As the United States inches closer to implementation of two factor verification for credit card transactions, where do the early adopters tand with Chip & Pin and what is next? Kiosk hardware purchasers, suppliers, and distributors both in Europe and abroad are anticipating how US adoption of EMV (Europay, MasterCard & Visa) will play out and which Chip technology will be adopted. The UK first adopted Chip & Pin more than a decade ago in 2003. With ten years of experience behind them, widespread acceptance, and the successful transition of liability from banks to sellers, established Chip & Pin markets have revealed what the U.S. can expect from adoption, the impact on fraud, and the benefits to converting, whether they select Chip & Pin, Chip & Contactless, or Chip & Signature.
Expectations:
As soon as liability is shifted to the seller, larger retailers and major high street chains will likely upgrade. Smaller businesses may show initial reluctance due to the significant cost of a new POS system. Owners of unattended kiosks such as parking or ticketing will have to etermine the cost of not converting, as well as the progression of the conversion (all at once or over time). Having learned that adoption only comes when liability shifts to the seller, credit card companies and banks are moving liability early on with an anticipated date of October 2015 for most US financial institutions. Liability for transactions at unattended gas station kiosks will not shift liability until 2017.
Fraud:
Hacking vulnerabilities exist, including the ability to harvest data from credit cards, bypass pin entry with an intermediary, or more commonly, fraudulent card-not-present transactions completed online or via mail order. Still, the existence of two factor verification decreases fraud risk to a great degree or at least shifts it to a card-not-present environment.
Benefits:
Few look beyond the obvious decrease in fraud for benefits, but they do exist. One benefit for retailers is the increased speed of transactions when a signature and receipt printing is not required. This decreases queues and allows for more transactions during busy times, with the same number of attendants or kiosks. Additionally, fewer paper receipts mean a savings in processing & material costs (which can ultimately decrease fees for retailers). Unattended kiosks benefit from increased security, user comfort with their information’s security, and decreased processing costs.
The UK Cards Association reported a dramatic reduction in fraud in the years following the adoption of EMV cards. With UK
retailers reporting losses down by 67% over the first five year period of adoption, and stolen card fraud down 58% in those same early years, low hanging fraud fruit seems to have taken a beating. As such, hackers and thieves seem to be moving on
to the harder to reach online and more technical hacking opportunities as well as countries that have not yet adopted these
fraud prevention measures. As the US adopts EMV, will those fraud opportunities move to other countries that have yet to
adopt two factor identification? Credit card transactions in an unattended or retail environment require multiple vendors from a
variety of business sectors in order to successfully process.
1. Credit Card accepting hardware
2. Kiosk/POS hardware
3. POS software
4. Lockdown software to secure POS and communicate from Credit Card accepting hardware to POS, from POS to Payment Processor
5. Gateway to communicate from POS to Payment Processor
6. Payment Processor
7. Bank/Credit Card Company
(Note: some steps are not necessary based on the transaction type)
The hardware for accepting credit cards with two factor verification is being developed. Companies are coming out with US specific hardware that will integrate with POS systems and payment processors in the US. Lockdown software systems like KioWare will need to create integrations that allow all of these new components to speak with one another. These software systems will be the bridge that links the new EMV credit card data to the kiosk/retailer payment processor.
One example of how this works in an unattended kiosk environment: Hemisphere West Europe (hardware component suppliers) is a prominent figure in unattended payment systems within Europe. They distribute CreditCall payment platform (Payment gateway to the processor) and multiple credit card accepting hardware devises (iSelf Series, UX Series, 4/1 and VIVOPay for example). Running on KioWare (kiosk lockdown software), the kiosks will be available in the US with EMV capabilities that mirror those used in the UK through their company UCP Inc.
The critical point of contention and concern is the possibility that regulations and requirements may continue to evolve and any hardware purchased could quickly become out of compliance. Using a vendor that is experienced with EMV enabled POS, kiosk, ticketing, car parking pay stations and vending terminals can only decrease this risk as well as provide new-to-EMV retailers and unattended kiosk vendors with the benefit of their experience and years in the EMV-enabled marketplace.
Ultimately, those who have already experienced the implementation of Chip & Pin will likely best be suited for transitioning those that have not. What lessons has the UK learned that they can teach to those new to the EMV landscape?
This article originally appeared in Kiosk Europe magazine.