How an Old Standard Could Trip Up a New Generation of Contactless Payments

The surprising revelation by J.C. Penney Co. Inc. over the weekend that it had ceased acceptance of contactless payments unmasked the little-noticed ability of contactless mobile wallets to work with point-of-sale technology that far predates them but which Visa Inc. wants banished.

The blend of old and new has worked just fine until now, but problems with it are likely to become apparent as contactless-enabled EMV chip cards begin to proliferate in the U.S., observers say. The new plastic cards won’t work when tapped on terminals relying on the old contactless standard known as magnetic-stripe data, or MSD, even if the terminal can read the card’s EMV chip when the card is inserted, or dipped, into the device. That potentially means longer lines at stores or even lost sales from frustrated cardholders.

Most U.S. EMV contactless cards are expected to be of the so-called dual-interface variety that support both contact and tap-and-go payments. There were few dual-interface cards in the market in 2018, but several big issuers have publicly committed to issuing them this year, including No. 1 credit card issuer JPMorgan Chase & Co. Visa predicts there will be 100 million of them by year’s end.

It turns out that the U.S. apparently has a large number of POS terminals that support contact EMV payments as well as MSD contactless payments with the general-purpose mobile wallets such as Apple Pay, Google Pay, and Samsung Pay. Those wallets use near-field communication technology and meet EMV standards for contactless payments.

When tapped on a terminal equipped only for MSD contactless payments, the mobile wallets have the ability to “step down” from EMV technology and still process the transaction, according to Randy Vanderhoof, executive director of the Secure Technology Alliance, a Princeton Junction, N.J.-based trade group that researches chip card payments. But no such stepdown is available for newer dual-interface cards, which can run EMV transactions via contact and contactless interfaces.

Vanderhoof notes that MSD was the standard used in the pre-EMV generation of contactless cards dating back more than a decade, the best known of which probably was Chase’s blink card issued from 2005 to 2014. Consumers, however, didn’t embrace these early contactless cards, in part because merchants didn’t, either. Even so, MSD capability was built into many contact-only EMV terminals later on. By not supporting EMV contactless payments, a merchant could avoid the cost and hassles of software upgrades and certifications.

But Visa in October 2017 set an April 13, 2019, deadline for terminals to support the newer EMV contactless standard and retire MSD. The EMV standard is more secure because it uses one-time cryptograms in transactions whereas MSD doesn’t. Plus, EMV is the contactless standard in many countries while MSD was developed mainly for the U.S. market, though it briefly was used in Canada, too.

“The payment brands want to get MSD out of the market and move everyone to the contactless EMV front,” Vanderhoof says. “That is how it is impacting on Apple Pay, because in the case of JCPenney they had enabled for EMV contact [transactions] but not EMV contactless.”

The initial news Monday focused on JCPenney dropping Apple Pay, but the Plano, Texas-based retailer confirmed to Digital Transactions News later that it also accepted Google Pay and Samsung Pay.

It surprised many observers to see JCPenney pull the plug on the mobile wallets because, after years of trying, the payments apps finally seemed to be attracting more merchant acceptors and consumer users. The move by JCPenney, which has struggled with weak sales in recent years, also raises the question of who else is still relying on contact-only EMV terminals with MSD capability.

“I would agree that there other retailers that are in the same situation as JCPenney,” says Vanderhoof, though he wouldn’t name any. Some merchants, because of “other priorities,” decided not to make EMV contactless upgrades, he says.

Another question is what will happen to merchants that hadn’t upgraded their terminals for EMV contactless payments by Visa’s April 13 deadline. Visa declined comment.