December 2, 2014

EMV Update

EMV Update

The chip cards are coming! We are now just 10 months away from the October 2015 liability shift date for U.S. EMV. That’s the date the card brands set to have all U.S. merchants supporting EMV (Chip card) technology. After that date, whichever organization breaks the “EMV chain” will be held responsible for fraudulent card activity that could have been prevented had they supported EMV. In practical terms, that means the liability for fraud could shift to the banks if they do not offer chip-embedded smart cards to their merchants, or to the processor if they are not certified to receive the EMV transaction, and of course, it could shift directly to the merchant if all other players are EMV ready but the merchant does not process the transaction through a certified EMV terminal.

Since we first heard about the U.S. rollout of EMV, we have been very vocal in declaring that EMV alone is not the solution to the recent high-profile breaches, and that merchants should not rush into EMV without thoughtful consideration. In spite of our lack of enthusiasm for the project, we’ve promised all along that we would be ready in advance of the deadline and would ensure that any of our merchant customers who make the effort can be prepared.

Here’s a quick update on our efforts:

  1. We already support EMV in Canada with the Ingenico iPP320 through Global, Moneris, and American Express.
  2. We are members of the U.S. EMV Migration Forum – actively participating and sharing best practices and insights with other payments industry players about the move to EMV in this country.
  3. We are currently working on U.S. EMV certifications with processors First Data (RapidConnect) and Chase Paymentech. We are certifying with the Ingenico iSC250 and Verifone MX915 devices. More certifications will be coming as the processors finalize their specifications and as additional devices are made available.
  4. We are actively working to combine EMV with P2PE in order to provide the true security that is missing from the current EMV specification.
  5. Finally, our friends and partners in the point-of-sale and property management system space will be happy to hear that we have enhanced our receipt text capabilities to help our vendor partners comply with processor-specific requirements for receipt content.

If you didn’t see your processor listed in point #3 above, don’t worry. Some of the processors are still tweaking their EMV specifications and we’re holding out until they are as bug-free as possible before we dive into the certification process.

As for devices, we expect to also have Ingenico’s full Telium line (iPP320, iPP350, iSC250, iSC350, iSC480) and Verifone’s MX925 certified by this time next year. If you think we should consider an additional device, feel free to email [email protected] and let us know which EMV terminals you’d like to see supported. While we can’t guarantee we’ll be able to write to every terminal in the next 10 months, we always appreciate your feedback and will do our best to accommodate your needs.

Look for more EMV updates in future editions of 4Sight, the Shift4 customer newsletter.