EMV in Limbo

The journey to align U.S. payments processing security standards with those in most of the rest of the world has all the appearances of progress: "inevitable" is the word most often heard in connection to EMV, and MasterCard and Visa have set what seem to be migration deadlines. Yet for card-issuing banks, there's still a frustrating lack of clarity that's requiring a U.S. migration strategy reliant on contingencies and agility. The banks know the standards are coming, but still don't know exactly what they'll look like.

What is clear is that the magnetic stripe-dominated payment system is on its way to the museum and will be replaced by a standard to be named later that links mobile, Web, point of sale and contactless payments requiring vast IT adjustments that impact both processing and security.

"Mag stripe is 50-year-old technology," says David Porter, a general manager for JPMorgan Chase. "We look at the swirl of things going in payments, such as RFID, ISIS, Google Wallet, Visa Wallet, etc. ... However long it takes, it will settle on the next universally updated payment methodology in the U.S., which we still don't know at this time."

Successfully navigating the new processing maze depends on harnessing the growth of two payments components that feed off one another - near field communication-enabled contactless payments; and pressure from retailers and card networks to apply EMV payment card security in the U.S.

EMV refers to Europay, MasterCard and Visa - a global standard for security chips in payment cards that is widespread in other countries, but just beginning to make inroads into the U.S. after years of reluctance due to the cost of changing payment terminals to accept chip payments. EMV is not regarded as foolproof - studies have shown EMV cards to be susceptible to man-in-the-middle attacks - but is considered safer than mag stripe cards because the cards are harder to counterfeit. While EMV migration creeps into the U.S., NFC-enabled payments are also starting to take shape as card networks, telecoms and handset manufacturers target the market with mobile wallet solutions. The conversions of payment terminals to accept contactless payments in the U.S. are expected to include EMV migrations.

The problem is that no ubiquitous NFC model and EMV model for all merchants and issuers to use for processing payments has emerged, impacting interoperability, slowing conversion and requiring IT execs like Porter to engage in multiple strategies - continuing old payment methods while preparing for contactless and EMV in some future form. "It's not clear how it will evolve," Porter says. "We have to be sure to be prepared in the back office and make sure our systems can process mag stripe, EMV or contactless payments."

UNDER PRESSURE

While the scant U.S. EMV adoption so far has been for travel cards, substantial migration will eventually come from card network and retail pressure.

Wal-Mart has been pushing for EMV adoption for years, and Visa and MasterCard are also pushing EMV in the U.S. By October 2012, Visa says any eligible merchant that accepts 75% of its yearly Visa transactions via chip-enabled tereminals that support both contact and contactless chip transactions will not have to annually validate compliance with Payment Card Industry Data Standards. By April 2013, acquirer-processors and subprocessors must support chip transactions, and by October 2015, liability for fraudulent transactions on chip cards will mostly fall on merchant acquirers instead of issuers, if the merchants don't have chip-accepting terminals. For MasterCard, ATMs in the U.S. will have to accept EMV cards as of April 19, 2013.