Opinion & Analysis: How to Place Your Bets on EMV

Mitchell Cobrin

Americans like a sure thing, which is not proving helpful when it comes to figuring out chip card deployment. Better to identify promising markets, like m-commerce, and recruit partners with expertise.

EMV technology, or the point-of-sale payment protocol based on Europe’s Europay-MasterCard-Visa card system, has arrived on U.S. shores, and, not surprisingly, providers, merchants, acquirers, ISOs, and pundits are all abuzz.

Yes, this embedded-chip authentication and authorization technology may be new to America, but it’s been working in full implementation throughout the world since it was introduced in 1996. It’s worth noting that there are today more than 1 billion EMV-compliant chip-based cards being used at over 15.4 million EMV-acceptance terminals throughout 80 countries around the globe.

Clearly, this technology is no newfangled widget. EMV has been proven effective in some of the world’s most demanding and sophisticated cities and commercial centers throughout Europe and Canada. Yet, even with this traction, many in the United States are skittish about the impact and implications, both positive and negative, of EMV.

Why, you may ask, is this the case? After all, U.S. providers have the benefit of volumes of data extracted from 80 countries to learn from, to understand what worked and what didn’t. They’re able to replicate the best-case scenarios for various challenges and solutions. So why all the fuss?

Simply put, it’s because we are a society that loves absolutes. Like most technologies across all industries, EMV can be deployed in a variety of forms, configurations, and platforms. As technologists, we like to obsess over predicting which of these formats will emerge with the coveted title of “best practice.” We like to be as sure as possible before we place our eggs—our investment dollars—in that one winning basket.

There is a lot at stake. EMV deployment will require changes not only in behavior at the point of sale, but will also necessitate significant changes in back-office processes—and along the payment chain.

Four Methods

Of course, it’s a big payday when we are able to guess an absolute winner correctly, especially before our competitors do. But what happens, more often than not, is that all of this pre-thinking and prognostication only serves to slow down adoption, transition, and rollout. In other words, we get caught up in analysis/paralysis.

Yes, we can absolutely learn from Europe and Canada in managing the mechanics of EMV deployment here in the United States, but let’s not get hung up on absolutely crossing every “t” and dotting every “i” for every conceivable merchant and consumer business model. Not when there are technology solutions available that are already working on, and with, all current EMV platforms and configurations. Let’s leave the absolutes for tomorrow and get down to work today.

There are currently four chief payment-presentation methods for EMV. Since this technology is relatively new and emergent to the United States, it makes sense to take a peek at each and provide a quick working definition.

The first two methods make use of the smart card chip embedded in the payment card itself. This is simply referred to as the “chip.” The chip is a rather sophisticated device that not only stores cardholder data, as does the magnetic stripe on older cards, but also interacts with the chip reader in a point-of-sale terminal to keep data safe and to ensure proper authentication.

Sensitive data stored on the chip are masked using an encryption key that is managed by the card issuer. These data are nearly impossible to extract and use in the cloning of a card for fraudulent use. And, even if the data were intercepted or extracted, it would be useless to the criminal, since the encrypted information is unique for every transaction. As a result, intercepted information could not be used to make additional purchases.

Method 1: Chip-and-PIN EMV

Chip-and-PIN is the brand name adopted by the banking industries in the United Kingdom and Ireland for the rollout of an EMV smart card payment system for credit, debit, and ATM cards. The word “chip” here refers to a smart card chip embedded in the card itself; the word PIN refers to a personal identification number that must be supplied by the customer.

“Chip-and-PIN” is also used in a generic sense to mean any EMV smart card technology that relies on an embedded chip and a PIN. With this technology, the paying consumer’s card has an embedded chip that, when coupled with the entry of a PIN, authenticates card and carholder and authorizes the cardholder to perform a transaction.

A significant benefit to chip-and-PIN is that its introduction roughly coincided with wireless technology becoming inexpensive and widespread. Hence, wireless PIN pads were quickly introduced that could be brought to the customer and used without the card ever being out of sight, even in restaurant situations.

In short, chip-and-PIN and wireless together dramatically reduce the risk of card theft, misuse, or cloning, thanks to a sophisticated encryption and authentication measure, and the ability to keep the card in sight.

Method 2: Chip-and-signature EMV

Similarly, chip-and-signature is an authentication and authorization security measure. But here the preferred combination to verify the cardholder is the chip embedded in the presented card and a signature at the POS terminal. This is similar to how mag-stripe cards are commonly used throughout the United States today, with a swipe and signature procedure and no PIN entry required.

The benefit of offering chip-and-signature over chip-and-PIN becomes apparent when issuers and merchants need to accommodate individuals who have difficulty entering PINs. This may be due to dexterity issues, visual impairment, memory problems, or mobility issues that make it hard to use a PIN terminal.

Chip-and-signature combines the added security and accessibility of the embedded chip with the easier verification method of the signature. And again, thanks to wireless technology, signature pads can be present wherever the cardholder is, so the card always remains in sight. Also, chip-and-signature is more cost-effective for merchants vis-à-vis point-of-sale expenditure.

Because of its similarity to current payment methods, the chip-and-signature option is expected to hold significant promise for a successful U.S. rollout, and perhaps even become the dominant mode.

Method 3: NFC and EMV

NFC, or near-field communication, is a set of standards for smart phones and similar devices to establish radio communication with each other by touching them together or bringing them into close proximity. Present and anticipated applications include contactless transactions and data exchange, particularly when paired with Bluetooth technology and/or in Wi-Fi environments.

NFC-enabled devices can be used in contactless payment systems similar to systems currently used in credit cards and electronic-ticket smart cards, enabling mobile payment to replace or supplement these card-based systems.

However, in this scenario, the EMV chip would need to be embedded not only within the smart phone or device, but also within the merchant’s payment terminal. This additional and significant hardware challenge presents a complication to U.S. markets that will no doubt slow adoption, at least initially.

Adding to the complication is the fact that paying with digital wallets that reside on a smart phone is still a relatively emerging payment option, requiring the adoption of unfamiliar consumer behavior. Also, such payments are supported by only the higher-end smart phones, and they remain generally unknown to most of the consuming public.

Method 4: No CVM and EMV

EMV technology also supports “no CVM” transactions. These are small-ticket transactions, generally under $25, depending on provider policies, where no cardholder-verification method (CVM) is required.

The obvious advantages here are the fact that low value equals low risk, at least from a fraud standpoint, and that “no verification required” means a faster and more pleasant experience for both the cardholder and the merchant.

The risk of loss and fraud is further mitigated by the issuer through the establishment of transaction-quantity and transaction-floor limits that necessitate PIN or signature validation whenever a limit is reached. Again, these values and limits are stored and tracked on the chip in the card itself, so they can be enforced even in offline use.

Ultimate Winners

It is generally believed that the two methods that will account for the greatest U.S. EMV rollout will be the first two described above—chip and PIN and chip and signature. This, of course, brings us full circle to our opening thought: the power and value of being first to predict which technology will most likely win out—that is, garner the greatest market share—and then being able to beat your competition to become the leading and de facto provider of that technology in your markets.

Add to this dynamic the rapid penetration of mobility in the payment space, and things begin to get really interesting. Why? Because, while EMV was slated to begin its U.S. rollout in April 2013, the overwhelming majority of current payment terminals are not EMV-enabled. Getting them there will require major investments.

Conversely, EMV in the m-commerce space can be deployed far faster than it can within fixed environments, while still providing all the advantages that make EMV an attractive payment technology: improved flexibility, enhanced security, increased convenience, and greater transactional ease of use. So much so, in fact, that the m-commerce space just may prove to be the smartest, easiest, and most effective entrée into the EMV game.

How so? Because third-party manufacturers of smart-phone-agnostic and processing-platform-agnostic hardware, software, and gateway solutions can implement EMV-enabling technology far more easily and with much less disruption in their lines of ancillary products—like chip readers and PIN-entry devices—than cellular manufacturers can into their various models of smart phones with EMV technology.

This means issuers and acquirers can begin implementing EMV systems for their merchants right now, using mobile-payment technology solutions that are already EMV-enabled. There’s no need for analysis/paralysis. They can get to work today.

The payment technology space is no different from any other technology sector. There are just as many risks in rushing to be the first to pick the winning horse as there are in stalling to see what develops and then betting on the race when it’s over.

The good news is that there are solutions available today that are universally compatible and don’t force you to choose one EMV method over the other. The bottom line: partner up with a proven global partner that has the technological depth, breadth, and universal compatibility to ensure you are able to place more than one horse in the race.

With a versatile and flexible partner behind you, you’ll be ready for whichever technology dominates. 

Mitchell Cobrin is cofounder and chief executive of Montreal-based AnywhereCommerce.