MasterCard’s ‘Road Map,’ Including Merchant Incentives, Lifts Industry Hopes for EMV

Ever since Visa Inc. released a major policy statement in August regarding chip cards in the United States, observers have waited for the other shoe to fall from competing card networks, especially Visa’s biggest rival, MasterCard Inc. That void began to fill in late on Monday with MasterCard’s release of what it calls a “road map” for EMV in the U.S. EMV refers to the standards governing cards equipped with microchips, which are generally regarded as more secure than conventional magnetic-stripe cards.

n

MasterCard’s new policy, and especially its inclusion of new adoption incentives as well as its endorsement of a crucial implementation timeline set forth by Visa, appears to have lifted hopes for the establishment of U.S. EMV, at least in the short run.

n

In particular, MasterCard will offer incentives to merchants that will favor EMV with PINs at the point of sale. And it will adopt and expand upon a Visa program that offers relief from audit requirements for the Payment Card Industry data-security standard (PCI). In addition to audit relief, the network will offer to reduce, and eventually eliminate, certain costs merchants must bear that are related to data breaches provided those merchants have adopted EMV.

n

Shares of VeriFone Systems Inc., the No. 1 U.S. terminal vendor and a company that would be expected to benefit from merchants’ replacement of current point-of-sale devices with EMV-capable terminals, shot up 8% in mid-day trading Tuesday.

n

Monday’s statement says that MasterCard will have “an immediate focus” on working with acquirers to make sure they are ready to support so-called dynamic authentication by April 2013, the deadline set out by Visa six months ago. This technology provides for a unique cryptographic identifier with each transaction, theoretically eliminating the chance fraudsters could counterfeit cards for point-of-sale use.

n

But MasterCard’s policy also provides for an indirect incentive for PINs to be used with EMV chip cards for authentication, a topic Visa did not touch on directly in its August release. While MasterCard is not mandating the use of either signatures or PINs, it will introduce what it calls a “liability hierarchy” in which the cost of fraud from lost or stolen cards will fall upon “whichever party adopts the less secure approach,” says Colin McGrath, senior business leader for market development at MasterCard.

n

In practice, this means merchants that install EMV terminals with chip-and-PIN capability will not be liable for lost-or-stolen fraud that occurs on EMV chip-and-signature transactions, effective October 2015, McGrath tells Digital Transactions News. In that scenario, “the issuer bears the cost of the fraud,” he says.

n

Visa’s U.S. timeline sets Oct. 15, 2015, as the date when liability for fraud losses will shift to acquirers, and by extension to merchants, if a customer presents a contact chip card for payment, the merchant hasn’t installed a chip-capable terminal, and the transaction later proves to be fraudulent. Petroleum marketers have until Oct. 1, 2017.

n

MasterCard’s stance on chip-and-PIN follows by nearly three weeks a set of EMV prescriptions from the Merchant Advisory Council, a Minneapolis-based trade group representing major retailers, airlines, and service providers. The MAG’s policy includes full-throated endorsement of chip-and-PIN. By contrast, U.S. banks that have issued EMV cards so far (chiefly to overseas travelers) have tended to favor chip-and-signature, arguing that signature authentication is more familiar to cardholders.

n

To speed up deployment of chip-enabled terminals, MasterCard’s statement says the network will provide for “true financial benefits” to merchants that install the devices.

n

Among these benefits will be relief from PCI audits, following Visa’s policy. In its August policy release, Visa extended to the U.S. a program that relieves merchants of the need to certify PCI compliance if they generate at least 75% of their Visa transactions from EMV-compatible devices.

n

Visa’s incentive, which still requires merchants to meet the requirements of PCI and also to accept contact, contactless, and near-field communication (NFC)-based mobile transactions, will take effect Oct. 1.

n

But MasterCard plans to go beyond that incentive with another that takes effect at the same time. It will reduce by 50% a merchant’s liability for card-reissuance and fraud costs in the case of a data breach if the merchant processes at least 75% of its transactions on terminals capable of both contact and contactless EMV, says McGrath. Effective October 2015, it will extend 100% relief of those costs if the merchant is processing at least 95% of its transactions on the EMV devices.

n

While a number of details remain in abeyance, observers see hopeful signs in MasterCard’s EMV statement. “This announcement will definitely have an effect,” says Annmarie D. (Mimi) Hart, chief executive of Seal Beach, Calif.-based payments vendor MagTek Inc., in an e-mail message to Digital Transactions News reacting to MasterCard’s announcement. “Visa on its own cannot move the U.S. to chip.”

n

Hart points out, however, that even with all its advantages EMV with dynamic authentication does not protect against online fraud, which has been found to rise in regions where EMV for POS and ATM transactions has already been introduced.

n

Indeed, some industry observers, while expressing hope that MasterCard’s policy, coupled with Visa’s, will lend impetus to EMV in the U.S., caution that much depends on the remaining details. “There appears real policy momentum for EMV,” says a statement e-mailed to Digital Transactions News from Paul Tomasofsky, president of the Secure Remote Payment Council, a trade group representing online and mobile players. “But, we must not get carried away yet. There is a lot of work to do.”