut down and open when necessary

4. Account alerts 100%5. Alerts for online transactions, 3-D Secure (Verified by

Visa & SecureCode)

Questions?

Jennifer Stadler, CPP

[email protected]

Vice President Marketing, Strategy & Communications

mailto:[email protected]

Documents

SURVEY OF CARD PRODUCTS & CLEARING...Global standard for chip-based debit and credit card transactions Over the last decade, fraud #’s have increased significantly in the U.S. Europe