The journey to align U.S. payments processing security standards with those in most of the rest of the world has all the appearances of progress: "inevitable" is the word most often heard in connection to EMV chip card, and MasterCard and Visa have set what seem to be migration deadlines.
Yet for card-issuing banks, there's still a frustrating lack of clarity that's requiring a U.S. migration strategy reliant on contingencies and agility. The banks know the standards are coming, but still don't know exactly what they'll look like.
What is clear is that the magnetic stripe-dominated payment system is on its way to the museum and will be replaced by a standard to be named later that links mobile, Web, point of sale and contactless payments requiring vast IT adjustments that impact both processing and security.
"Mag-stripe is 50-year-old technology," says David Porter, a general manager for JPMorgan Chase & Co. "We look at the swirl of things going in payments, such as RFID, Isis, Google Wallet, Visa Wallet, etc. ... However long it takes, it will settle on the next universally updated payment methodology in the U.S., which we still don't know at this time."
Successfully navigating the new processing maze depends on harnessing the growth of two payments components that feed off one another–Near Field Communication-enabled contactless payments, and pressure from retailers and card networks to apply EMV payment card security in the U.S.
EMV is not regarded as foolproof; studies have shown EMV cards to be susceptible to man-in-the-middle attacks. But the standard is considered safer than mag-stripe cards because they are more difficult to counterfeit.
While EMV migration creeps into the U.S., NFC-enabled payments also are starting to take shape as card networks, telecommunication companies and handset manufacturers target the market with mobile wallets. The conversions of payment terminals to accept contactless payments in the U.S. are expected to include EMV migrations.
The problem is that no ubiquitous NFC model and EMV model for all merchants and issuers to use for processing payments has emerged, affecting interoperability, slowing conversion and requiring IT execs such as Porter to engage in multiple strategies–continuing old payment methods while preparing for contactless and EMV in some future form.
"It's not clear how it will evolve," Porter says. "We have to be sure to be prepared in the back office and make sure our systems can process mag stripe, EMV or contactless payments."
But both contactless and EMV standards are being hamstrung by the fact that in the U.S they really aren't standards in the way that word is usually used.
The lack of collaboration among stakeholders in the NFC payments market is well documented, as telcos and handset manufacturers both have their own preferred method of delivering mobile payments. But Porter says there are lingering differences on the EMV front.
Issuers, merchants, card firms and regulators in the U.S. still aren't on the same page, mostly over liability, the burden of terminal conversion and simple politics.
What made EMV work when it was rolled out in the UK, for example, was the joint effort of a government mandate, bank users and the associations, which collaborated on an aligned system, Porter says, adding that these groups worked with merchant associations and hardware manufacturers to put EMV in place. "Those are four or five different disconnected bodies, but there was momentum to push it. The alignment of interests right now in the U.S. is not apparent, for whatever reason. For the final standard to emerge there will have to be alignment."
What do you think about this? Send us your feedback.
