EMV in the US: Adoption, Timelines, and Incentives from Visa and MasterCard
EMV stands for Europay, MasterCard, and Visa. EMV is the global standard for inter-operation of integrated circuit payment cards and point-of-sale terminals and ATMs.
Integrated Circuit payment cards are often referred to as "Chip Cards", and chip card capable payment systems are often called "Chip and PIN", because authentication is done via reading information from a microchip embedded in the payment card, and by the cardholder entering a Personsal Identification Number (Chip-and-PIN) into the POS terminal or signing a sales reciept (Chip-and-signature).
EMV authentication includes a cryptographic message that makes each transaction unique. This "dynamic authentication" is considered to be a more secure form of authentication than the traditional magnetic strip currently used in the United States, and has been widely adopted in Europe and elsewhere. In order to reduce the risk of fraud and identity theft, the Visa and MasterCard Card Associations have released strategies, timelines, and incentives for US merchants, issuers, and acquirers to move from magnetic strip authentication to the EMV standard by 2013.
In August 2011, Visa announced three EMV initiatives:
- Expansion to the U.S. of the Technology Innovation Program (TIP): TIP eliminates annual PCI validation requirements for merchants who have 75% of their Visa transactions originating on chip-enabled terminals. To qualify for TIP, POS terminals must be enabled to accept contact and contactless chip cards and NFC contactless payments from mobile devices.
- U.S. acquirers and processors must be able to support chip transactions with dynamic authentication no later than April 1, 2013.
- Liabilty shift for domestic and cross-border counterfeit POS transactions effective October 15, 2015. Liabilty for fraudulent transactions at merchants, that at a minimum, have not installed contact chip terminals, will shift from the card issuer to the acquirer and the merchant.
In February 2012, MasterCard released a statement on EMV:
- MasterCard will have "an immediate focus" on working with acquirers to make sure they are ready to support dynamic authentication by April 2013
- MasterCard will introduce a "liability hierarchy" in which the cost of fraud from lost or stolen cards will fall upon "whichever party adopts the less secure approach." This means merchants that install EMV terminals with chip-and-PIN capability will not be liable for lost-or-stolen fraud that occurs on EMV chip-and-signature transactions, effective October 2015.
- MasterCard will provide "true financial benefits" to merchants that install EMV terminals: relief from PCI audits, 50% reduction in data breach liability for card-reissuance and fraud costs for merchants processing at least 75% of their transactions on EMV capable terminals, and effective October 2015, 100% relief of those costs if the merchant is processing 95% of its transactions on EMV terminals.