October 1, 2015 marks a significant milestone in the payment card industry’s EMV transition in the US. The EMV (which stands for Europay, MasterCard, Visa) transition is the payment card industry’s attempt to upgrade the US payment infrastructure to accommodate cards and card readers with pin-and-chip technology. On October 1, 2015, the payment card industry is instituting a liability shift in which merchants and card issuers that are not EMV compliant will shoulder expenses associated with fraud in “card present” transactions.
The motivation behind this transition is security. The US is significantly behind the rest of the world in adopting pin-and-chip technology. Europe, for example, has been using pin-and-chip for nearly a decade now. Pin-and-chip technology (using dynamic data) provides for significant security advantages over the antiquated magnetic strip technology (using static data) and should significantly reduce instances of fraud in “card present” transactions.
Merchants and card issuers should know that this October 1st deadline was established by the payment card industry–that is to say, this date is not mandated by law. Despite this, merchants and card issuers should be aware that non-compliance may come at significant expense. The specific details of the liability shift differ among each payment card company (see the October 2015 specifics for Visa, MasterCard, Amex and Discover here), but the broad strokes are roughly the same.
In “card present” fraud (where the payment card is physically presented at the transaction), payment card companies will assign liability, to either the merchant or card issuer, that is not EMV compliant. If an instance of “card present” fraud occurs using a pin-and-chip card on a magnetic strip card reader, the merchant will be liable for the fraud. Conversely, if an instance of fraud occurs using a non-pin-and-chip card on a pin-and-chip reader, the card issuer will be liable for the fraud.
Not every merchant transaction is subject to the liability shift. As the October 2015 liability shift only applies to “card present” fraud, online and phone transactions are not affected. Additionally, the compliance deadlines for ATMs and automated fuel stations are not until either October 2016 or October 2017 (depending on the payment card company).
Becoming EMV compliant and transitioning to pin-and-chip technology comes at significant expense to both merchants and card issuers. Credit card fraud in the US, however, accounts for billions of dollars of loss annually. With the impending liability shift, non-compliant merchants and card issuers are at risk for significant amounts of liability. Merchants and card issuers that are non-compliant should make it a priority to determine the approach best suited to minimizing their liability under these new standards.
