US EMV Smart Card Migration: What Cards Do …...©2013 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. U.S. EMV Smart Card Migration: What Cards

©2013 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

U.S. EMV Smart Card Migration: What

Cards Do Merchants Hold in their Hand?

Moderator: Claudia Swendseid, Federal Reserve Bank of Minneapolis

Panelists: Rue Jenkins, Costco Wholesale Corporation

Malcolm Nunes, The Home Depot

Gavin Waugh, The Wendy’s Company

October 30, 2013

©2013 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. ©2013 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

Agenda

• Introductions

• EMV Overview

• EMV Global Deployment & Impact

on Fraud

• EMV Adoption in the U.S.

• Business Case for Merchants

• Issues Facing Merchants

©2013 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 2


Who We Are – Claudia Swendseid

• Senior Vice President of the

Federal Reserve Bank of

Minneapolis

• Serves on the Bank’s

Management Committee & has

responsibility for FedACH

operations & application

development, Information

Technology, Customer Contact

Center, & the Payments

Information & Outreach Office

Federal Reserve System:

• Establishes & executes U.S.

monetary policy

• Promotes a stable financial system

• Supervises & regulates financial

institutions (FIs)

• Provides financial services to FIs &

U.S. Government

Mission in payments – To foster

integrity, efficiency, & accessibility of

U.S. payment & settlement systems

in support of financial stability &

economic growth

3


Who We Are – Rue Jenkins

• Assistant Treasurer of Costco

Wholesale Corporation

• Responsible for a wide range of

Treasury & Cash Management

activities including treasury

mgmt. & investment/borrowing

activities, bank relationships &

foreign exchange activities

• Manages global credit facilities

About Costco:

• Costco Wholesale Corporation

operates an international chain of

membership warehouses that carry

quality, brand name merchandise

• Over 600 warehouses worldwide

• $99.1 billion in revenue in 2012

• Employs over 107,000 people in

the U.S.

4


Who We Are – Malcolm Nunes

• Senior Manager of the

Financial Services

Department, the group

responsible for managing the

cost of acceptance

• Current focus is on alternative

& emerging payments

About Home Depot:

• World’s largest home improvement

retailer

— 2,200 locations in the US, Canada

& Mexico

• Home Depot corporate has annual

revenues of $70 billion

• Employs 325,000 people in the U.S.

• Home Depot U.S. processes 2

million card transactions per day;

accepts Visa, MasterCard, AMEX &

Discover credit cards plus signature

& PIN debit

• First retailer to accept PayPal at the

point of sale

5


Who We Are – Gavin Waugh • Vice President & Assistant

Treasurer for The Wendy’s

Company, operator & franchisor

of the Wendy’s® restaurant brand

• Responsible for capital markets,

Treasury operations, & tender

type card programs

• Serves on several Treasury

advisory committees including

the AFP Treasury Advisory Group

About Wendy’s:

• World’s third-largest quick-service

hamburger company

— 6,500 franchise & company restaurants

in the U.S. & 26 countries worldwide

• Wendy’s corporate has revenues of

$2.5 billion & employs 40,000 people

in the U.S.

• Wendy’s U.S. processes 300,000 card

transactions a day & accepts Visa,

MasterCard, AMEX & Discover credit

cards & signature debit (but not PIN debit)

“Upgrading the Wendy’s U.S. system to PIN pads inside our restaurants & at the drive-thru would cost more than 12 times the annual amount of post-liability shift fraud.”

6


EMV Overview

Why EMV

?

EMV Choices

What Is

EMV?

7


What Is EMV?

• EMV (Europay, MasterCard & Visa)

is a set of global proprietary

specifications for credit & debit

payment cards, point-of-sale

terminals & card transaction

processing networks based on

“smart chip” card technology

• Chip cards contain embedded

microprocessors that provide

stronger security against

counterfeit fraud in card-present

transactions – i.e., card

authentication

EMV chip cards use an embedded microprocessor for payment transactions

8


Why EMV & Why Now? • Helps reduce counterfeit card fraud by using

dynamic data to authenticate card rather than

static data as with magnetic stripe card

• Doesn’t improve protection against lost & stolen

& card-not-present fraud

• May facilitate interoperability with global card

infrastructure as EMV is adopted worldwide

• May help prevent fraud shift from countries with

EMV to U.S.

• May serve as security foundation for other types

of payment applications such as near field

communication (NFC)

9


Chip Choices Card issuers must decide which EMV smart

chip functions to implement

Card Interface

Card Authentication

Cardholder Verification

Transaction Authorization

Online

authentication

Offline

authentication

Online PIN

Offline PIN

Signature

No CVM

Online

authorization

Offline

authorization

Contact

Contactless

Dual

interface

10


EMV Global Deployment

& Impact on Fraud

11


EMV Around the World 80 Countries Use EMV Payments

12

Europe zone 1:

84.4% of cards

94.4% of terminals

Africa & the Middle East:

20.6% of cards

75.9% of terminals

Asia Pacific:

28.2% of cards

51.4% of terminals

Europe zone 2:

14.5% of cards

68.1% of terminals

Canada, Latin

America & the

Caribbean:

41.1% of cards

76.7% of terminals


Card-not-Present (CNP) Fraud after

EMV

0

100

200

300

400

2004 2005 2006 2007 2008 2009 2010 2011 2012

UK France Canada Australia (local

currency)

Sources: Financial Fraud Action UK, The Observatory for Payment Card Security, Canadian Bankers

Association, Australian Payments Clearing Association. 2012 France data is not available yet.

13


Cross-Border Fraud after EMV

14

0%

15%

30%

45%

60%

2004 2005 2006 2007 2008 2009 2010 2011 2012

UK France Australia

(% of total

fraud)

Sources: Financial Fraud Action UK, The Observatory for Payment Card Security, Australian Payments Clearing

Association. 2012 France data is not available yet.

14


Fraud Rates after EMV

0

3

6

9

12

2006 2007 2008 2009 2010 2011 2012

UK France Canada (Interac Only) Australia

(basis

points)

Sources: Financial Fraud Action UK, The Observatory for Payment Card Security, Interac, Australian Payments Clearing

Association

Results vary by market

15


Global Card Fraud Up 14.6% in 2012

• Acquirers, issuers & merchants lost $11.27 billion worldwide due to card fraud in 2012

– Issuers averaged fraud losses of 6.13 cents per $100 spent

– U.S. based counterfeiting crime accounted for over ¼ of global losses

– U.S. led world in CNP fraud losses; as U.S. is largest e-commerce market

USA, 47.3%

Rest of World, 52.7%

Distribution of Card Fraud Losses

US accounts for nearly half (47.3%) of

world’s total card fraud losses, but only

23.5% of total card transactions

Source: Nilson Report cited in Business Wire press

release, 8/13/2013

16


EMV Adoption

in the U.S.

17



U.S. Card EMV Smart Chip Migration

Roadmap Key Dates October

2012 April 2013 October

2013 April 2015 October 2015 October

2016 October 2017

Visa PCI audit relief

Acquirers & processors required to support merchant acceptance of EMV transactions

3rd party ATM acquirer processors & sub-processors required to support EMV data

Card-present counterfeit liability takes effect excluding automated fuel dispensers (AFD)

ATM liability shift

Card-present counterfeit liability takes effect for automated fuel dispensers

MasterCard Account Data Compromise (ADC) relief (50%)

ADC relief (95% - 100%)

ATM liability shift

Lost or stolen liability shift for AFD

Lost or stolen liability shift

Discover

PCI audit relief

American Express

18


EMV Migration Forum

• Consortium of stakeholders working together to facilitate the U.S. migration

– Card brands, ATM networks, debit networks, issuers, merchants, acquirers, processors, equipment & card manufacturers, consultants, & others; about 220 in total

– Members pay fees to Smart Card Alliance

– Entire group meets about every 3 months

19


EMV Forum Working Committees

• Debit

• Testing & Certification

• ATM

• Card-Not-Present

• Communication & Education

• EMV Deployment Coordination

– Orlando, FL chosen as test city

20


Issuers Slow to Issue EMV Debit Cards

When Do You Plan to

Issue EMV Debit Cards?

50%

8%

38%

2% 2%

0%

20%

40%

60%

80%

100%

Already have issued

Plan to issue in 2013



No plans

Reasons for Waiting

• Uncertainty about merchant

acceptance & changes in

liability shift dates

• Inadequate business case

• Unresolved issues related to

compliance—e.g., how to

migrate to EMV & meet Reg II

merchant routing choice

requirements

Source: 2013 Pulse Debit Issuer Study

21


Business Case for

Merchants

22


Is There a Positive Cost/Benefit Proposition for EMV Acceptance by Merchants?

Acceptance: Pros

• Reduces counterfeit fraud in card-present transactions

• Avoids assuming liability shift

• Reduces PCI reporting cost

• May help protect against fraud loss shifts to U.S. from countries adopting EMV

• Supports more standard card payment methods across countries

• Ability to accept EMV cards from international travelers

Acceptance: Cons • New investments in equipment,

software, & infrastructure

• Protection still needed for card lost or stolen fraud & card-not-present fraud

• CNP fraud may increase due to shift from card present

• Check out may take longer; cards may be forgotten more often

• Complexity of supporting different card brand roadmaps

• May not integrate readily with mobile payment acceptance

23


Biz Case for Individual Merchants

Depends on Fraud Liability Costs

• In October 2015, fraud liability for card-present

disputed transactions will shift to the party

that is not EMV-enabled

• The big question is: how much could fraud

potentially cost merchants?

– Merchants may find it challenging to quantify

the impact of this liability

24


Are U.S. Card Fraud Losses Big

Enough to Justify EMV? Payment cards represent a disproportionate amount of fraud

50% ACH

45% Checks

2% Credit

2% Sig.

Debit

1% PIN

Debit

30% Credit

25% ACH

23% Checks

21% Sig.

Debit

2% PIN

Debit

$ Volume by Non-Cash Payment Type -

2010 FI’s Fraud Losses by Payment Type -

2010

Sources: NACHA, Federal Reserve 2010 Payments Study, PaymentsSource Bankcard Profitability Study, The

Nilson Report, Pulse Debit Issuer Study

25


PIN Debit Fraud is 8X Lower than

Signature in U.S.

$0.000

$0.005

$0.010

$0.015

$0.020

$0.025

$0.030

$0.035

Signature Debit PIN Debit Net fraud loss rates -- $ per transaction 2006 2007 2008 2009 2010 2011 2012

Source: Pulse Debit Issuer Studies

8.1

5.4

7.5 7.5

5.2 5.4

4.7

0.6 1.1

0.8 1.0 1.3

1.0 0.7

Basis points shown in white:

e.g., in 2012, average fraud

loss rate was 5.4 bps, or 5.4

cents per $100 of card spend

on signature debit transactions

Issuers net fraud loss rates fell by about 30% for both signature & PIN debit in 2012

26


Issues Facing Merchants

27


Debit Interchange Rules Struck Down

28

Date Action

July 31 District court struck down Reg II

August 21 Federal Reserve filed an appeal

September 19 Appeals court approved request for

expedited action on appeal

— Briefings to appeals court due by

end of 2013

September 20

District court stayed decision to allow

existing rules to remain in place during

appeal


Debit Routing Issues

• Reg II requires that debit cards offer merchants a choice of at least two unaffiliated networks on which to route transactions

• Merchants want continued ability to route all transactions at a switch level for maximum reliability & negotiation flexibility; merchants do not want to support multiple applications on a debit card

• Even when Reg II issues resolved, industry needs time to agree on routing technology

29


What about the Dynamic Mobile

Payments Environment?

30

Mobile NFC Payments P2P Payments

Mobile Card Reader

Mobile QR Code Payments

Mobile Wallets


Integration with Mobile Payments

• Near Field Communication (NFC)

technology can support payments

(mobile, contactless cards) by

enabling data exchange between

devices in close proximity, e.g.,

mobile phone & POS terminal/reader

— EMV can facilitate NFC-based mobile

payments by offering a network to accept &

process chip transactions, but:

1. Will NFC be the primary mobile payment

enabling technology?

2. Does EMV technology offer the best security

foundation to protect against fraud?

31


Authentication & Verification

• Merchants want issuers to allow both

online & offline authentication: offline is

especially needed for small-value,

repetitive transactions (e.g., transit)

• Merchants want issuers to opt for chip

cards that use PIN verification, not

signature

– PIN debit fraud rates are 8X lower than

signature debit

32


Customer Service at the Point of Sale

• Merchants want minimal changes & processing requirements at terminal level, with same or better transaction speed & reliability/uptime as magnetic stripe cards

• Speed of checkout: don’t create delays at the POS by requiring customers to make additional decisions

• Concerns about customers learning to use chip cards: e.g., use of PIN on both credit & debit transactions, cards left behind in terminal, etc.

— Will need to train staff & customers

33


Card-Not-Present Fraud Mitigation • Online fraud cost merchants $3.5B in 2012

• Merchants &/or issuers can take steps to

authenticate & validate online transactions

– Collect all card account information including

card verification number

– Use address verification service

– Use one-time password

– Enroll in payer authentication services, e.g. 3D Secure®

– Enable consumers to authenticate online transactions

with a bank-issued PIN, e.g. Acculynk’s PaySecure®

– Use IP geolocation technology to verify customer’s

location with account billing or shipping address

– Use anomaly detection software to flag suspect

transactions

Source: CyberSource Online Fraud Report, 2013

34


Other Concerns of Merchants

• Card brands must address unique needs of specific industry segments, e.g., quick service restaurants & fuel

• Want simplified certification process which reduces redundancy in testing

– Facing resource constraints when testing point of sale equipment: expect testing queue bottlenecks due to volume of activity to meet roadmap deadlines

– Want ability to remotely inject future updates for software

35


Summary

To decide on the right strategy & timeframe, merchants should:

1. Assess relevant benefits & costs to decide whether to accept EMV cards & when

2. Determine impact on business operations & customer service

3. Monitor status of open issues

—Debit routing costs & options

—Interrelationship with mobile payments

—Fed’s appeal of July 31 ruling

36


Q & A Session

U.S. EMV Smart

Card Migration:

What Cards Do

Merchants Hold

in their Hand?

37


Resources • EMV in the U.S.: Putting it into Perspective for Merchants and Financial Institutions, by FirstData

http://www.firstdata.com/en_us/insights/EMV_WP.html

• EMV for U.S. Acquirers: Seven Guiding Principles of EMV Readiness, by MasterCard Advisors www.mastercardadvisors.com/_assets/pdf/emv_us_aquirers.pdf

• Post Durbin & Pre-EMV: Payment Acceptance Trends Evolving for Retailers, by Association for Financial Professionals http://www.afponline.org/pub/pdf/Retail_PostDurbinandPre-EMV.pdf

• The Efficiency & Integrity of Payment Card Systems, FRB Philadelphia Discussion Paper, http://www.philadelphiafed.org

• U.S. EMV Roadmap Announcements ― Visa http://corporate.visa.com/newsroom/press-releases/press1142.jsp

― MasterCard http://www.mastercard.us/mchip-emv.html

― Discover http://discovernetworknews.com/stories/discover-implements-emv-mandate-for-u-s-canada-and-mexico/

― American Express http://about.americanexpress.com/news/pr/2012/emv_roadmap.aspx

• Card Payments Roadmap in the U.S.: How Will EMV Impact the Future Payments Infrastructure? by Smart Card Alliance http://www.smartcardalliance.org/resources/pdf/Payments_Roadmap_in_the_US_020111.pdf

• Contactless Mobile Payment, by EMVCo http://www.emvco.com

• Managing the Migration to EMV & NFC Payment Technology, by Frost & Sullivan http://www.frost.com

• The Migration to EMV Chip Technology, by Gemalto http://pymnts.com/assets/Shared/Gemalto-EMV-Whitepaper.pdf

• FRB Atlanta Blogs on EMV http://portalsandrails.frbatlanta.org/

• EMV Migration Forum public educational website http://emv-connection.com/

38




http://www.mastercardadvisors.com/_assets/pdf/emv_us_aquirers.pdf



http://www.afponline.org/pub/pdf/Retail_PostDurbinandPre-EMV.pdf




http://www.philadelphiafed.org/



http://corporate.visa.com/newsroom/press-releases/press1142.jsp




http://www.mastercard.us/mchip-emv.html




http://discovernetworknews.com/stories/discover-implements-emv-mandate-for-u-s-canada-and-mexico/




















http://about.americanexpress.com/news/pr/2012/emv_roadmap.aspx

http://about.americanexpress.com/news/pr/2012/emv_roadmap.aspx

http://www.smartcardalliance.org/resources/pdf/Payments_Roadmap_in_the_US_020111.pdf



http://www.emvco.com/

http://www.emvco.com/

http://www.frost.com/

http://www.frost.com/

http://pymnts.com/assets/Shared/Gemalto-EMV-Whitepaper.pdf







http://portalsandrails.frbatlanta.org/

http://portalsandrails.frbatlanta.org/

http://emv-connection.com/




Contact Information Claudia Swendseid

Senior Vice President

Federal Reserve Bank of Minneapolis

[email protected]

Rue Jenkins

Assistant Treasurer

Costco Wholesale Corporation

[email protected]

Malcolm Nunes

Senior Manager of Financial

Services

The Home Depot

[email protected]

Gavin Waugh

Vice President & Assistant

Treasurer

The Wendy’s Company

[email protected]

39

mailto:[email protected]





APPENDIX


Interest in Open, Consensus

Integrated Chip Standards • EMVco’s proprietary standards are privately developed &

controlled by a limited number of participants with vested interest in outcomes

• In contrast, open, consensus standards are developed in a public forum by interested parties working with standards development organizations certified by a quasi-government body; adoption of such standards is voluntary – e.g., X9, X12, & ISO 20022 develop open, consensus standards

• On December 9 & 10, 2013, an integrated chip standards industry meeting will be held in Philadelphia – Sponsored by X9 & the Federal Reserve Bank of Minneapolis

– Invitation-only event for diverse stakeholders who will explore need for open, consensus standards for smart chip payments in U.S.

41


EMV Primer: Terminology • Cardholder verification methods (CVM) exist to answer the question “Is this card

in the right hands?”

– The object is to protect against lost & stolen card fraud

• Card authentication answers the question, “Is the card genuine?”

– The object is to prevent losses from counterfeit fraud

• Online verification & authentication methods are performed by the issuer or

issuer processor

— In the online PIN verification process, the POS terminal electronically

communicates with the issuer & verifies that the PIN is correct, thus

authenticating the cardholder

• Offline methods are performed by the card & terminal; they don’t require a

connection to the issuer or issuer processor

– In the offline PIN verification process, the PIN is validated by comparing the

given PIN to the PIN that is stored securely on the card

• A risk management aspect of EMV implementation that merchants have to

address is to decide whether to authorize the transaction offline or send an online

authorization request to the issuer

42


Canada & Credit Card Fraud

• Credit card-present fraud

losses from counterfeit &

lost or stolen declined

41% between 2008 & 2012,

but losses from card-not-

present fraud more than

doubled over the same

period. In aggregate, credit

card fraud increased by

$39.9M CAD

128.4 140.4 176.1

259.5 268.6

245.4 199.6 171.5

152.6 145.1

2008 2009 2010 2011 2012

Card-not-present

Counterfeit & lost or stolen card

Fraud Losses on Canadian-Issued

Credit Cards (million CAD)

Source: Canadian Bankers Association

43


• Conversion to EMV chip cards was mainly complete by year-end 2012

• With EMV chip/PIN processing, Canada’s Interac debit card system cut

card-present fraud losses by 73% between 2009 & 2012 ― to a record low

Canada & Debit Card Fraud

10

4.5

14

2.3

11

9.0

70

.0

38

.5

6.2

8.3

6.8

3.8

2.0

0

2

4

6

8

10

0

30

60

90

120

150

2008 2009 2010 2011 2012

Fraud Losses Fraud Rate (million

CAD)

Source: Interac

(basis

points)

44

44


UK Counterfeit Fraud after EMV

12

9.7

96

.8

42

.1

45

.8

31

.0

36

.2

24

.5

16

.8

15

.6

52

.8

11

3.3

13

3.6

56

.4

30

.8

20

.5

0

30

60

90

120

150

180

2004 2005 2006 2007 2008 2009 2010 2011 2012 Total Domestic Cross-Border

(million

Pounds)

98.6

144.3

169.8

80.9

47.6 36.1

Source: Financial Fraud Action UK

45

45

Fraud data includes debit & credit cards; EMV chip

migration was nearly complete by year-end 2006


France Domestic Card Present

Fraud after EMV 6

3.5

59

.2

59

.1

45

.4

44

.5

41

.0

36

.2

48

.1

2.900

2.500 2.400

1.700 1.500 1.400

1.200 1.500

0

1

2

3

4

5

0

15

30

45

60

75

2004 2005 2006 2007 2008 2009 2010 2011

Fraud Losses Fraud Rate (million

Euros)

Source: The Observatory for Payment Card Security. 2012 France data is not available yet.

(basis

points)

46

46

Fraud data includes debit & credit cards; EMV chip

migration was nearly complete by year-end 2006


47

Australia Domestic Card Present

Fraud after EMV

59

.1

62

.8

67

.6 7

8.1

66

.0

58

.6 6

9.9

0

20

40

60

80

2006 2007 2008 2009 2010 2011 2012 Fraud Losses

(mill

ion

$A

UD

)

Source: Australian Payments Clearing Association

47

Fraud data includes debit & credit cards;

EMV chip migration began in 2008

Documents

US EMV Smart Card Migration: What Cards Do …...©2013 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. U.S. EMV Smart Card Migration: What Cards