For Many Restaurants, EMV Won't Be on the Menu

The migration to EMV-chip cards is proceeding at a slow crawl at many merchants. But in the restaurant industry in particular, many proprietors see it as an unnecessary ingredient.

Though there are some examples of large chains or food courts going past EMV to implement mobile and tablet-based payments, many restaurants still rely on the charm and familiarity of taking orders on a paper pad and accepting payments as cash or a swiped card.

This has even led to some hybrid situations such as Waffle House, which resisted a full overhaul of its ordering process when it added tech from NCR. Even the NCR tech was a compromise; the chain put in NCR Silver to address the slowdown introduced to its payment process when it began accepting credit cards in 2006.

With such a mindset prevalent at many regional and local eateries, it's likely that many will delay their EMV upgrades "until there is a need for a technology upgrade across their full solution," said John Pearson, NCR's chief information security officer for hospitality.

The major card networks set an Oct.1 deadline for EMV adoption at most U.S. companies. After that deadline, those that do not support EMV-chip cards face a shift in fraud liability.

And as much as NCR Hospitality would like to sell more terminals, Pearson says that it might not make sense for merchants to rush to install the new systems just because of the looming deadline. He has advised hospitality merchants to closely weigh their upgrade costs against their actual chargeback history before committing to an upgrade.

"If history is any guide, the EMV shift will take several years for full conversion and standardization. I believe if you have a dollar to spend on upgrading your POS system, you first want to spend it on security such as improved firewalls and point-to-point encryption, second on compliance, including EMV, and finally on streamlining payment transactions," Pearson said.

NCR Hospitality points out in its "EMV Myths Debunked" report that implementing EMV is not a government regulation, nor is it needed to comply with Payment Card Industry security standards.

Most importantly, implementing EMV alone does not protect a restaurant payment network from being hacked. NCR recommends data encryption to complement EMV cards.

"EMV alone adds only marginal security to the payment process," Pearson said. "Solutions like point-to-point encryption and mobile wallets add much greater security."

All added up, there are many challenges to the economics of EMV in restaurants, said Thad Peterson, senior analyst with Boston-based Aite Group.

"Aside from low chargebacks, table service restaurants need to figure out how to manage EMV pay-at-the-table, since the server won't be able to take the card back to the POS terminal to make the transaction happen," Peterson said.

Terminal technology will play a key role in the transformation of restaurant payments, whether those terminals are prepared for EMV or not.

Wireless terminals are common in Europe, making EMV payments at a restaurant an easier task because the devices can be moved from table to table. But those terminals are rare in the U.S., Peterson said.

Seeking a solution, TableSafe and Creditcall revealed an arrangement earlier this year in which they would provide EMV-ready mobile point of sale software for full-service restaurants, allowing EMV card acceptance at tables. Whether such a method can become widespread in the U.S. is difficult to predict.

A more noticeable trend for restaurants has been to seek convenience and security answers through consumer-initiated mobile payments. One example is the iPad-based ordering system at the La Guardia food court operated by OTG; this system is built on NCR's self-checkout technology.

Late last year, OpenTable released a mobile payment app in the Washington, D.C. area allowing iPhone users to pay their restaurant bills through a linked credit card and bypass the standard settling of the tab in handing a card to a waiter.

Regardless of which way restaurant owners decide to go with EMV, the card networks' liability shift will change the way merchants have to weigh their fraud concerns against their technology investments.

"It's not so much about when is a good time to convert, it's more about mitigating risk," Pearson said.

Restaurant owners wanting to meet the October deadline need to get equipment in place, get EMV certified and train employees for the changes.

Those who choose not to implement EMV in time will have to determine their risk "by looking back at financials and quantifying the amount of chargebacks they had for a given time period," Pearson said. "They can then compare this cost to that of implementing EMV and make a decision on whether to move forward or not."

If restaurants choose to wait to deploy EMV, they will not be alone; the card networks gave the petroleum industry an October 2017 deadline for upgrades, Pearson noted. Thus, restaurants should not be singled out as a weak link.

Even if restaurants do not conclude that EMV will offset enough fraud to justify the cost of the upgrade, consumer perception may push them to support EMV anyway.

"As EMV becomes more commonplace in the retail environment, consumers are going to perceive that transactions that do not use the chip are less secure and will raise the issue with merchants who are not implementing EMV," Aite's Peterson said.