Retailers have been hearing that smart cards are coming to the United States for years, yet they rarely see such a card in their stores. In fact, many have heard so many projections about the cards with so little action that they’ve tuned out on the subject, taking the attitude that when they actually start seeing the cards in their stores, they’ll worry about installing terminals that can read the chips.
EMV smart cards have been around since 1994, when Europay, MasterCard and Visa (EMV) developed the specifications for issuance and acceptance worldwide. Since then, JCB and American Express have also joined EMV. The EMV standard encompasses specifications, test procedures and compliance processes managed by EMVCo, which is jointly owned and operated by the major credit card companies.
The EMV standards have been widely adopted in Europe and parts of Asia — last year, there were more than 1.5 million EMV-compliance cards in use worldwide — but U.S. card issuers and retailers have largely stuck to the mag-stripe card. In the last year, however, several banks have begun issuing cards with both a mag-stripe and a chip, and many are reported to be considering smart card rollouts over the next three to five years.
While it’s likely to be years before a large number of smart cards start appearing in stores, retailers will soon become liable for fraud made on these cards if no smart card-accepting device is in place — meaning retailers need a game plan now.
Timelines for acceptance
A timeline from IBM’s Retail User Group shows that retailers are likely to spend the next 12 to 18 months establishing EMV implementation plans to meet the liability shifts generated by credit card associations that go into effect in late 2015. In October 2015, for example, MasterCard will shift the liability for a fraud transaction from the issuer to the merchant if the issuer’s card has the more secure chip on it but the retailer was not able to read the chip.
“We have developed a liability hierarchy so that whichever side does not employ the most secure method will be responsible for the fraudulent transaction,” says Colin McGrath, vice president of development for MasterCard’s U.S. markets. Therefore, retailers need to determine how they plan to provide a long-term solution as soon as possible.
“In the past, there was a lot of talk and encouragement for merchants to upgrade their equipment,” says Randy Vanderhoof, executive director of the Smart Card Alliance. “But now there are specific timelines agreed to by the payment brands that could trigger action by merchants. It is no longer encouragement, but compliance issues, that are making merchants take another look.”
Retailers “are going to need time to align their acceptance systems to support the changes required in the next few years,” Vanderhoof says. “The earlier they begin planning, the more likely they can make the transition as smoothly and efficiently as possible.”
Even as they begin to issue smart cards, most banks will continue to support mag-stripe cards, so retailers whose terminals can’t read smart cards won’t have to worry about turning customers away. A bigger issue is making sure they are in compliance with the top security standards in the market and showing their customers that they take fraud prevention and security measures seriously, says David Hogan, director of major accounts for Heartland Payments Systems, a large merchant acquirer and processing company.
The first step is to learn more about EMV and what retailers need to do to accept smart cards long term. “Most retailers are in the investigative and research phase of EVM,” McGrath says. “What does it mean for them? What do they need to do? What is the business case for implementing this?”
A lot of retailers may be confused or unsure about how to react. “There is a lot of disinformation in the market,” Hogan says. “Across the board, we see a lot of confusion.”
As retailers seek to modernize/upgrade card acceptance systems to facilitate EMV, many are also thinking about adding mobile and contactless payment options. “They need to think about how they will make all these changes and EMV in one coordinated effort,” Vanderhoof says.
Heartland’s Hogan agrees that retailers need to look at the big picture, but says the need for an integrated solution could also complicate the matter. “There are so many alternative payment options out there now that it has made the issue more complex. A lot of retailers are waiting to see what mobile solution will be the leader in terms of market share before they react. Will it be Google, PayPal, Isis or some other solutions provider?”
Most retailers should begin by speaking with their key payments suppliers about what they are doing to facilitate the movement to EMV. “What are their plans for EMV?” McGrath says. “What are the plans of other VARs [valued added resellers] that they might be working with?”
Smaller retailers will need to rely heavily on their merchant acquirers and processors for assistance. “Many small retailers purchase branded systems and it will be easier for them to make the changes because they can rely on these suppliers to show them the way,” says Vanderhoof. “Large retailers that have complex, customized systems will require more extensive system changes.”
McGrath also believes the task could be more complicated for larger retailers, who “have a lot more relationships to consider and more companies to coordinate their efforts with.”
Some merchants, particularly those with older POS systems, may need to replace their existing systems, but many should be able to accommodate EMV through system upgrades or add-ons. Retailers that have followed the trend toward stand-alone terminals, where customers swipe their own cards and enter PINs, should have an easier time than retailers that have integrated card acceptance into the cash register system.
“The solutions required vary across the board but a lot of retailers will be able to retrofit their existing systems,” McGrath says.
Still, it can be a major undertaking for some retailers, particularly those that have made substantial recent investments in systems that are not EMV-compatible. Hogan mentions one retailer that spent about $12 million two years ago to replace all the chain’s credit card readers; the new readers do not have the right slot for reading smart cards, though, and another large investment may be required.
“Most large retailers refresh their POS systems every eight to 10 years,” Hogan says. “A lot of them just put in new systems around 2007 and 2008 and they weren’t planning on making major changes or replacements for another five to six years.
“Most retailers will proceed when they are ready,” he says.