Visa is encouraging retailers to move toward the EMV technology seen in Europe, but some argue by the time it’s implemented in the U.S., the technology will be outdated.
By Erin Rigik, Associate Editor.
Visa this fall announced plans to speed up the migration to contact chip and contactless EMV chip credit card technology in the U.S.
EMV is a global standard for interoperation of integrated circuit (IC) cards and IC card capable point-of-sale (POS) terminals and ATMs for authenticating credit and debit card transactions.
Global integration of EMV would mean Visa and MasterCard cards can continue to be accepted everywhere. The adoption of dual-interface chip technology also would prepare U.S. payment infrastructure for Near Field Communication (NFC) mobile payments by creating the necessary network to accept and process chip transactions.
Visa has set October 2015 as a deadline for merchants to install EMV payment terminals in stores, and the end of 2017 as the deadline for gas stations featuring pay-at-the-pump terminals to accept EMV payment or assume the liability and cost of disputed credit card transactions.
Some retailers are embracing the new technology as the next step toward a new world of payment transactions, while others are questioning why U.S. retailers are being asked to upgrade to an old technology that has existed for more than a decade in Europe, instead of preparing for a more secure, modern approach to payments.
“EMV is 20 year-old technology that already has known deficiencies—no security for online use, no security of the card number and susceptible to man-in-the-middle attacks,” said Trinette Huber, manager, information privacy and security for Sinclair Oil’s PCI program. Sinclair Oil Corp. supplies fuel to more than 2,000 stations and convenience stores in 22 states.
Too Costly for C-Stores?
“From the retailer standpoint there are a lot of hardware costs involved in the upgrade to be ready to process the EMV chip,” said Huber. The technology involves chip without pin—rather than chip and pin. Visa has been calling it Chip & Choice. For their expensive upgrades retailers would only see a reduction in counterfeit card fraud. Fraud related costs make up some 0.15% of total sales, Huber estimated, and of that counterfeit card fraud is even less.
“They don’t think the U.S. consumer will accept the pin,” Huber said. “So without pin, it will only address counterfeit card fraud. It won’t address lost and stolen cards, or friendly fraud, so it’s just a small portion of total fraud costs.”
From a c-store point of view, “the penalties wouldn’t be that significant in comparison to the costs of infrastructure replacement,” agreed Aaron McPherson, practice director with IDC Financial Insights.
As a result many retailers see the move by Visa and MasterCard as asking retailers to undergo another major, highly expensive hardware and software installation upgrade without any real benefit in return.
“U.S. merchants don’t want old technology. U.S. merchants want the next generation of EMV—one that protects the card number so that PCI compliance requirements are thrown out, and one that addresses online fraud,” Huber said. “Let’s update that technology and do full card encryption. Then the return on investment would be worth it.”
Preparing The Pumps
Waycross, Ga.-based Flash Foods, which has more than 170 stores, is one c-store chain looking to embrace EMV as it adds fuel dispensers to new locations. The chain participated in a field trial from November 2010 until early 2011 through Gilbarco, upgrading its fuel dispensers to Encore 700S pumps at one of its stores. The dispenser’s integrated pay-at-the-pump platform is EMV certified, offers multi-platform security and mobile payment ready technology.
“We participated in the trial because that upgrade enabled us to be compliant as far as the PCI regulations to take debit at the pump, and it also put us in place for EMV, so we’ll be ready when the actual technology becomes available in our area,” said Jenny Bullard, chief information officer for Flash Foods.
Flash Foods is in the process now of building a new location in Macon, Ga. that will be the first new location to feature the Encore 700S. “As the industry moves closer to the EMV technology being available, then we will actually start going back and retrofitting dispensers at existing locations,” Bullard added.
But even though the pumps are EMV capable today, the technology is still not ready. “Even if we did have someone with a chip card, we still could not process the EMV at this time because of additional software needing to be added to the pumps,” Bullard noted.
Reading Between the Lines
Numerous misconceptions on the benefits and penalties surrounding EMV implementation abound. One is that the “deadlines” by Visa are mandates, much like PCI. “Basically it is a choice. You have to do the cost benefit analysis,” Huber said.
Another misconception is that those who upgrade to EMV can forgo PCI. “Visa is not going to require people who upgrade 75% of their equipment to report on PCI, but that does not mean they don’t have to follow all PCI requirements. It just means they don’t have to report it,” said Huber, adding, what retailers want is something that makes the card number secure so PCI compliance can be eliminated.
Deadlines for EMV are still unclear. “If you look at all the literature from VISA as far as when we see this technology being in place in our industry there are different dates thrown out there,” Bullard said.
Since customers in the U.S. aren’t currently carrying chip-enabled cards, the incentive for retailers to add the new technology is limited. “If your locations see a lot of tourist dollars and customers that have the cards, and it makes sense with your fraud costs, then great, but otherwise we’re being asked to change a large part of our business for something the customer doesn’t even have and isn’t demanding,” Huber said.
“From a retailer perspective it’s hard for us to know what to do,” Bullard agreed. Flash Foods faced a similar tough decision a few years ago—go back and retrofit all the pumps at older locations to make them PCI compliant/debit capable or stop taking debit at the pump. The chain chose the latter and today, with the new EMV acceleration, Bullard is glad Flash Foods made the decision it did. “Now that they’re coming around with EMV, if we had completed the debit upgrades, we’d still have to spend more money to make the pumps EMV capable,” Bullard said.
Years Away
From Bullard’s perspective, NFC is at least 3-4 years out, but something to look toward in the future. “The technology is coming,” she said. But others fear retailers will have to spend gobs of money replacing their terminals only to realize once they do, the technology is old hat and something new is around the corner.
“Visa’s EMV announcement is short-sighted and will be obsolete within the next 10 years,” Huber said. “Visa needs to offer a solution that solves the data security problem for the consumer, the merchant and the banks. Visa needs to open their eyes to companies like iTunes, Google and PayPal that are starting to offer solutions to consumers that protect credit card data through smart phone apps and other online wallets.”
Flash Foods is also looking into apps, even as it gets its new dispensers ready for EMV. “We are within our talks internally and we are looking at the apps and ways to incorporate that into our loyalty program,” Bullard said.
Huber said, retailers do want to move to chip, and toward the technology of tomorrow. “But stop asking us to repeatedly upgrade minor things and give us the major thing we are seeking. Retailers want technology that eliminates PCI, that provides online security, reduces fraud costs and gives us real fraud protection.”
