New EMV Initiatives: Will EMV Issuers Be Able To Cope?
Almost all of the 145 million EMV cards issued in 2005 carried only a single application and offered very simple functionality. Since EMV cards have historically lacked sophistication, most EMV card issuers have only implemented EMV data preparation software or simply upgraded their in-house card issuance systems. Recent EMV initiatives, however, are making more use of the EMV infrastructure, expanding functionality and reducing costs.
When chip cards were introduced 10 years ago, many believed that an immediate and major change would occur in the payment landscape. Some industry analysts expected chip cards to house multiple applications, which cardholders would be able to download post-issuance. Transactions would be offline, secure and fast. Issuers would receive and analyse mountains of data from chip transactions and make precise parameter changes to the card application to guard against undesired use. Cash transactions would be vastly reduced; cardholders would need only one card to hold all their applications, and new form factors would appear, enabling them to house the chip in a key fob, watch, mobile telephone or even their fingers, if so desired.
“When EMV started, there was a lot of hype around multi-application; then banks who invested in EMV had to concentrate and deliver the main application, which was the payment,” says Guido Mangiagalli, head of the new channels unit at Visa Europe. What has actually happened to EMV payment card issuance is not a story of large-scale innovation. The rush to combat fraud, comply with card scheme mandates and meet liability shifts meant there was no time to consider value-added solutions. Some payment card issuers are issuing EMV cards, but almost all are single-application, low functionality cards. Chip manufacturers have increased security, but at the expense of more imaginative uses of chips. Issuers have, therefore, used relatively simple systems to manage this issuance. Generally, they have either added data preparation systems to their issuing environments or enhanced their in-house systems to add chip data to the card embossing file. A number of issuers have implemented smart card management systems, but they are in the minority.
Recently, though, some of the original EMV ideas have matured and become more affordable. Some of these business initiatives are pushing issuers to expand card functionality and explore the chip card’s unexploited potential.
The card schemes have developed several initiatives to make better use of the EMV infrastructure, first, in card-not-present (CNP) environments and second, for contactless payments.
As more bank customers use Internet banking and debit and credit cards for Internet purchases, fraudsters are becoming increasingly clever, creating the need for stronger authentication. Traditional methods, such as static passwords, are proving vulnerable to fraud. Led by MasterCard and Visa, the card industry has introduced standards to bring two-factor authentication to the virtual world of Internet banking and shopping. The programme is based on EMV payment card technology. MasterCard originally created the chip authentication programme (CAP), which has been sublicensed by Visa to create its password authentication programme.
CAP uses the chip card’s ability to validate a customer’s EMV PIN. If the PIN is valid, then the chip generates an application cryptogram that acts as a dynamic, single-use password. A personal card reader is required to perform the operation and displays the dynamic password, which is then entered at the Internet banking or shopping site to authenticate both the card and the customer. The method is called two-factor authentication because it is based on two key points: something the customer has (the EMV payment card) and something the customer knows (the PIN).
In the UK, APACS has produced implementation guidelines that direct issuers to add the CAP application separately, which ensures that CAP will be issued on multi-application cards. Other countries are following this lead. CAP also marks the beginning of wide-scale use of EMV debit cards for functions outside payments, e.g. authentication. “It is a tricky process [for issuers] to add new functionality,” says Gijs Schreuder, head of consumer payments at ABN AMRO. “Consumers have to adopt and understand [new applications]. Once they understand the functionality, they are ready for new ones.”
The more cardholders trust and accept their cards for use in different environments, the more valuable the card becomes to both the cardholder and the issuer alike.
In the US, contactless cards have proven extremely popular, with more than 20 million cards already issued. Contactless EMV payments will be launched soon, and the card schemes are using them in their so-called ‘war against cash’. MasterCard estimates that 180 billion European cash transactions take place annually and suggests that a great number of those could be efficiently processed as contactless payments.
Outside the US, the card schemes have decided to make use of the offline EMV infrastructure to implement contactless payments. Contactless cards interface with a card reader without requiring a card swipe or dip. Cardholders can use contactless cards to pay for goods by simply waving a card within 10 centimetres of a contactless reader. Transactions are mainly authorised at the point-of-sale (POS) terminal against limits held on the chip. Transactions below a certain value threshold, typically £10, may be made without requiring cardholder verification. Early indications from pilots carried out in the UK and France show that issuers and merchants alike are impressed at the potential of contactless cards and expect a successful mass rollout.
In the UK, a number of major banks have announced a joint launch of contactless cards beginning in the London region this year. A minimum of half a million cards are expected to be issued initially and 1,000 merchants will be involved. Barclaycard has also announced a partnership deal to house Transport for London’s Oyster contactless ticketing application on its payment cards.
Further pilots and rollouts of EMV contactless cards are continually appearing. LaSer
Cofinoga, a French issuer of mainly private-label store cards, has launched a trial of
contactless cards. In Turkey, Garanti Bank has already issued 50,000 EMV-compliant
MasterCard contactless cards since rollout began in summer 2006. Contactless EMV card payments are ready for takeoff, but the impacts to issuers are unknown. Payments made with these cards will take place in offline environments, without PINs, by a technology that is not widely understood. Initially, transaction values will be relatively low, and this will prevent issuers from becoming overly worried about levels of fraud or bad debt. The maximum transaction value will be £10 with a possible £30 purse before a transaction is put online.
However, pressure from merchants to raise transaction limits and from cardholders to raise purse limits will eventually leave issuers with a problem – they will have to manage the risk of issuing cards that can perform, for example, transactions for £25 with a purse of £250 in offline environments without needing to check the cardholder’s identity.
Issuers will need to refocus on offline risk management around the EMV profiles and parameters that up until today have been set up as standardised values. The ability to change these profiles and parameters post-issuance will also become more important as demand grows to issue contactless cards to wider groups of cardholders.
Smart card vendors agree that contactless payments will boost chip cards and inspire issuers to adopt them. The Smart Payment Association, comprising the four major suppliers of banking smart cards worldwide, has announced a new initiative to promote contactless, multi-application payment cards. The association has defined an interoperable data format for contactless applications, from loyalty programmes to transit to cinema ticketing.
Developments in Near Field Communications (NFC) are related to contactless payments and the NFC is likely to make some issuers reconsider the form factor for the contactless application. Recently, many pilots have used mobile telephones to house the contactless chip. If mobile telephones were to take over some of the payment market, this would lead to new challenges for issuers, such as how to personalise the payment application over the air.
SEPA will force eurozone banks to reform the patchwork of debit card networks that currently exists across Europe. These networks are anti-competitive and prevent European banks from acquiring cardholders across the eurozone. One of the most important elements of the new European card framework is EMV compliance; however, the most generous estimates of migration in Europe indicate that only 40% of the task is complete.
EMV plays a key role in preventing and fighting card fraud. Fraud rates are typically low at the national level and high at the cross-border level. SEPA is intended to significantly increase card payments across the eurozone, and it is vital that measures be implemented to prevent an increase in fraud. Therefore, the European Payments Council (EPC) has mandated that all cards issued in 2008 be EMV-compliant, with the aim that EMV will be fully implemented by 2010. Observers believe the deadline for EMV compliance is achievable subject to retailer agreement to terminal changes.
Hence, pressure exists for EMV card issuers to achieve EMV compliance in addition to the pressure from the card schemes via liability shifts. “EMV is the key way; we gave a clear deadline of 2010 on that,” affirms Alfred Schmauss, chairman of the cards working group of the EPC. Furthermore, SEPA’s drive to increase competition for electronic payments will put card revenues under pressure; therefore, card issuers are more likely to try to extract added value from EMV, instead of simply issuing single-application payment cards. Issuers forced to begin EMV issuance will now find that higher specification cards are cheaper than a few years ago, and some of the initiatives are better defined. Both of these things should make it easier for issuers to implement value-added services.
Initiatives such as contactless cards are based on a fully implemented EMV infrastructure. Pressure from SEPA will lead to this happening by 2010 at the latest. Datamonitor’s ‘Contactless Payment 2006’ report states: ‘As the contactless payment programmes outside the US require an EMV-compliant infrastructure, it is the level of migration that appears to be determining the future development of contactless in the region.”
The EPC also believes that contactless technology will benefit the eurozone. The EPC has expressed a goal to reduce the cost of cash handling thus targeting low-payment transactions.
A number of European countries within the SEPA region have also expressed fear that the emergence of a Visa and MasterCard duopoly across the eurozone could restrict competition. For this reason, some countries are planning to maintain their domestic debit card schemes in the short term, alongside an international debit card application. This will demand that some issuers in these countries issue multi-application payment cards and implement the supporting infrastructure.
Further impact to issuers will be derived from SEPA’s drive to open domestic markets to allow more cross-border acquiring. Once implemented, consumers will be able to use EMV debit cards anywhere in the eurozone. This could impact the business case for joint retailer and card issuer loyalty schemes. A vastly expanded market in which the loyalty schemes operate will help drive these schemes forward. The general acceptance of an EMV debit card across the eurozone could accelerate the use of the card in areas such as identification and transit.
EMV cards are beginning to migrate from their basic, functional origins and head in the direction that some first envisaged. Surprisingly, this change has occurred slowly.
Originally, it was assumed that everything would happen overnight in a sort of ‘big bang’ migration. Instead, expediency has meant that EMV cards have been rolled out as secure, single-application payment cards.
In a few years, issuers will find that EMV cards have turned into multi-application, highly complex chip cards. Furthermore, sophisticated risk management systems will perform post-issuance changes to contactless card parameters and applications.
But uncertainties remain. Will issuers get there by piecing together various issuance systems, as the latest EMV initiative dictated, or will they take a more strategic view and implement a future-proof chop card issuing system that can take on new challenges? Will issuers have the foresight to see changes coming and make the necessary and difficult decisions to prepare their companies for the future? Do issuers think chips are their future, or just a necessary evil to fight fraud?
Financial institutions that embrace chip functionality and exploit the potential to offer cardholders greater levels of service will succeed and profit from the large-scale investment that EMV requires.