The journey to align U.S. payments processing security standards with those in most of the rest of the world has all the appearances of progress: "inevitable" is the word most often heard in connection to EMV, and MasterCard and Visa have set what seem to be migration deadlines. Yet for card-issuing banks, there's still a frustrating lack of clarity that's requiring a U.S. migration strategy reliant on contingencies and agility. The banks know the standards are coming, but still don't know exactly what they'll look like.
What is clear is that the magnetic stripe-dominated payment system is on its way to the museum and will be replaced by a standard to be named later that links mobile, Web, point of sale and contactless payments requiring vast IT adjustments that impact both processing and security.
"Mag stripe is 50-year-old technology," says David Porter, a general manager for JPMorgan Chase. "We look at the swirl of things going in payments, such as RFID, ISIS, Google Wallet, Visa Wallet, etc. ... However long it takes, it will settle on the next universally updated payment methodology in the U.S., which we still don't know at this time."
Successfully navigating the new processing maze depends on harnessing the growth of two payments components that feed off one another - near field communication-enabled contactless payments; and pressure from retailers and card networks to apply EMV payment card security in the U.S.
EMV refers to Europay, MasterCard and Visa - a global standard for security chips in payment cards that is widespread in other countries, but just beginning to make inroads into the U.S. after years of reluctance due to the cost of changing payment terminals to accept chip payments. EMV is not regarded as foolproof - studies have shown EMV cards to be susceptible to man-in-the-middle attacks - but is considered safer than mag stripe cards because the cards are harder to counterfeit. While EMV migration creeps into the U.S., NFC-enabled payments are also starting to take shape as card networks, telecoms and handset manufacturers target the market with mobile wallet solutions. The conversions of payment terminals to accept contactless payments in the U.S. are expected to include EMV migrations.
The problem is that no ubiquitous NFC model and EMV model for all merchants and issuers to use for processing payments has emerged, impacting interoperability, slowing conversion and requiring IT execs like Porter to engage in multiple strategies - continuing old payment methods while preparing for contactless and EMV in some future form. "It's not clear how it will evolve," Porter says. "We have to be sure to be prepared in the back office and make sure our systems can process mag stripe, EMV or contactless payments."
While the scant U.S. EMV adoption so far has been for travel cards, substantial migration will eventually come from card network and retail pressure.
Wal-Mart has been pushing for EMV adoption for years, and Visa and MasterCard are also pushing EMV in the U.S. By October 2012, Visa says any eligible merchant that accepts 75% of its yearly Visa transactions via chip-enabled tereminals that support both contact and contactless chip transactions will not have to annually validate compliance with Payment Card Industry Data Standards. By April 2013, acquirer-processors and subprocessors must support chip transactions, and by October 2015, liability for fraudulent transactions on chip cards will mostly fall on merchant acquirers instead of issuers, if the merchants don't have chip-accepting terminals. For MasterCard, ATMs in the U.S. will have to accept EMV cards as of April 19, 2013.
Discover is also pushing EMV migration - though there are differences. MasterCard and Discover are pushing Chip and PIN, citing security, while Visa's Chip approach says online processing removes the need for the offline authentication of Chip and PIN.
"The changes in liability will push the risk back out to retailers and will force them to react by accelerating the swap-out in the terminals," says Ron Shevlin, a senior analyst at Aite Group.
While uncertainty surrounding consumer demand and prevailing tech models for NFC mobile payments and mobile wallets remains, the argument is that merchants that upgrade payment terminals to accept mobile payments will add EMV acceptance capabilities at the same time.
"The contactless part is very important," says Zilvinas Bareisis, a senior analyst at Celent. "The link between contactless terminals and EMV payments ensures that not only are these terminals accepting chip payments, but it's a way to ensure they are paving the way for mobile payments as well."
But both contactless and EMV standards are being hamstrung by the fact that in the U.S they really aren't standards in the way that word is usually used.