Thursday , March 28, 2024

Canada Puts Down Chip Card Roots

 

Canada seems to have found a workable formula for rolling out EMV technology.

 

Can the U.S. learn from it?

 

By Peter Lucas

 

Payment card executives in the United States looking to follow a model for how to roll out EMV cards and terminals need look no further than Canada. Indeed, America’s neighbor to the north is in the midst of what Canadian card executives, terminal makers, and payments experts describe as an extremely smooth, on-schedule rollout.

 

That’s good news for the credit and debit card industry, because some prognosticators forecast as far back as 2007 slow going for the conversion to the chip-based cards that require the cardholder to enter a PIN, hence the nickname “chip-and-PIN.”

 

Their predictions were based largely on the anticipation of unexpected problems, such as slow merchant adoption, and the steep EMV learning curve that consumers in other regions of the world encountered—problems that in some countries delayed chip-and-PIN card systems by years.

 

Canada’s success to date can be traced to two key points: the ability of the country’s banks and transaction processors to work together to create and operate Interac, Canada’s national PIN-debit network, and lessons learned from an EMV trial in Kitchener-Waterloo, Ontario.

 

Announced in October 2007, the Kitchener-Waterloo pilot yielded important lessons about consumer and merchant education regarding EMV technology, the technology needs of merchants in the petroleum industry, and some of the hurdles large merchants faced meeting conversion timelines.

 

“One of the key successes to the EMV rollout in Canada has been how the card industry worked together to avoid duplication of efforts among the payment card brands and come up with key messages that could be brought forth to educate the public and merchants about the transition to chip-and-PIN,” says Tracey Black, president of Toronto-based payments consulting firm GFH Group Inc. “By working together, the industry was able to apply the lessons learned in the pilot to the rollout.”

 

The big networks—Visa Canada, MasterCard Canada, American Express, and Interac—chose GFH Group to oversee the Kitchener-Waterloo pilot. Black is a former Royal Bank of Canada and TD Bank executive.

 

No Mandate

 

As of December 2010, 70% of cards issued in Canada, 55% of point-of-sale terminals, and 90% of ATMs deployed by financial institutions were EMV-compliant, according to Advanced Card Technologies (ACT) Canada, an association promoting new card technologies. Conversion rates for ATMs deployed by independent operators were estimated to be below 90%.

 

Those figures are considered a significant improvement from just a few months earlier. In September 2010, 182.2 million EMV cards had been issued and deployed in the Canada, Latin America, and Caribbean region representing 26.4% of all cards, and 2 million EMV terminals had been deployed representing 55.6% of all terminals, according to EMVCo. American Express Co., JCB International, MasterCard Inc., and Visa Inc. own EMVCo., which manages the EMV specifications for chip-based payment cards and terminals.

 

Interac has set a deadline of Dec. 31, 2012 for ATMs in its network to be EMV-compliant and Dec. 31, 2015, for all cards in its network to be compliant (chart). Visa Canada set a March 31, 2011, deadline for the shifting of liability for fraudulent transactions to non-compliant merchants and card issuers.

 

With the passing of the liability shift, payment experts believe far more than 70% of cards and 55% terminals have been converted. Visa and Interac declined to provide figures for the number of cards, terminals, and ATMs that had been converted as of March 31.

 

Under the rules of the liability shift, merchants that have not deployed an EMV terminal can still accept EMV cards, but must authorize a purchase on the card using its magnetic stripe. If that transaction is fraudulent, the merchant is responsible for the loss.

 

Concurrently, card issuers that continue to issue mag-stripe-only cards are liable for fraud losses on those cards that occur at EMV-compliant Canadian merchants. Canadian issuers will continue to include magnetic stripes on their EMV cards so they can be used in the United States and other non-EMV countries.

 

“While we don’t have a mandate for EMV compliance, the passing of the liability-shift deadline moved a lot of merchants to install EMV terminals,” says Shirley Matthew, head of product platform for Visa Canada, which announced in 2004 that it was adopting EMV technology.

 

Visa opted not to mandate that merchants become EMV-compliant because it wanted to provide merchants with choice. “Merchants can look at their fraud risk and make the decision whether they want an EMV terminal or not,” says Matthew. “A merchant that sells knitting supplies is likely to be less prone to fraud than a merchant that sells jewelry or electronics.”

 

Nevertheless, the liability shift is a natural incentive for merchants of all sizes to deploy EMV terminals, says Dan Kelly, senior vice president of legislative affairs for the Canadian Federation of Independent Business (CFIB), a trade association representing small and mid-sized businesses.

 

Big-Merchant Angst

 

EMV cards are less prone to fraud in the physical world than mag-stripe cards because of a two-layered authentication process that validates the card and cardholder. When inserted into a POS terminal, the card’s embedded microprocessor validates the authenticity of the chip to the terminal using algorithmic codes. The cardholder validates her identity by entering a PIN. The chips also have much greater memory than the mag stripe, which opens EMV cards to a wide range of non-payment functions.

 

EMV stands for Europay-Master­Card-Visa, the card networks that pushed the standard in Europe and Asia. Europay International was a European bank card association that co-developed the EMV standard in the early 1990s. Although MasterCard absorbed Europay in 2002, its name remains associated with the standard.

 

The March 31 liability shift held significance beyond placing the fraud risk on non-compliant EMV merchants and issuers. Visa’s original liability-shift date was Oct. 31, 2010. Visa pushed that date back when large merchants operating integrated POS systems and gas stations that were just receiving EMV-compliant in-pump card readers only a few months before the deadline complained they would not meet it.

 

“It is a lot harder for large merchants that have integrated their POS terminal into a cash register or complex POS system to swap out legacy equipment than it is for a small merchant using a standalone POS terminal,” says CFIB’s Kelly. “A big reason the deployment of EMV terminals among small and mid-sized merchants has been smoother is that most of them rent their POS terminal, so the acquirer can upgrade them at little or no additional cost. Merchants that own their POS system prefer to wait for planned technology upgrades.”

 

Another factor in the decision to extend the deadline is that since larger merchants were lagging behind, it meant they would have to implement the new technology in the months leading up to the Christmas shopping season. Most large merchants prefer to perform technology upgrades immediately after the holidays so they have ample time to train staff on the new equipment and work out any bugs before the next holiday season.

 

Petroleum retailers faced unique problems. “In Canada, petroleum retailers tend to exceed the government safety standards for a POS terminal in proximity to the pump,” says Catherine Johnston, president and chief executive of ACT Canada. “Initially, there was not a card reader that met the desired standards, which meant one had to be built,” she says.

 

The terminals finally started coming to market in mid-2010, which meant that gas stations would have to scramble to meet an October liability-shift deadline.

 

“There were concerns that too many merchants would be rushing to get their terminals certified at the last minute, which would be tough to manage,” says David Chaudhuri, vice president and general manager for terminal maker Ingenico Canada. “That was a consideration for extending the deadline.”

 

Since then, petroleum retailers have been granted a second extension for the liability shift through December 2012, MasterCard Canada president Betty DeVita said in an interview with Canada’s PaymentsBusiness magazine earlier this year.

 

PIN Amnesia

 

Besides arriving at a manageable date for most merchants to comply with the liability shift, banks and the card networks discovered the need to adjust their consumer-education efforts on how to use chip-and-PIN technology.

 

As counter-intuitive as it may sound, training Canadian consumers to enter a PIN when conducting a credit card transaction was a big hurdle during the pilot. Despite the country’s long-time use of Interac PIN-debit cards, which launched in 1994, consumers had a surprisingly hard time remembering PINs for credit card transactions.

 

The habit of signing a receipt was so deeply ingrained in their consciousness that they simply forgot to commit their new credit card PINs to memory. In other instances, the problem could be traced back to their card-issuing bank opting to assign them a random PIN versus allowing the cardholder to choose one they would remember.

 

“The hardest thing for consumers and merchants when it comes to payments is changing the process at the point of sale,” says Anne Koski, head of Business Credit Cards for Royal Bank of Canada. “If consumers are not used to entering a PIN for credit card transactions, it is going to take a while for them to get in the habit.”

 

Consumers also were prone to leaving their cards in the POS terminal after entering their PIN. “That was an issue that had a more significant impact than expected,” says Black. “Solutions included terminal prompts being changed to remind cardholders to remove their cards, beeps being added to remind cardholders to take their cards, and merchant training being revised to include a reminder to the cardholder to remove the card from the POS terminal.”

 

Efforts to improve consumer education for the rollout included mailing written tutorials on how to use the card at the point of sale, how and where to reset a PIN, and whom to contact in the event the card did not work as expected in stores.

 

Despite the extent of the mailings, the information did not always resonate with consumers, which meant that many forgot their PIN the first few times they attempted to use their credit cards.

 

“If a consumer entered the wrong PIN or could not remember it after the card was inserted in the terminal, we would reach out to the cardholder and instruct them to come to a branch so we could give them their PIN in person or show them how to reset it,” says Koski. “We were careful to avoid allowing PIN resets over the phone or giving out PINs over the phone.”

 

Variations in terminal prompts also hindered consumer recall and comfort with chip-and-PIN technology during the pilot. “The inconsistency of terminal prompts led to confusion among cardholders about how to complete the transaction and in many cases the transaction would time out,” says ACT Canada’s Johnston.

 

The inconsistencies originated with the variety of POS systems used by merchants. “Merchants with integrated systems had different prompts on their terminals than merchants using standalone terminals,” says Koski. “Looking back, consistent prompts are something we’d address before rollout, but now that cardholders are used to using chip-and-PIN it is less of an issue.”

 

‘Unforseen Cost’

 

One critical marketing issue that was addressed in the pilot was explaining to the public why Canada was moving to chip-and-PIN. Even though fraud levels in Canada were manageable when the move to EMV was announced, the change was based on the knowledge that as the rest of the world adopted EMV, more fraud would migrate to non-EMV countries.

 

“The industry realized during the Kitchener-Waterloo trial that the message it needed to send to merchants and consumers was increased security, less loss,” says Johnston.

 

As smoothly as the rollout has gone, the lack of a mandate by Visa, Canada’s largest card network, to implement EMV has left an opening for some merchants to embrace contactless chip cards instead of chip-and-PIN. Petroleum retailers Shell and Esso have had contactless solutions in the market for years.

 

According to Kelly, other merchants, such as fast-food restaurants and low-ticket merchants that don’t require a signature for credit card transactions below a floor limit, reportedly are embracing contactless technology in lieu of EMV, including Tim Horton’s, a big chain of diners throughout Canada and the U.S.

 

“One complaint about chip-and-PIN is that it is slower and some consumers forget their card in the terminal, which delays the next transaction,” says Kelly. “Merchants that put a premium on moving consumers through checkout quickly are going with contactless.”

 

While not as secure as chip-and-PIN, contactless technology is considered more secure than mag-stripe cards because the chip resides in the card or a handheld device that communicates directly with the card reader. Hence, there is no mag stripe that can be skimmed at the point of sale. Additional layers of security include a transaction identifier or security code that serves as a proof of authenticity for each payment.

 

“Several Canadian merchants have been ahead of the curve when it comes to contactless technology and we feel it is an alternative solution to chip-and-PIN that we can manage,” says RBC’s Koski.

 

One downside to contactless cards is that issuers that got in on the ground floor of EMV ended up quickly reissuing their cards so contactless terminals could read them.

 

“That was an unforeseen cost for early adopters that did not understand chip technology and the direction it was going in Canada as well as they thought,” says Anthony Genovese, vice president of consulting services in the Toronto office of Magnitogorsk, Russia-based Compass Plus, a provider of retail banking software and electronic payment systems.

 

‘A Hole in the System’

 

While little data about fraud levels is yet available, anecdotal evidence suggests that credit card fraud has dropped since EMV cards were first issued in 2008. Chip-and-PIN technology will not prevent some forms of fraud, notably e-commerce fraud.

 

Ultimately, questions remain about how long after Interac’s card-implementation deadline of 2015 will Canadian issuers support a magnetic stripe on their EMV cards, and how long will merchant terminals continue to read magnetic stripes. For the time being, Canadian issuers feel compelled to continue supporting the mag stripe because of the significant amount of cross-border transactions initiated by Canadian and U.S. travelers.

 

In a study of 2010 tourism spending by its cardholders, Visa reported in late April that Canada was the No. 1 source of Visa cardholders to the U.S., and those cardholders spent $9.2 billion, up 18% from 2009. Canada was the most popular foreign destination of U.S. Visa cardholders, who spent $3.5 billion there last year, up 8% from 2009.

 

Canadian cardholders using their credit card in the U.S. are protected under current Visa, MasterCard, and AmEx liability rules. Canadian merchants that are EMV-compliant will not be held liable for fraudulent transactions conducted with a foreign mag-stripe card. Canadian merchants also have the option to decline acceptance of mag-stripe cards.

 

“The risk of the mag stripe is that fraud will follow it,” says ACT Canada’s Johnston. “As long as mag-stripe technology is supported, it leaves a hole in the system that criminals can exploit.”

 

Until the U.S. adopts EMV technology (box, page 32), it is unlikely that Canadian banks will opt to phase out support for the magnetic stripe.

 

“When there is substantial enough fraud migration to the U.S. because it does not support EMV, then there is likely to be movement by U.S. banks to adopt EMV,” says William F. Keenan, chief executive of DeNovo Corp., a Wilmington, Del.-based payment card consulting firm that does business in Canada.

 

In the meantime, U.S. issuers and acquirers have a prime example of relatively smooth EMV rollout to learn from right in their back yard.

 

 

 

How Long Before EMV Conquers the U.S.?

 

Talk of EMV adoption in the U.S. is nothing new, but with Canada rolling out chip-and-PIN cards and terminals and Mexico also migrating to EMV technology, it may not be long indeed before the U.S. becomes a magnetic-stripe island in the Americas.

 

While Europe and many countries in the Asia-Pacific region adopted EMV technology to overcome telecommunications infrastructure that was either unreliable or vulnerable to interception of magnetic-stripe card data, the U.S. with its reliable land lines steadfastly continues to support mag-stripe technology.

 

The reasons vary from implementation of strong data-encryption technology to a reluctance to abandon the investment made in current infrastructure. But the primary reason comes down to the lack of a convincing business case for EMV.

 

The fraud rate has been stable in recent years at about 7 basis points of charge volume, or only 7 cents for every $100 in bank card purchases—a level issuers apparently can live with.

 

“Fraud prevention is a big part of the business case for chip-and-PIN, but in the U.S. card issuers also want to see more revenue opportunities for EMV cards to justify the cost of the switch,” says William F. Keenan, chief executive of consulting firm DeNovo Corp. “Until the business [cases] for fraud prevention and new revenue opportunities merge, I don’t see the U.S. adopting EMV.”

 

Some of the new revenue opportunities from EMV cards are loyalty programs, consumer identification, and other add-on features for which issuers can charge third parties fees to add to their chip cards.

 

“There are certainly some revenue opportunities to be had by adding functionality to the chip beyond payment,” says David Chaudhuri, vice president and general manager for terminal maker Ingenico Canada. “But the driving force remains fraud mitigation as fraud moves from EMV-enabled countries to non-EMV countries.”

 

Some payments experts argue that EMV technology has already gained a toehold in the U.S. because a handful of card issuers are issuing EMV cards to customers who frequently travel internationally. And some studies have said U.S. travelers are beginning to have problems using their mag-stripe cards in Europe and other places with established EMV systems. But others counter that the U.S. payments landscape is made up of too many players with widely diverse interests for EMV to gain a consensus of support.

 

“You’ve got card issuers, acquirers, processors, and ISOs that work independently of each other. It’s going to be tough to get everyone moving in the same direction at once,” says Keenan. “Adopting EMV is a fundamental change in the U.S. payments landscape and it is going to require a strong business case that combines fraud reduction with new revenue opportunities for card issuers.”

 

 

 

 

 

How EMV Benefits Merchants

 

– Reduced fraud.

 

– Reduced credit card chargebacks.

 

– Time and cost savings due to enhanced operational procedures at the point of sale—reduction of collection efforts, no need to sign receipt, duplicate receipts unnecessary.

 

– Greater customer confidence.

 

– Consistent payment card transaction experience for merchants and their customers.

 

Source: GFH Group Inc.

 

 

Check Also

Visa And Mastercard Agree to Merchant Rate Cuts and Acceptance Changes in a Major Settlement

Merchant lawsuits challenging credit card interchange and payment card network rules that began nearly two …

Leave a Reply

Digital Transactions