ST. PETERSBURG, Fla.-The march toward EMV continues, but as one meeting here made clear, credit unions remain unsure at what point they should jump in.
That every credit union will need to adopt the EMV standard in plastic cards is not in doubt. But questions remain around costs, production lead times, roll-out, making an ROI business case to the board. Another big unknown: merchants and retailers will be big drivers, yet those industries are also in flux and uncertain.
During CSCU's Solutions Conference here, a panel of experts offered both a broad outline as well as some specifics on how credit unions should best proceed. But the panelists acknowledged that many are concerned they will be making big investments in EMV at the same time the standard will be leapfrogged by other payment methods.
"A lot of people asking should we be paying for this migration to EMV when, with all the talk about mobile and QR codes, other technologies may leapfrog EMV," said Kim Lawrence, head of consumer product initiatives and platforms with Visa. "We estimate that in five years that 75% of the current payments will still originate with a card, so it's relevant."
EMV is relevant for another reason, suggested Lawrence: "EMV is a proven way to fight card fraught. Dynamic data provides a foundation for secure innovation."
EMV, which stands for Europay, Mastercard Visa, is a set of standards that support global interoperability on chip-based transactions. EMV is effective at reducing fraud in card-present transactions and it is impossible to counterfeit. But
While Europe and Canada have made great strides in adopting EMV, progress has been slower in the U.S. due to complexity of the market and costs. Nevertheless, U.S.-based issuers have less than four years to meet EMV compliance deadlines from Visa and Mastercard. Visa, said Lawrence, is urging is stakeholders to take a "learn, plan, monitor and deploy" approach.
Answering Five Key Questions
Bastian Knoppers of FIS said he recognizes the key question from boards of directors when it comes to EMV is "Why are we doing this?" The answer, he said, lies in the why, the what, the when, the how and the who."
The Why: "Where's the business case? Where's the ROI? Fraud? My guess is you are not looking at high costs in fraud and skimming. The why is because of the dates and incentives that have been set by Visa and Mastercard, which has changed the rules from a payments standpoint. The ROI on EMV is not something the board is going to see as a typical three-year ROI. The why is going to be more in the 7-10 years, and probably closer to 10."
The What: What form EMV will take in the U.S. remains unknown, said Knoppers. Issued to be settled include debit (single debit AID issue); dual interface (contact vs. contact/contactless); Online PIN vs. Chip & PIN; Online only vs. Off-line transactions; Operating platform (Multos? Java? Native?); Card profile; Mobile (NFC payment strategy), and ATMs.
The When: "The key issue is the debit issue. But even if answered tomorrow, does it really make sense to implement EMV and start issuing cards? No. Because there really aren't many terminals out there in the U.S. The member communication and education piece is absolutely critical to implementation, and if there's no place for them to use it, why issue?"
The How: The key questions here include whether to mass reissue, or reissue on the monthly expire cycle. Should it be centralized or an in-branch issuance? "Probably one of the key factors of success we've seen in other countries is an orderly process of issuance. Managing that in a careful and controlled, deliberate manner is key."
The Who: With international users is there an issue? How bad is it? What is the cause? What about differences between credit and debit? What are the options to manage the issue? "For the next 12-18 months you need to do a lot of homework, understanding the questions around EMV, and really putting your plan together," said Knoppers.
Just What Is It?
What is an EMV smartcard? As Docia Myer of CPI explained, it's a smartcard that has a chip in it. It's a plastic card with a silicon chip/module and, if contactless, an antenna. Other possible features include a signature panel, mag stripe, embossed and a hologram. There are a number of ISO standards that define the principal standard for making controlling and testing smart cards.
There's a marketing issue to keep in mind, cautioned Myer. "The key thing to know is the position of the chip on the card to determine if there is opportunity to refresh your brand. What if you let members customize cards (with images), and that chip is right on the face of their grandmother?"
"Choosing the correct platform means understanding what does the credit union want to issue," continued Myer. "What applications does FIS support? What does the CU's roadmap look like, short and long term? Is there a price requirement/budget? The buying cycle and production lead times are much longer on a chip card than on a traditional mag stripe card, so you need to have a longer planning horizon."
A North-of-the-Border Lesson
The Canadian Imperial Bank of Commerce was the first in that country to roll out EMV cards, distributing more than seven-million between 2007 and 2010. CIBC's Steven Fodor said one not surprising development has been the migration of fraud. Fraudsters are now concentrating on the card-not-present space, such as mobile and online.
"Sixty percent of losses now are card-not-present," said Fodor. "But that is charged back to the merchant, so your gross fraud could be higher, but your net fraud will be lower." He added that that doesn't mean a reduction in fraud management staff.
Fodor offered four best practices when it comes to chip-card rollout:
1. Use collaboration. "A chip rollout plan ensures success for ALL stakeholders. You do not want all your cards rolled out at the same time. You must time chip rollout with normal re-issues to reduce non-receipt fraud risks. You should stagger the mailing of PIN and chip."
2. Understand and track chip a authorization date, which is critical for longer-term success.
3. Education is key. "Employees need 'just in time' training on how to monitor chip transactions. Employees require role play training for chip customer loyalty conversations."
4. PIN Adoption. "Protect your purchase volume. Have a robust PIN reset program and let people use the same PIN for debit and credit."
