Visa and MasterCard have set October 1, 2015 as the deadline for retailers across the U.S. to switch from the classic swipe-stripe credit card reader to an EMV system that reads chip-cards. The carrot is that the entire country will change over to the more fraud resistant chip system, bringing the U.S. into technological alignment with the credit cards used by the rest of the world. The stick is that retailers who don’t make the switch will be responsible for fraudulent charges. The migration to chip-card readers is part of a larger period of disruption in the world of consumer credit. With new technologies such as Apple Pay, Square, and GoPayment entering the market, retailers have more choices than ever before, but are also deeply dissatisfied with high fees and distrustful of banks and credit card companies.
We talk to some savvy retailers to bring you the information you need to make sure you’re ready for October 1, and informed about the new world of consumer credit technologies.
Why EMV?
EMV stands for Europay, MasterCard and Visa, the founding members of EMVCo, the group which establishes and regulates credit card chip technology. Unlike the magnetic stripe cards that are the norm in the U.S., EMV cards contain a chip (microprocessor) that validates the credit card during every interaction with the payment device, and uses encryption to secure the data. During a sales transaction, EMV is more secure than magnetic striped cards because of its technology, as well as how it’s physically handled. Sophisticated authentication protocols make it difficult to use skimmed card information, and the act of inserting the card into the device by the customer, rather than swiping the card by the retailer, means the card never leaves the customer’s possession.
Most of the world migrated to EMV around 2005, primarily to combat credit card fraud. As the rest of the world became more secure, with a typical drop in fraud of over 50% per country, credit card thieves have increasingly targeted the U.S. and its millions of vulnerable magnetic-stripe cards. While the need to switch is urgent, the task is herculean. With the October 1 deadline looming, there is a still a massive amount of work to be done to complete the transition to chip. The National Retail Federation (NRF) estimates that at the beginning of this year only about 8% of U.S. consumers had chip-enabled credit cards. Banks are expected to work to substantially increase those numbers, with industry projections putting the percentage of chip cards at between 50% and 60% by the end of this year.
New EMV Policy: What’s it Mean to Me?
Switching to EMV can be a simple process, or become more difficult and time consuming based on the size and complexity of the retailer’s POS system. “We did make an early transition to the chip technology in our store,” explained David Stoller, owner of Suitcases & More in Scottsdale, AZ, “but we have not done anything with those SquareApples or that GoQuick. We are pretty simple folk here.” Guy Paquette, director of corporate operations for Bagot Leather Goods, Luggage Plus in Kingston, Ontario, also found that for a business of his size, the change was easy. “Retailers should have no fear, because this should be a seamless conversion.” As Paquette recalls, “I use Chase, like many folks in the U.S.. I called them, they sent a technician that afternoon, and he plugged in my new machine.”
Larger retailers with customized POS systems may have the additional burden of certifying that their credit card processing systems meet EMVCo standards. However, for the vast majority of retailers, your payment processor has already taken care of EMV certification.
EMV on the Sales Floor
The switch to EMV will require some training, both of staff and of your customers. In order to run a card with a new EMV machine, first visually identify whether the card is a chip card. If it’s a stripe card, the EMV machines available to U.S. retailers also allow traditional swipe-authorization. If it’s a chip card, the customer will insert it into a slot in the bottom, front of the card reader, which points towards the customer, and leave it in the machine. The customer will follow the terminal prompts, and then complete the transaction either with a signature, or by entering a Personal Identification Number (PIN code), less common in the U.S..
According to QuickBooks.com, during the Canadian EMV migration a frequent problem was that many customers absent-mindedly left their credit cards in the machine at the end of the transaction (as many of us have done in older-style ATM machines). This is likely to be a problem during the transition to chip cards, since the busy holiday season comes right after deployment of the new EMV machines. U.S. retailers will need to take steps to remind harried and distracted holiday shoppers to withdraw their cards at the end of the transaction, either through signage or even humorous employee t-shirts.
Managing Fraud Risk
While credit card companies have made it clear that EMV machines are not a requirement, they have also stated that the October 1 deadline represents a liability shift from the credit card company to the retailer in cases of fraud. No one wants to be the source of a security breach affecting their customers, both from a public relations and a liability standpoint, so beyond the EMV requirement it’s important that the first goal of your payment and point of sale (POS) system is to protect your customers’ data.
Since switching to EMV in 2008, Canada saw a 40% reduction in fraud, according to QuickBooks.com. It’s unclear if the reduction in fraud in Canada is the result of adoption of EMV technology, or the concurrent change in Canadian laws protecting consumer privacy and security. “I’m a technology guy, so we got the new payment systems as they came out, just to give them a try,” explained Paquette. “Doing business in Canada, our primary concern is compliance with our government’s strict privacy laws. We first got a chip enabled credit card reader 10 or 12 years ago, and then invested in tap and pay technology [also called near field communication (NFC)] about six years ago. A year after that, in response to the Electronic Documents Act (PIPEDA), an amendment to the Privacy Act, we got rid of our tap and pay machine.” Fraud concerns and complying with PIPEDA also drove Paquette to restructure his POS system. “We separated our credit/debit system completely from our POS system to prevent any data breaches that would result in our customers’ credit card information being stolen.” Sam Hirsh, owner of Tripquipment in Falmouth, ME, believes Paquette’s security measures are important for U.S. retailers. “How do you protect yourself? By doing the most common sense things possible. We will never save credit card information,” stated Hirsh. The experience of Canadian retailers is of interest to U.S. retailers, who are frequently encouraged to adopt more and more integrated systems, which save credit card info, sales history and other consumer data, while also having the ability to push personalized promos out to customer’s smart phones. The promotional value of these integrated systems must be weighed against their possible vulnerability to hackers and credit card fraud.
As was the case during global adoption of EMV, fraud will most likely migrate to the least secure sales channel. Retailers without EMV card-reading technology may find themselves targets in the future. However, there is no reason to panic if you don’t currently have an EMV card reader. You have to take an actual EMV card (still not common) after October 1 that turns out to be fraudulent in order to create a liability situation. But do contact your card processor to create a plan to get yourself an EMV compliant machine as soon as possible.
Where is the Bottleneck?
Although news outlets have characterized the slow U.S. adoption of chip-card readers as symptomatic of unsophisticated U.S. retailers, the real problem lies elsewhere. Technology vendors and credit card processors are racing to get their services certified as being compliant, at the same time that larger retailers, health care companies, banks, airlines, and other credit card-dependent businesses are also trying to get certified. Chuck Weisbart from It’s…In The Bag! in Palm Desert, CA, echoed a common frustration: “Our processing company is waiting until the first of October. Our banks are the ‘financial gestapo.’ We would have had the chip readers years ago, but it was our banks that didn’t want to have to spend the moolah.” Hirsh is also experiencing vendor-related delay. “Our POS company sent us a note saying the chip-card readers were coming but not available yet. Meanwhile we’re getting offers every day from other processing providers offering chip machines and asking us to switch. But we like our POS system so we’re going to wait for them.”
Credit Card Controversy
In the rest of the world, EMV card readers require a PIN, rather than the signature cards that most U.S. banks will issue. The Mallory Duncan, senior vice president and general counsel of the NRF believes this is unfair. “Banks are adding a chip that makes the card hard to counterfeit but refusing to add the PIN that would ensure user legitimacy. Retailers are being required to cover the $25 to $30 billion cost of the new equipment. Why are they making us buy equipment that can do both, but refusing to do what they do in Europe and set up a system that does both?” Duncan asks.
Weisbart also has a beef with the length of time that it’s taken banks to issue chip cards in the U.S..
“You can tell the real traveler from the novice, as the real traveler has experienced refusal of their unchipped cards overseas. What is baffling is that a lot of our customers have called the big boys in banking, such as Bank of America, Chase, and Wells Fargo, and asked for a chipped card as they are going out of the country, and have been told that they cannot get them, and the consumer accepts that answer. Wait till the chipped card comes in the mail automatically in the next couple of months to hit the October deadline, and then see how much all these consumers trust their big boy banks.”
Swipe Fee Furor
Credit card processing fees are a continual source of merchant frustration. The biggest question travel goods retailers have about new credit is whether new technology and new options will disrupt the market enough that processing fees go down. The answer, at least so far, seems to be no. NRF estimates that current transaction costs run between 2% and 4%, although it can be difficult to track batch fees, statement fees, maintenance fees, data security compliance fees, monthly minimums and customer service fees on top of the non-negotiable interchange fees. Credit card fees are now the third or fourth largest expense for retailers, after rent and payroll. New technologies, such as PayPal Here and Square charge between 1.7% and 2.75%; on the lower end of the 2% to 4% fee range but likely not low enough to shake up the industry.
Outside the U.S. it’s possible to find tighter government regulation of interchange fees, leading to more money in retailers’ pockets. As an example, in 2003 the Reserve Bank of Australia cut credit card interchange fees in half. Organizations such as NRF and businesses like Walmart have been going after the credit card companies in the courts, although so far their efforts have not been fruitful. On Jan 20th of this year, the Supreme Court rejected a NRF challenge to debit card swipe fee rules. Duncan, speaking for a disappointed NRF, stated that the Supreme Court ruling “means retailers will keep paying billions of dollars more than they should, and that fee-hungry banks will continue to rake in unearned profits that ultimately come out of consumers’ pockets.” Duncan called for continued work lobbying for lower swipe fees: “Countries all over the world are significantly reducing interchange fees because they know these fees are a sweetheart deal for big banks and an unfair burden for merchants and consumers.” Whether we ultimately choose smart wallets, tap and pay, swipe or chip, that is legislation we can all support.
Pick Your Features and Make Your Move
Many businesses will opt to swap their non-EMV terminal for an EMV-compatible one, to keep it simple and keep their costs down. One wise upgrade would be to make sure your new EMV terminal is both signature and PIN capable. Although most U.S. consumers will initially receive chip and signature cards now, chip and PIN cards are coming in the future. And if you have significant number of international customers, you’ll need that PIN capability. It could make the difference between closing a large sale, or not.
This may also be the time to upgrade your current system to one with inventory or customer loyalty tracking, although that adds a level of potential security risk. You could opt for a machine that also takes mobile or contactless payment, such as Apple Pay, by using NFC. Contactless EMV payments allow customers to tap their card against the terminal (as with a mobile wallet) which can significantly speed up transactions. If you have very busy periods, this could make a big difference to the length of the line at the cash register and the overall transaction experience for your customer. Ricki Subel, Marketing Manager for central U.S. chain Landmark Luggage, states that “we have integrated Apple Pay at one of the stores. We are interested in modernizing our operating systems in general, as well as being ahead of the curve to suit the needs of our customers and comply with consumer trends. There have been some technical issues on the behalf of both the system hardware and the user fluidity, but we are working through those in an effort to be able to bring Apple Pay to all stores who are very willing and excited to try it.”
Bottom line? We’re in the VHS and Betamax era of new credit and we don’t know who is going to come out on top. The name of Chase’s new terminal, Future Proof, sums up the uncertainty of current payment practices. It accepts swipe-type debit and credit cards, works for both PIN and signature inserted chip cards, and accepts both mobile wallet payments and contactless chip-card transactions. When making decisions about new credit, think about your customer demographic, make your best prediction of what payment technology will gain popularity in your region, and try to keep your contracts and systems flexible to respond to change.