Today, new technology allows for a variety of options to make purchases. Although the payments security industry has made great strides in order to keep up with this growth, there has been a steady rise in identify theft and fraud. For example, in the UK in the early 21st century as the practical limit of security measures that could be applied to magnetic stripe cards was reached, counterfeit or cloned credit and debit cards used at automated teller machines (ATMs) and point of sale (POS) terminals led to huge losses.
To overcome this challenge, security and risk management experts from Europay, MasterCard and Visa devised a set of specifications, now known universally as EMV, with the primary goal of creating a globally-interoperable and highly-secure payment card standards to combat fraud for face-to-face transactions, based on chip card technology. A chip card utilizes an embedded tamper-resistant ‘microprocessor’ that protects the cryptographic keys and sensitive cardholder credentials necessary to perform a payment transaction. It is significantly more secure than the magnetic stripe on traditional cards and has the capability to evolve to meet new threats against next generation payment methods, including contactless and mobile payments.
The origin of EMV
To provide succinct specifications, EMVCo was formed as the organization to oversee and manage the testing and approval process to facilitate global interoperability at ATM and POS - covering payments using EMV-based contact cards, contactless cards and mobile NFC devices.
Although the original EMV specifications were developed exclusively by the founding payment systems, the expertise of the wider payments industry (banks, acquirers/processors, technology vendors etc.) is now being leveraged through the business associates, technical associates and subscriber forums. This ensures open specifications with widespread peer review that can be used royalty-free in market verticals outside of payments, enabling other transaction-related activities to adopt the best practices of the card payments industry.
The organization’s board now includes all the major payment systems, American Express, Discover, Union Pay, JCB, MasterCard and Visa. The latest members, Discover and Union Pay, joined in 2013 creating strong representation from the US and China regions respectively.
The market impact of EMV
The implementation of EMV is a proven measure in dramatically reducing counterfeit card fraud through chip technology. Chip cards are not practical for fraudsters to clone, unlike the legacy magnetic stripe payment cards. When coupled with PIN verification, EMV also helps eliminate much of the fraud associated with face-to-face transactions involving lost or stolen cards. Flexible risk management allows for the ability to securely authorize payments offline (particularly for circumstances where an online connection may not be feasible), yet another benefit not possible with magnetic strip cards. Issuers have the capacity to create risk profiles down to individual cardholder or card level, with the ability to make updates dynamically without having to re-issue the card.
Worldwide adoption of EMV
Data published by EMVCo for the period ending in Q4 2012, indicates that EMV continues to gain momentum with more than 1.6 billion cards in circulation (representing just under 45% of all payment cards) and 23.8 million EMV-capable POS terminals (representing over 75% of the total terminal population).
Deployment varies considerably by region with the adoption rate in Europe exceeding 80% for both cards and terminals. Europe, Middle East, Africa, Australia and Latin America have converted more than 50% of their terminals to accept EMV card but the card rollout on average is lagging behind, in some countries as low as 15%. In North America, Canada is progressing well with its EMV rollout, however the US is only just starting the process.
The US has been hesitant to adopt EMV mainly because of the significant investment required especially by issuers, acquirers and merchants. In addition, magnetic stripe fraud is being kept to ‘acceptable levels’ by using online authorization for the vast majority of transaction, coupled with widespread adoption of fraud monitoring/detection systems. Unlike the UK, the US has no organization to mandate EMV policies and as a result it is left to voluntary industry collaboration with organizations such as the EMV Migration Forum playing a leading role.
Looking ahead
While the most obvious benefit is the proven record of preventing fraud, there are a host of other reasons for all countries to standardize on EMV for its payments cards. The transition would facilitate global interoperability and enable a timescale to be agreed to phase magnetic stripe acceptance. EMV would also provide a platform for future mobile payments including Mobile NFC which uses EMV technology and the same basic key infrastructure on the chip. It is important to foster this building block in order to keep doors open for future innovation.