EMV: What it is, why it’s important, and what do I need to ...

1 EMV: What it is, why it's important, and what do I need to know? EMV Basics for Merchants z z CONFIDENTIAL AND PROPRIETARY. Copyright 2014 Vantiv, LLC. All rights reserved. Vantiv, the Vantiv logo, and all other Vantiv product or service names and logos are registered trademarks or trademarks of Vantiv, LLC in the USA and other countries. indicates USA registration. Agenda What EMV is How EMV works Card brand roadmaps Debit routing Planning steps 2. What is EMV? z z What is EMV? EMV is a set of international standards that defines interoperability of secure transactions across the international payments landscape. EMV transactions introduce dynamic data specific to the card and the transaction, with the goal of devaluing transaction data in flight and reducing the risk of counterfeit fraud. EMV has become the world-wide standard and both neighbors, Canada and Mexico, have EMV mandates effecting multi-national retailers.

2 EMV is the stepping stone to the future of payments due to its dynamic data authentication (Contactless, Mobile). 4. What is EMV? The computer chip on the card uses cryptography to provide strong security. EMV can utilize two forms of cryptography to secure a transaction: Digital signatures ensures data is authentic Encryption ensures data is kept confidential The digital signature devalues the card and transaction data because even if the data is intercepted, the digital signature cannot be replicated. In the context of EMV, encryption is only used to protect the PIN. Does not encrypt all of the transaction data 5. Market Drivers for EMV. Counterfeit, Lost and Stolen Fraud Losses Currently Issuers are liable for all counterfeit fraud-related losses When EMV cards are issued, liability for counterfeit fraud will shift to merchant if the merchant is not EMV enabled When used with a PIN, also protects against lost and stolen fraud.

3 The card brands assign fraud liability based on the least secure party to the transaction Global interoperability of chip cards and payment devices Worldwide standard used by all countries Support for international commerce Contactless and Mobile payment schemes 6. EMV around the world World wide EMV deployment and adoption1. Region EMV Cards Adoption Rate EMV Terminals Adoption Rate Canada, Latin America and the Caribbean 401M Asia Pacific 372M Africa & the Middle East 50M Europe Zone 1 755M Europe Zone 2 46M United States2 Totals3 1 Figures reported in Q4 2012 and represent the latest statistics from American Express, JCB, MasterCard and Visa, as reported by their member financial institutions globally 2US Figures are estimates based on reports from Visa and MasterCard as of Q4 2011. 3 Totals does not included data from the US. 97%. of European ATMs and 97%+. of Canadian ATMs are EMV.

4 Compliant 7. Why EMV Fraud trends Canada 2008-2010 BY 2011. HOLIDAY FRAUD. HOLIDAY. FRAUD SIGNIFICANTLY. PEAKS REDUCED. 8. Why EMV Global Fraud Trends Counterfeit Fraud Volume (Visa only) and Rest $ 2004. + 307% of World Sales Volume ROW. 2011 $ 2012. - 56%. and Rest of World Fraud - 52% ROW $ Volume $ 2012. Europe Asia Pacific (Liability Shift in (Liability Shift in (Liability Shift in 2005) 2006) 2015). 9. Why EMV- Fraud trends in As EMV migration nears completion in Canada, Europe and parts of Asia Cross Border Counterfeit Fraud SIGNIFICANT. GROWTH SINCE 2005. 10. What is the risk? $160,000,000. $140,000,000. $120,000,000. $100,000,000. $80,000,000. 2009. $60,000,000. 2010. 2011. $40,000,000. $20,000,000. $0. Source: Visa Visa US Domestic Counterfeit Fraud 11. What is the risk? 14%. 6% 34%. 6%. 8%. 9%. 13%. 10%. SUPERMARKETS FUEL DISPENSERS ELECTRONICS STORES DEPARTMENT STORES.

5 DISCOUNT STORES SERVICE STATIONS PHARMACIES Other Visa US Domestic Counterfeit Fraud Source: Visa 12. How EMV works z z How does EMV work? An EMV card is inserted into a terminal The chip embedded in the card contains the account data;. this is accessed by the reader in the terminal Using data from the card and the transaction, the chip creates and sends a unique code, or cryptogram , to the processor's host during the transaction, validating the card The card is removed when the transaction is completed 14. Contactless and Mobile An EMV chip can be on a contactless card where the chip is tapped or held near the terminal - OR - A chip can be inside your smart phone and the phone is waived near the terminal 15. Difference between Magnetic Stripe Terminal and EMV Terminal There is a fundamental difference between a magnetic stripe and an EMV chip transaction Magnetic Stripe Terminal Card is simply a static storage device that is read by the terminal The terminal performs card swipe, PIN encryption and signature capture (integrated environments).

6 Functions 16. Terminal Mag Stripe Transaction Flow 2 3. 1. 5. 4. 1. Card is swiped through Terminal 2. Authorization Request from Terminal to Acquirer 3. Authorization Request from Acquirer to Issuer 4. Authorization Response from Issuer to Acquirer 5. Authorization Response from Acquirer to Terminal 17. Difference between Magnetic Stripe Terminal and EMV Terminal The issuing bank defines the processing rules via parameters on the chip The chip on the card processes transactions information and determines how to apply the rules for processing The terminal helps enforce the rules on the chip If terminal is unable to provide the services requested by the chip, the issuer may set rules that will result in the chip declining the transaction. 18. EMV Terminal and Transaction Flow 4 5. 3. 1. 2. 9. 8 7. 6. 1. Card is inserted into EMV Terminal 3. Online Authorization Request from Card to Terminal 2.

7 First Half of EMV Transaction Protocol 4. Authorization Request from Terminal to Vantiv A. Application Selection 5. Authorization Request from Vantiv to Issuer B. Read Application Data 6. Authorization Response from Issuer to Vantiv C. Offline Data Authentication D. Processing Restrictions 7. Authorization Response from Vantiv to Terminal E. Cardholder Verification 8. Completion and script processing. If Issuer approved F. Terminal Risk Management but card denied transaction a reversal is produced G. Terminal Action Analysis H. Card Action Analysis 9. Card is removed from EMV Terminal 19. EMV Introduces New Security Functions 1 3. Card Authentication Authorization Security Options 01101010010010101. 2 4. 1010100100101. Contact, Cardholder Contactless, Verification and Mobile Options Technology 20. EMV Card Authentication 1. Online Card Authentication CARD. ISSUER HOST.

8 Generates an EMV Host Validates the EMV. 1 Dynamic Cryptogram 2 Dynamic Cryptogram Offline Card Authentication (optional). CARD TERMINAL. Card provides the Terminal validates Online 1 terminal a dynamic 2 the dynamic 3. security certificate security certificate Authorization 21. Cardholder Verification (CVM) 2. Is the cardholder the right person? } EMV CVM List More than one CVM is supported on a card Signature Online PIN. Issuers choose what CVMs to support Offline PIN. Issuer chooses the priority order of the No CVM. CVMs 22. Online vs. Offline PIN. EMV Online PIN EMV Offline PIN. 2. 4653. Works the same as mag stripe host based PIN PIN stored and validated at the All EMV cards use chip Encrypted online PIN for ATM. PIN. Most Offline PIN transactions go No system changes required online for authorization The is an online market Changes required: PIN selection/activation process PIN stored and validated Customer PIN Communications at Offline PIN change process the host 4653 Synchronization with the online PIN.

9 Issuer Add ability to send PIN and PIN. Host counter updates to the card 23. EMV Authorization/Approval 3. Issuers can make better authorization decisions with richer risk data provided in an EMV transaction Transaction approval process (1) Online Authorization (2) Offline Authorization (Optional). Works much like a magnetic stripe card transaction The card authorizes the transaction New EMV data is sent to the host No communication with a host system Dynamic authentication technology is used for authorization New risk assessment rules are followed Card contains offline authorization criteria and counters 24. EMV requires certification and validation Terminal Acquirer Chip EMVCo terminal type Processor Network Host EMV Chip application approval hardware Certification certification (Before and logic testing Host certification they can be sold). Payment network brand already completed by Card Personalization testing for each brand Vantiv validation (For each supported product issued).

10 25. Liability Shifts, PCI Validation Waivers, and Account Data Compromise Relief z z What are the New Rules? April 2013 April 2013 April 2013 April 2013. Processors must Processors must Processors must Processors must support EMV support EMV support EMV support EMV. International ATM. April 2015 liability shift October 2015 October 2015. 3rd party ATM Liability shift of Liability shift of must support EMV October 2015 counterfeit transactions counterfeit transactions Liability shift of October 2015 counterfeit transactions October 2017 October 2017. Liability shift of Liability shift for AFD Fuel liability shift counterfeit transactions October 2016. Liability shift for ATM. October 2017. Liability shift for AFD October 2017. Liability shift for ATM Liability shift for AFD. A Regional Debit Network solution proposal has been released by the EMV Migration Forum 27. Liability Shift Details Counterfeit fraud liability is assigned based on hierarchy of which party has most secure option enabled.