A new service from Visa helps issuing banks get a security boost from chip-cards without the costly and time-consuming technology investments that would normally be required.
Visa cards that use the EMV chip standard have a special code called an iCVV, which is submitted with each transaction to prove the card's legitimacy. This code serves the same purpose as the card verification value written to a magnetic-stripe card, but it has a different value — so the bank systems designed to handle regular CVVs cannot normally handle iCVVs in their place.
Visa's iCVV Convert service, which it is expected to announce Monday, is designed to save U.S. banks time and money as they shift to the EMV chip-card standard that is common in other countries. Visa's service converts the iCVV to a CVV before sending it to the issuer.
Issuing banks "don't have to worry about the added complexity of supporting keys to generate and validate another CVV value. They can just use the same CVV system that they're using today," says Stephanie Ericksen, Visa's head of authentication product integration.
"It's faster, there's less development time … and it's much less expensive for them to do," she says.
Visa is also updating its Chip Authenticate service, which validates a separate cryptogram used by EMV cards. Visa has offered a version of this service for about 10 years, and most EMV-card issuers that enroll in the service stay with it, Ericksen says.
State Employees' Credit Union, one of the few issuers of EMV cards in the U.S., uses the Chip Authenticate service. Visa would not say which other issuers use the service. Visa requires the use of an iCVV code with EMV cards issued in the U.S.
In the past 18 months, a million Visa EMV cards have been issued in the U.S. Most EMV cards issued to U.S. citizens are offered to travelers to use in countries where the standard is widespread.
Merchant acceptance of EMV cards in the U.S. remains low. Visa has set deadlines for merchant acceptance, though merchants have expressed some concern over whether the cards will use the same level of security in the U.S. as they do overseas. EMV cards are called chip-and-PIN cards because they are commonly used with a PIN. However, Visa and MasterCard have said that a PIN is not necessary in the U.S., and some issuers have already forgone PIN codes for their cards. (Though MasterCard does not explicitly require a PIN, its liability policies make it likely that issuers and merchants will support PIN to avoid paying for fraud losses).
