EMV Cards - Revision history

Russ horton: /* I want it already, what's the ETA? */

2020-06-26T15:29:02Z

I want it already, what's the ETA?

← Older revision		Revision as of 15:29, 26 June 2020
Line 69:		Line 69:

	=I want it already, what's the ETA?=		=I want it already, what's the ETA?=
	To clarify, these EMV readers are not just another input device to feed the card data to CMS for processing like the mag stripe readers have been. This is a new paradigm where the card reader device MUST handle the processing. As such each device must be individually certified (which is rigorous) and thus we expect to only offer support for a small number of devices. CMS will also have to be modified to support feeding transaction data to the device, have the device process the transaction, and CMS be updated with the results of that processing. This is not a trivial project and must be executed carefully to ensure a trouble-free and PCI compliant implementation~~. Bottom line, it's going to take some time but know we are committed to providing an EMV solution. There will also be the expense to the merchant to purchase the EMV card reader device~~.		To clarify, these EMV readers are not just another input device to feed the card data to CMS for processing like the mag stripe readers have been. This is a new paradigm where the card reader device MUST handle the processing. As such each device must be individually certified (which is rigorous) and thus we expect to only offer support for a small number of devices. CMS will also have to be modified to support feeding transaction data to the device, have the device process the transaction, and CMS be updated with the results of that processing. This is not a trivial project and must be executed carefully to ensure a trouble-free and PCI compliant implementation.

	=Will it work with my merchant account?=		=Will it work with my merchant account?=

Russ horton: /* Why chips? */

2015-11-10T21:56:15Z

Why chips?

← Older revision		Revision as of 21:56, 10 November 2015
Line 8:		Line 8:

	When a card is swiped, the terminal performs an initial communication to the processor to see if the card was issued with an EMV chip or not. If so you'll be prompted to insert the card into the terminal instead. This addresses the scenario where a thief has picked up your card data by NFC and created a fake mag stripe version of the card.		When a card is swiped, the terminal performs an initial communication to the processor to see if the card was issued with an EMV chip or not. If so you'll be prompted to insert the card into the terminal instead. This addresses the scenario where a thief has picked up your card data by NFC and created a fake mag stripe version of the card.

			[http://info.mercurypay.com/rs/772-ISK-107/images/Nov_10_Messenger_Article2_EMVtransaction.pdf Article explaining the details of an EMV transaction]

	MPS has outlined the Benefits of EMV to include:		MPS has outlined the Benefits of EMV to include:
Line 17:		Line 19:
	That said, it offers no additional security for card use online or by phone (CNP - card not present transactions). It's worth noting that these cards still have a mag stripe on them to be used with traditional/current card swipe solutions since it is expected that it will take retailers a few years to implement chip card readers.		That said, it offers no additional security for card use online or by phone (CNP - card not present transactions). It's worth noting that these cards still have a mag stripe on them to be used with traditional/current card swipe solutions since it is expected that it will take retailers a few years to implement chip card readers.

	~~Recent statement~~ from Square on the topic:		Statement from Square on the topic (Sept 2015):

	''Here’s some data we’ve seen: about 17 percent of the cards swiped on Square Stand or Reader now contain a chip, up from roughly 3.5 percent in January 2014. For now, the majority of the cards are still being processed as magnetic-stripe transactions (all chip cards also have a magnetic stripe on the back). But as sellers upgrade to EMV technology, more and more of these transactions will be processed via the chip on the card instead of the magnetic stripe. A big milestone here is the liability shift, which, as we mentioned, happens in October. At the current pace of chip card issuance, we expect roughly 35-40 percent of cards to be chip-enabled by the time the liability shift hits (though this may change if issuers speed up or slow down their pace). - See more at: http://paymentsjournal.com/Content/Featured_Stories/26769/#sthash.XSpykLlN.dpuf''		''Here’s some data we’ve seen: about 17 percent of the cards swiped on Square Stand or Reader now contain a chip, up from roughly 3.5 percent in January 2014. For now, the majority of the cards are still being processed as magnetic-stripe transactions (all chip cards also have a magnetic stripe on the back). But as sellers upgrade to EMV technology, more and more of these transactions will be processed via the chip on the card instead of the magnetic stripe. A big milestone here is the liability shift, which, as we mentioned, happens in October. At the current pace of chip card issuance, we expect roughly 35-40 percent of cards to be chip-enabled by the time the liability shift hits (though this may change if issuers speed up or slow down their pace). - See more at: http://paymentsjournal.com/Content/Featured_Stories/26769/#sthash.XSpykLlN.dpuf''

Russ horton: /* What is my exposure to PCI fines? */

2015-10-05T18:15:32Z

What is my exposure to PCI fines?

← Older revision		Revision as of 18:15, 5 October 2015
Line 36:		Line 36:

	=What is my exposure to PCI fines?=		=What is my exposure to PCI fines?=
	This is not about PCI, breaches or the crippling fines that go with them. If a fraudulent transaction occurs with an EMV card, the merchant is responsible for the cost of that fraudulent transaction. See this [http://www.discovernetwork.com/chip-card/images/Merchant%20Store%20Owner_Fraud%20Liability%20Shift%20Overview.pdf pdf/graphic from Discover] which does a nice job of illustrating which scenarios impact the merchant. It is not a data breach that would incur PCI fines. Here is an article from the PCI Council that explains their stance:		This is not about PCI, breaches or the crippling fines that go with them. If a fraudulent transaction occurs with an EMV card, the merchant is responsible for the cost of that fraudulent transaction. See this [http://www.discovernetwork.com/chip-card/images/Merchant%20Store%20Owner_Fraud%20Liability%20Shift%20Overview.pdf pdf/graphic from Discover] which, on page 2, does a nice job of illustrating which scenarios impact the merchant. It is not a data breach that would incur PCI fines. Here is an article from the PCI Council that explains their stance:

	*https://www.pcisecuritystandards.org/news_events/quick_resources/increasing_security_with_emv_chip_and_pci.php		*https://www.pcisecuritystandards.org/news_events/quick_resources/increasing_security_with_emv_chip_and_pci.php

Russ horton: /* What is my exposure to PCI fines? */

2015-10-05T18:14:37Z

What is my exposure to PCI fines?

← Older revision		Revision as of 18:14, 5 October 2015
Line 36:		Line 36:

	=What is my exposure to PCI fines?=		=What is my exposure to PCI fines?=
	This is not about PCI, breaches or the crippling fines that go with them. If a fraudulent transaction occurs with an EMV card, the merchant is responsible for the cost of that fraudulent transaction. See this [[http://www.discovernetwork.com/chip-card/images/Merchant%20Store%20Owner_Fraud%20Liability%20Shift%20Overview.pdf pdf/graphic from Discover]] which does a nice job of illustrating which scenarios impact the merchant. It is not a data breach that would incur PCI fines. Here is an article from the PCI Council that explains their stance:		This is not about PCI, breaches or the crippling fines that go with them. If a fraudulent transaction occurs with an EMV card, the merchant is responsible for the cost of that fraudulent transaction. See this [http://www.discovernetwork.com/chip-card/images/Merchant%20Store%20Owner_Fraud%20Liability%20Shift%20Overview.pdf pdf/graphic from Discover] which does a nice job of illustrating which scenarios impact the merchant. It is not a data breach that would incur PCI fines. Here is an article from the PCI Council that explains their stance:

	*https://www.pcisecuritystandards.org/news_events/quick_resources/increasing_security_with_emv_chip_and_pci.php		*https://www.pcisecuritystandards.org/news_events/quick_resources/increasing_security_with_emv_chip_and_pci.php

Russ horton: /* What is my exposure to PCI fines? */

2015-10-05T18:14:19Z

What is my exposure to PCI fines?

← Older revision		Revision as of 18:14, 5 October 2015
Line 36:		Line 36:

	=What is my exposure to PCI fines?=		=What is my exposure to PCI fines?=
	This is not about PCI, breaches or the crippling fines that go with them. If a fraudulent transaction occurs with an EMV card, the merchant is responsible for the cost of that fraudulent transaction. ~~It appears to be~~ the ~~same as losing a chargeback dispute~~. It is not a data breach that would incur PCI fines. Here is an article from the PCI Council that explains their stance:		This is not about PCI, breaches or the crippling fines that go with them. If a fraudulent transaction occurs with an EMV card, the merchant is responsible for the cost of that fraudulent transaction. See this [[http://www.discovernetwork.com/chip-card/images/Merchant%20Store%20Owner_Fraud%20Liability%20Shift%20Overview.pdf pdf/graphic from Discover]] which does a nice job of illustrating which scenarios impact the merchant. It is not a data breach that would incur PCI fines. Here is an article from the PCI Council that explains their stance:

	*https://www.pcisecuritystandards.org/news_events/quick_resources/increasing_security_with_emv_chip_and_pci.php		*https://www.pcisecuritystandards.org/news_events/quick_resources/increasing_security_with_emv_chip_and_pci.php

Russ horton: /* Should I care? */

2015-09-23T17:52:05Z

Should I care?

← Older revision		Revision as of 17:52, 23 September 2015
Line 22:		Line 22:

	=Should I care?=		=Should I care?=
	If you do all of your business by phone and/or online (card not present), no need to worry about the change. It is something you'll want to consider if you accept physical cards (card present).		If you do all of your business by phone and/or online (card not present), no need to worry about the change. It is something you'll want to consider if you accept physical cards (card present). At this stage accepting EMV cards does not impact your processing rates and we've not heard plans to do so.

	As a consumer you'll start receiving new chip cards from your credit card providers and be instructed on how to use them as merchants begin adopting the hardware needed to process them.		As a consumer you'll start receiving new chip cards from your credit card providers and be instructed on how to use them as merchants begin adopting the hardware needed to process them.

Russ horton: /* When is the Right Time to Implement EMV? */

2015-09-14T17:52:44Z

When is the Right Time to Implement EMV?

← Older revision		Revision as of 17:52, 14 September 2015
Line 64:		Line 64:
	If you were to assess the number of card present fraudulent charges you've received in the past and then further reduce that by the fraction of future charges that will be made with cards that are EMV (noting this liability doesn't apply to non-EMV cards), in most cases the resulting risk/liability for not accepting EMV cards in October should be low.		If you were to assess the number of card present fraudulent charges you've received in the past and then further reduce that by the fraction of future charges that will be made with cards that are EMV (noting this liability doesn't apply to non-EMV cards), in most cases the resulting risk/liability for not accepting EMV cards in October should be low.

	Good article reviewing some reasons why now may not be the time to implement EMV - http://blog.solupay.com/top-7-reasons-not-to-adopt-emv		Good article reviewing some reasons why now may not be the time for your company to implement EMV - http://blog.solupay.com/top-7-reasons-not-to-adopt-emv

	=I want it already, what's the ETA?=		=I want it already, what's the ETA?=

Russ horton: /* Will it work with my merchant account? */

2015-09-02T23:55:38Z

Will it work with my merchant account?

← Older revision		Revision as of 23:55, 2 September 2015
Line 70:		Line 70:

	=Will it work with my merchant account?=		=Will it work with my merchant account?=
	Our first implementation of ~~a solution for~~ EMV will be with our payment partner MPS. If your merchant account is not with MPS, please contact us so we can arrange to have a quote prepared for you.		Our first implementation of EMV will be with our payment partner MPS. If your merchant account is not with MPS, please contact us so we can arrange to have a quote prepared for you.

	Again, this has no effect on card not present (CNP) transaction, only card-present.		Again, this has no effect on card not present (CNP) transaction, only card-present.

Russ horton: /* Why chips? */

2015-09-01T16:19:43Z

Why chips?

← Older revision		Revision as of 16:19, 1 September 2015
Line 9:		Line 9:
	When a card is swiped, the terminal performs an initial communication to the processor to see if the card was issued with an EMV chip or not. If so you'll be prompted to insert the card into the terminal instead. This addresses the scenario where a thief has picked up your card data by NFC and created a fake mag stripe version of the card.		When a card is swiped, the terminal performs an initial communication to the processor to see if the card was issued with an EMV chip or not. If so you'll be prompted to insert the card into the terminal instead. This addresses the scenario where a thief has picked up your card data by NFC and created a fake mag stripe version of the card.

	It offers no additional security for card use online or by phone (CNP - card not present transactions). It's worth noting that these cards still have a mag stripe on them to be used with traditional/current card swipe solutions since it is expected that it will take retailers a few years to implement chip card readers.		MPS has outlined the Benefits of EMV to include:
			*Reduced risk of accepting counterfeit cards
			*Reduced risk of card skimming at the POS terminal
			*Accepting foreign cards which are already EMV enabled
			*Modernized POS with support for EMV and contactless payment technologies (NFC)

			That said, it offers no additional security for card use online or by phone (CNP - card not present transactions). It's worth noting that these cards still have a mag stripe on them to be used with traditional/current card swipe solutions since it is expected that it will take retailers a few years to implement chip card readers.

	Recent statement from Square on the topic:		Recent statement from Square on the topic:

Russ horton: /* What is EMV? */

2015-09-01T16:14:34Z

What is EMV?

← Older revision		Revision as of 16:14, 1 September 2015
Line 2:		Line 2:

	=[http://merchant.mercurypay.com/secure-my-business/getting-ready-emv/what-is-emv/ What is EMV?]=		=[http://merchant.mercurypay.com/secure-my-business/getting-ready-emv/what-is-emv/ What is EMV?]=
	The above title is a link to an informative article from one of our payment processing partners, Mercury Payment Systems (MPS) and is worth the read. EMV cards are also referred to as "chip card" (because they have a chip embedded in the card). Another type of "chip card" is [http://www.transfirst.com/secure-processing/NFC NFC] which is Near Field Communications chip. The new retail devices that support EMV will have you insert the card, chip first into a slot on the front, instead of swiping the mag stripe. For NFC cards/readers you'd merely wave the chip over the reader. New smartphone enabled payment applications like Apple Pay use this NFC technology as well.		The above title is a link to an informative article from one of our payment processing partners, Mercury Payment Systems (MPS) and is worth the read. EMV cards are also referred to as "chip card" (because they have a chip embedded in the card) or "smart cards". Another type of chip card is [http://www.transfirst.com/secure-processing/NFC NFC] which is Near Field Communications chip. The new retail devices that support EMV will have you insert the card, chip first into a slot on the front, instead of swiping the mag stripe. For NFC cards/readers you'd merely wave the chip over the reader. New smartphone enabled payment applications like Apple Pay use this NFC technology as well.

	=Why chips?=		=Why chips?=