Discover Favors More Security for U.S. EMV Migration

Payments processing innovation isn't coming easy to the U.S., where even attempts by card companies to move forward on new security standards come in different shades.

Most recently, Discover has followed Visa and MasterCard to issue EMV mandates for acquirers and direct-connect merchants in the U.S., Canada and Mexico. However, there are subtle differences, mostly in that Discover and MasterCard prefer a form of security that's different from Visa preference in the North American market. EMV refers to Europay, MasterCard and Visa — or the use of embedded chips to secure card payments. EMV is widely used overseas, and plans for a U.S. migration are underway.

Discover has set an April 2013 EMV mandate to acquirers and direct-connect merchants. It says it will support all card authentication channels, including online and offline; all verification methods, including chip-and-PIN and chip-and-signature; and contact and mobile payments. Discover says liability rules will be defined in the coming months. Visa says that by April 2013, acquirer processors and sub processors must support chip transactions, and by October 2015 liability for fraudulent transactions on chip cards will mostly fall on merchant acquirers instead of issuers, if the merchants don't have chip accepting terminals. MasterCard says U.S.-based ATMs will have to accept EMV-enabled cards as of April 19, 2013.

Visa says that instead of a blanket mandate on any specific cardholder verification method, Visa has left the choice of cardholder verification method to card issuers and the merchant accepting the transactions. The card firm said it continues to support a range of cardholder verification methods for all Visa products including signature, PIN and no-signature for low-value, low-risk transactions. Visa says that while PIN does have utility in verifying the legitimate cardholder is in possession of the card, PIN remains a static data element and when stolen in conjunction with cardholder account information creates an increased risk for ATM fraud. The card firm says that when PINs are compromised, fraud occurs at the ATM, not the point of sale, and that fraud trends must be viewed across the entire payment system, and not just a single channel or segment.

While the goals of the three firms would appear to be the same — get U.S. merchants and issuers to join the rest of the world and offer EMV payments — there are subtle differences. New card verification technology is coming in slightly different technology flavors, requiring banks to prepare to process payments for different versions of what would appear to be the same standard.

"They aren't fully in agreement," says Brian Riley, a senior research director for TowerGroup, who spoke with BTN as part of a report on payments processing that will run in the April issue.

The differences in verification, such as chip-and-PIN or chip-and-signature, have been the subject of much debate over the past year as U.S. banks prep for EMV. Chip-and-PIN requires an authentication number to execute payments; while chip-and-signature does not require the PIN and is considered faster. MasterCard and now Discover are nudging toward chip-and-PIN; while Visa says online payment processing makes chip-and-PIN less necessary. But the controversial debate has all three firms leaving options open and choosing words carefully.

Troy Bernard, global head of chip payments for Discover, says the card company isn't explicitly mandating a specific verification — in fact the firm touts its flexibility in that matter. But Bernard does say "security is paramount and the greater security is where we'd like to get to. That would lend itself to chip-and-PIN."

A MasterCard spokesperson told BTN that its current preference is for chip-and-PIN, which it calls "the more secure approach," but that position could evolve.

"Visa allows you to process low-value transactions faster. The tradeoff is the security of the PIN …While MasterCard's option is more secure at the point of sale, Visa's is quicker at the point of sale. Both options are used throughout the world," Riley says.

In a blog on its site, Visa contends that in the U.S. online processing enables transactions to be transmitted in real-time to the issuer for approval. "One thing that's clear from the questions is that there's a lot of confusion around the myth that EMV means 'chip-and-PIN.' It doesn't in many countries, including the U.S."

"We are supportive of chip cards from the most simplistic point of view, getting the cards out there that have dynamic data with the ability of enhancing that data, but not burdening issuers with complexity. Online-only chip cards are less expensive, less complex to personalize and less complicated from a key management point of view," says Stephanie Ericksen, head of authentication and product integration for Visa, who spoke with BTN in an interview.

Erickson and Bernard say the differences between the EMV roadmaps from the card firms should not impact interoperability.

"My first reaction to the interoperability question would be no — EMV is a toolbox and allows for different types of cardholder and verification methods," Bernard says. "I think that some of the debate isn't so much about chip-and-PIN versus chip-and-signature that it is about offline and online card validation. That is where some more needs to happen …one consideration that an issuer needs to make is about terminals that work online and offline. For a bike rack in Paris, if I use chip-and-signature there is no cashier to take my signature and capture and store it, so the PIN is needed. But in the U.S., 30 percent of merchants have PIN pads, so that's another consideration. There are arguments to be made each way."