In this blog post, I cover what EMV is, why we should care, when it should be implemented by merchants and whether merchants still need to meet the PCI-DSS requirements.<\/p>\n
Written by Daniel Ruiz, Point-of-Rental\u2122 Systems IT Support Liaison, on December 16, 2013<\/i><\/p>\n I was once told credit card security was a \u2018cat and mouse game\u2019 and I couldn\u2019t agree more.\u00a0 EMV is like a really big cat and credit card thieves are the pesky mouse.<\/p>\n EMV stands for Europay\/MasterCard\/Visa.\u00a0 EMV credit cards were designed and introduced to reduce fraud occurring in magnetic-stripe face-to-face environments, by using chips embedded into credit cards that use secret cryptographic keys to generate authentication and authorization data.\u00a0 EMV was first formed in 1993 in Europe and has been implemented in many countries excluding the United States.<\/p>\n Merchants should care about EMV because it is already being implemented in the United States and will be a requirement starting October 2015.<\/p>\n Historically, merchants who needed a way to process credit cards would simply purchase Point-of-Sale (POS) terminals from their bank.\u00a0 These days bad guys have caught on to this antiquated technology and exploited it at the expense of cardholders and merchants.\u00a0 Innovation has spurred new secure ways of processing cardholder data to protect cardholders and merchants from the pain and suffering of dealing with credit card fraud.<\/p>\n Full implementations of EMV specifications can mitigate the risk of compromised card data being used to commit face-to-face fraud.\u00a0 EMV implementations utilize different card verification values maintained on the chip from those maintained in the magnetic-stripe image data.\u00a0 In addition, when implemented in conjunction with PIN for cardholder data verification, EMV limits the impact of the lost\/stolen\/never-received categories of fraud.\u00a0 Evidence has clearly shown that in those countries where EMV has been deployed, there has been a measurable and significant reduction in face-to-face fraud. [1]<\/p>\n EMV has real numbers behind its effectiveness — in Canada, for example, fraud fell from $142 million in 2009 to $38.5 million just three years later.<\/p>\n EMV will be a requirement come October 2015.\u00a0 Visa has set dates for a shift in fraud liability and if a merchant has not implemented EMV and fraud is committed at their business then they will be liable for covering the fraudulent charges, penalties and fees that come with breaches.<\/p>\n Environments fully configured to take EMV can substantially reduce fraud in face-to-face environments but an EMV environment does not automatically fulfill PCI-DSS requirements nor does it protect the confidentiality of cardholders and sensitive authentication data.\u00a0 Add to this the capability of merchants to process both EMV and non-EMV transactions, and it becomes obvious that protecting the confidentiality of cardholders and sensitive authentication data is essential. [1]<\/p>\n By design, PCI-DSS does not distinguish between underlying transaction security mechanisms, but instead seeks to protect the Primary Account Numbers (PAN) and other sensitive authentication data as a goal without examining the underlying fraud risk should this data be compromised.\u00a0 In the future, should EMV become the sole means of payment in a given face-to-face channel, coupled with a globally adopted robust authentication process for card-not-present (CNP) transactions, the need to keep the PAN and other sensitive authentication data confidential would be significantly reduced.\u00a0 As a consequence, the PCI-DSS would be updated to bring it in line with the threat landscape that would then exist, and its applicability in relation to EMV reduced accordingly.\u00a0 Until such time, EMV and PCI-DSS together create a powerful two-pronged approach to the objectives of reducing fraud and increasing security.<\/p>\n Therefore, in securing the current face-to-face acceptance environment one should not consider it to be a case of either EMV or PCI-DSS, but rather EMV and<\/i><\/b> PCI-DSS.\u00a0 Both are essential elements in the fight against fraud and data exposure.\u00a0 Together they provide the greatest level of security for cardholder data throughout the entire transaction process.<\/p>\n EMV is a proven credit card security technology already adopted by many countries around the world and is being adopted by the United States.\u00a0 Liability for merchants and consumers start in October 2015 and merchants should have their credit card environment ready to take EMV transactions by then or risk being held liable for credit card breaches.\u00a0 Implementing EMV is a smart and logical step for the United States that can greatly reduce fraud in a short amount of time.\u00a0 EMV and PCI-DSS are both to be implemented as one does not trump the other when it comes to protecting cardholder data.\u00a0 Meeting both requirements puts the merchant on the path to less stress because it will less likely have to deal with credit card fraud cases.\u00a0 Credit card security is a \u2018cat and mouse\u2019 game and EMV is a large step for merchants having a big healthy lion.<\/p>\nWhat is EMV?<\/h1>\n<\/div>\n
Why Should Merchants Care?<\/h1>\n<\/div>\n
When Do We Need to Implement?<\/h1>\n<\/div>\n
Do I Still Have to be PCI Compliant?<\/h1>\n<\/div>\n
Conclusion<\/h1>\n<\/div>\n