chip cards: emv updates for parking

CHIP CARDS – EMV UPDATESWhat does it mean for the U.S. Parking Industry?

Dave Witts, President of U.S. Payment Systems

9:15 a.m. CT, March 31st 2015

[email protected] linkedin.com/in/dwitts www.creditcall.com/emv-migration

EMV is Coming to the U.S.

• It’s been a long journey,

but Chip is finally coming

• So is the ability to make secure

contactless payments

• U.S.-issued EMV cards do exist!

https://www.creditcall.com/?utm_source=smart card alliance&utm_medium=ppt&utm_campaign=payments summit 2015



• Liability shift

• Fraud reduction

• EMV is the global

approach to security

Why is EMV Required?




Why is EMV Required

LOOMINGU.S. EMV LIABILITY SHIFT




Why is EMV Required

EVER EVOLVING

PCI DSS

REQUIREMENTS




U.S. Breaches in 2014

Logo 2014 # of Cards/Premises Affected

Breach cost

January 11 350,000 $4.1 million

January 16 100 million $148 million

January 27 2.6 million Not disclosed

February 2 160 hotels Not disclosed

February 27 400,000 Not disclosed

March 14 Not disclosed Not disclosed

March 17 25,000 Not disclosed

March 22 Not disclosed Not disclosed




Logo 2014 # of Cards/Premises Affected

Breach cost

May 14 51 stores Not disclosed

June 12 33 restaurants Not disclosed

August 600,000 Not disclosed

September 868,000 Not disclosed

September 9 56 million $34 million

October 9 Not disclosed Not disclosed

October 21 1.16 million Not disclosed

December 8 Not disclosed Not disclosed

U.S. Breaches in 2014




U.S. Payment Card Fraud in 2013

Source: Nilson Report




Number of U.S. Compromised Cards in 2014




% of all U.S. Cards Affected in 2014




Hackers & U.S. Card Data

• Almost half the world’s credit card fraud

happens in the U.S., despite being home to

only a quarter of all credit card transactions

globally

• The consistent onslaught of consumer data

breaches among major businesses

illustrates some of the main vulnerabilities

in magnetic stripe cards

• The U.S. is last power economy to migrate

to EMV making it an easy target, resulting

in both a shift in consumers’ perception and

confidence




The Proven Impact of EMV Adoption on

Payment Card Fraud in Other Countries

U.K. (introduced in 2004)

• Counterfeit card fraud losses have fallen and are at their lowest level since 1999

• Fraud on lost and stolen cards is now at its lowest level for two decades

• Losses at U.K. retailers have fallen by 67% since 2004

• Lost and stolen card fraud fell by 58% between 2004 and 2009

• Mail non-receipt fraud has fallen by 91% since 2004

Canada (introduced in 2008)

• Losses from card skimming in Canada fell from CAD$142 million in 2009 to CAD$38.5 million in 2012

Source: http://www.emv-connection.com/emv-faq/




U.S. EMV Card Industry Updates

• By beginning of 2014 financial

institutions had issued 20 million EMV

cards

• By end of 2014, this number had

increased to more than 100 million EMV

cards

• By October 2015, it is forecasted that up

to 450 million EMV cards will be in

circulation due to reissuing of cards to

customers

Source: PYMNTS

450m




The 5 Pain Points of EMV Migration

5

4

3

2

1





1 Choose Chip card reader, develop and perfect driver





2 Update processor interface to

support EMV messages

• Typically poor support from

processors

• Good working knowledge of EMV

required

• Takes between 90-180 days

development time





3 Go through M-TIP/ADVT/AEIPS test cycle





3 Go through M-TIP/ADVT/AEIPS test cycle

• Each Chip card reader & processor combination

requires various layers of brand certification

• Rinse and repeat for each processor

• Costly text cards and testing tools

• Typically 10-16 weeks in mature EMV markets

per processor

• Potentially longer in new markets due to

skill/resource shortages





4 Adapt or create a Terminal

Management System (TMS) solution

to support

• Chip card reader firmware

• EMV configuration

• Other transactional information





5 Certify for PCI P2PE

PCI The Payment Card Industry Data Security

Standard is a set of requirements designed to

ensure that ALL companies that process, store

or transmit credit card information maintain a

secure environment.

P2PE A solution that encrypts card data from the entry

point of a merchant's point-of-sale (POS) device

to a point of secure decryption outside the

merchant's environment.





5 Certify for PCI P2PE

• Ongoing process

• Typical spin up time 6 months

• Tends to be costly




The Risks of Non-Compliance

• High costs in fraudulent activity

• Potential legal action/costs

• Irreparable damage to reputation and

creditability

• Potentially punished with higher rates from

card companies and processors




• Customer experience – what changes?

• Card is inserted for the duration of the transaction rather than being swiped or dipped

• Dip and wait, rather than dip & read

• Chip and PIN

What EMV Means for Parking Operators &

Manufacturers




• Transaction timings – slower than a

magnetic stripe transaction due to

EMV transaction dialogue.

• Online authorizations are more or

less the same speed.


Manufacturers




• Signage to educate public - including

clear instructions & graphics

• Hardware for manufacturers

• Certification costs

• Decrease in fraud costs


Manufacturers




How to Overcome Technology Hurdles

• “The Manufacturers’ Dilemma”

Buy vs. Build (go it alone and develop

an in-house solution or buy off-the-shelf)

• Is it worth it for a manufacturer to build

their own solution?




Questions That Should be Asked of Your

Parking Equipment Suppliers and Operators

• What is your EMV Migration path?

• Do you need a new card reader?

• Will you be able to use your existing processor?

• What is your EMV Migration suppliers previous experience?

• What is your chosen Migration solution suppliers relationship with your processors?




Summary

1. Start NOW – EMV Migration can take up to 22

months, it won’t happen at the push of a button

2. Ensure the safest payment system possible by

combining EMV with P2PE

3. Don’t reinvent the wheel – partner with an

experienced EMV solution provider



If you have any questions, please contact:

Dave WittsPresident of U.S. Payment Systems

Creditcall Corp1133 Broadway, Suite 706, New York, 10010

www.creditcall.com

+1 609 339 9080

[email protected]

Dave.Witts59



chip cards: emv updates for parking

Technology

emv cards

debit cards source

data breach cost

disclosed 6logo2014

states source

credit cards white lodging

emv liability

big data breaches