EMV at 10

It’s now 10 years since the era of the EMV standard dawned for the U.S. payments industry. It ushered in chip cards—and along with them an effective defense against fake cards. Herewith a report on how the industry has reacted—and how effective EMV has been.

In October 2015, the big four card networks made it official, implementing a technique called a “liability shift” to nudge U.S. processors and merchants to adopt the EMV standard for card security. It would be one if the most momentous technology overhauls ever undertaken by American Express, Discover, Mastercard, and Visa—not to mention processors and merchants.

The shift imposed the liability for fraud on the party that hadn’t adopted EMV technology. Preparing for it in 2015, U.S. card issuers, merchants, and ATM operators spent an estimated $10.5 billion on compliance, with the bulk of that expense falling on merchants in the form of new point-of-sale technology. Chip reading at the point of sale was now in; deciphering mag stripes was out.

There was nothing particularly new about chip card technology. Cartes Bancaire in France launched the first chip card in 1986, but adoption lagged. What was new a decade ago was a subtle penalty, a sort of knuckle sandwich wrapped in diplomatic language and backed by the Big Four: if a merchant did not adopt EMV—the technology that enables chip card transactions—that recalcitrance would require the non-conforming party to bear the cost of any fraud. That got things going.

EMV, or Europay, Mastercard, and Visa, has taken off over the course of the past decade. Last year, a bit more than 93% of all U.S. card-present transactions were processed via that embedded chip, according to EMVCo, the developer of EMV specifications (chart). That’s 2.7 percentage points behind the world. But the world is farther ahead on adoption, at nearly 72% of cards, four points more than the U.S.

That liability shift is working its magic—just not at the fast clip some would prefer. Merchants, issuers, and acquirers will observe with a great deal of interest how long it takes for the U.S. card-payments market to catch up with the rest of the world.

Following are reports on the progress of EMV from the viewpoint of three crucial constituencies—acquirers, merchants, and issuers. How will they view the technology a decade from now? That’s anybody’s guess, but nobody will complain about a decade’s worth of savings on fraud losses.

EMV’s Impact: Acquiring

Ten years on since the U.S. payment card market migrated to the EMV chip standard via a liability shift, it might be difficult to recall the migration’s impact on acquirers. EMV chip transactions in the United States now account for 93.51% of card-present transactions, according to EMVCo, the EMV standards body.

Not only did they need to help educate merchants about why they needed new point-of-sale terminals, their sales agents required training on the new chip card technology and how it was different from a mag-stripe-only transaction. They also needed to ensure any devices that would accept EMV-compatible cards were certified, a lengthy and sometimes costly process.

With more than four years to prep—Visa announced its EMV intention in August 2011 and Mastercard did so in January 2012, with Discover and American Express announcing that same year—acquirers had a lot of work ahead of them.

Has all that work paid off? Generally, yes. EMV chip transactions in the United States now account for 93.51% of all card-present transactions, according to EMVCo, the EMV standards body. EMV’s chief anti-fraud effort was to reduce counterfeit card-present transactions.

“At this point, EMV is the standard,” says Dustin Magaziner, chief executive and founder of PayBright, a Raleigh, N.C.-based payments provider. “It is almost hard to remember the days where EMV wasn’t the norm in card-present environments. At this point, most folks at PayBright don’t even know or remember the pre-EMV days.” His recall of the migration is that it was a “mess.”

Certification, for example, was rife with delays, complex testing processes, and mixed availability for POS terminals. Digital Transactions reported in September 2015 that the process was moving along as expected, with one exception—POS systems. The myriad configurations made testing time-consuming. Software came from one company, hardware from another, and payment processing from third. It wasn’t too much an issue for merchants at either end of the size continuum; the mid-market bore the brunt of the headaches.

As reported then, certification for a POS terminal might have taken three to four weeks. But, with the push to meet the Oct. 15, 2015, liability-shift deadline, POS systems were taking four to six months. In 2016, Visa and Mastercard launched programs to streamline the testing process.

The U.S. transition to EMV was not mandated, but merchants that opted not to participate would then take on the liability for fraudulent card-present transactions, something most players likely feared could cost more than new POS terminals.

It was complicated, too, because of the disparate elements of the transition, says Ian Holmes, director and global lead for enterprise fraud solutions at SAS, a data and artificial intelligence technologist.

“Merchants also had to weigh the cost of upgrading to EMV against the liability shift, which made them responsible for fraud losses if they processed a chip card without EMV technology,” Holmes says.

“The lack of uniformity in technology and processes throughout the transition also added friction,” Holmes continues. “Some cards required PIN, some required signature, and some allowed ‘no [cardholder verification method] for low-value transactions. Merchants had to support multiple methods, and the resulting customer confusion only served to slow adoption at point of sale.”

Merchants also had to contend with high-pressure sales pitches sometimes and limited terminal availability at other times, Magaziner says.

“The migration was a mess 10 years ago,” he says. “Processors and sales reps scared merchants into making a change, processors couldn’t get terminals, merchants were being overcharged, and leased terminals at exorbitant prices for the ‘EMV mandate required to be compliant under Visa’s rules.’ There were a lot of sales gimmicks at the time and created a Wild, Wild West environment for a few years.”

Even with these issues, the migration progressed. Acquirers and their merchants adapted. EMV acceptance got a big boost during the Covid pandemic when consumers realized their new chip cards also contained an antenna so they could tap the card at a payment terminal. The choice to re-terminalize many merchant locations with both contact and contactless acceptance finally paid off.

“Overall, impacts of the migration has been positive, though not without challenges. Despite banks’ earnest efforts, educating the public largely fell to merchants, who otherwise risked losing sales when customers encountered new and unfamiliar technology and processes,” Holmes says.

Contactless in particular stood out for PayBright, Magaziner says. “Similar to EMV being a big change 10 years ago, we’ve seen a marked increase in tap-to-pay over the last few years.”

EMV helped make it so mobile wallets could be more easily adapted to the point of sale. Apple Pay, Google Pay, and Samsung Pay all launched as the liability shift got under way. “By enabling card payments through phones, EMV helped drive the adoption of digital payments and, in turn, demand for more robust fraud-detection solutions capable of keeping pace with the speed and complexity of real-time payments,” Holmes says.

—Kevin Woodward

EMV’s Impact: Merchants

At first, stores were slow to adopt EMV-capable devices, some experts say, because they were unsure the technology would do much for them, making it hard to recover the cost. And merchants have kept a wary eye on the machinations of the payments industry for many years, raising objections to a range of impositions from banks and processors—not least, the interchange fees they must pay for card acceptance.

“In the beginning, there was an outcry over the cost” of EMV-capable devices, recalls Eric Grover, principal at the consultancy Intrepid Ventures. Now, he says, “I don’t think you hear much out of them these days. Now, it’s part of the landscape.”

What turned merchants around on EMV? Some say it has much to do with the improvements EMV and services related to EMV devices have brought to the in-store payment process. For example, by some estimates, some 65% of EMV cards are now dual-interface, supporting both contact and contactless payments.

“One of the biggest things EMV has enabled is ease of use and far less friction,” notes Cliff Gray, principal at Gray Consulting Ventures, a payments advisory. Adding contactless capability has only magnified this effect, he notes. “How many of us tap our phones? What could be easier?” he asks, pointing to the role EMV has played in popular contactless features such as Apple Pay.

Some merchant niches have seen further improvement. Take restaurants, for example, where pay-at-table has become practically a required process “so the waiter doesn’t run away with the card,” jokes Gray. And customers are unruffled. “Most consumers know they’re fully protected,” says Grover. “I don’t think there’s much inhibition.”

Now, say some observers, EMV is poised to accompany tokenization, the technology that masks sensitive card information with data that’s useless if intercepted by thieves. “The golden rule around [all] this is, don’t have any gold in your fort,” says Gray. “That’s what a token does, and EMV will happily ride with it.”

—John Stewart

EMV’s Impact: Consumers

When the card networks implemented the EMV liability shift in 2015, consumers had no idea how it would improve the checkout experience over the next decade. Not only did the liability shift force merchants to install EMV terminals that reduced the risk of fraud, it laid the foundation for tap-to-pay technology to become mainstream.

At the same time, the shift raised the level of trust between consumers, on the one hand, and merchants that rolled out EMV terminals, on the other. That’s because it sent a signal the merchant was serious about protecting customers from fraud committed using stolen and counterfeit cards, payments experts say.

“The EMV liability shift encouraged merchants and issuers to invest in their card payments technology, from enhanced terminals to chip-enabled cards, which resulted in less fraud at the point of sale and provided the consumer with added confidence to use their debit and credit cards over cash,” says John Winstel, head of optimization product for the processor Worldpay, which is being acquired by Global Payments Inc. in a deal expected to close early next year. “It also added a level of trust with merchants who had upgraded their terminals to EMV to provide a safe and secure checkout experience.”

Reducing fraud, especially in the United States, was a key initiative for the card networks in 2015, as fraud was migrating to the country from other regions of the world where EMV cards and terminals were commonplace.

“As EMV rolled out in other parts of the world, fraud in those regions began to shift to the United States, which was slower to adopt EMV technology,” says Christina Hulka, executive director of the Secure Technology Alliance. “When it comes to fraud, criminals look for the weakest link, and the U.S. was the weakest link in the system at the time.”

As more and more merchants began to install EMV terminals, they embarked on education efforts, along with issuers, to prompt consumers to dip their cards in the terminals. “The networks made efforts to educate consumers, but merchants had the biggest incentive to be sure their customers were using the technology,” says Thad Peterson, a strategic advisor for Datos Insights.

Another benefit from the liability shift for consumers was that it forced financial institutions to accelerate their issuance of chip cards, which meant U.S. cardholders would be able to use their cards when travelling abroad. By that time, many merchants outside the U.S. no longer supported magnetic-stripe card readers. “That was an issue for U.S. consumers,” says Hulka, who was a Visa Inc. executive in 2015. “For interoperability to truly work, the entire payments system has to support it.”

As the migration of card fraud to the U.S. reached a tipping point in 2012, the card networks not only realized they needed to create incentives that would induce adoption of EMV technology, but that doing so could also resolve the interoperability issues U.S. cardholders faced when traveling abroad, Hulka adds.

Another benefit to consumers from EMV is that it helped lay the foundation for tap-to-pay and digital-wallet technology, which speeds checkout at the physical point-of-sale.

“The liability shift forced merchants to upgrade their hardware to maintain compliance, and these new terminals also came equipped with near-field communication technology, enabling contactless tap-to-pay capabilities, opening a new door for payment acceptance,” says Winstel.

Tap-to-pay technology took off during the Covid-19 pandemic as consumers were looking for payment options that did not involve touching a terminal. At the same time, issuers started embedding NFC technology in their cards to enable tap-to-pay capabilities. The confluence of the two trends created a perfect storm where tap-to-pay exploded in the U.S. during the pandemic and made the technology mainstream.

“The foundation for contactless adoption was already there, but the pandemic triggered mass deployment of contactless cards and terminals and mobile wallets,” Hulka says. “The liability shift has spurred a lot of innovation [at the point-of-sale] that builds off chip technology, whether it be on a card or a device.”

“The liability shift provided an incentive on both sides to implement the technology, issuers putting chips on cards and merchants purchasing EMV capable terminals,” Peterson says. “The result was the rapid near-elimination of counterfeit card fraud, which was the objective of EMV.”

–Peter Lucas