As the initial push for EMV transition emerged in 2012, Visa worked diligently to dispel the myth that EMV was tied directly to the use of personal identification numbers (PINS). Now, as the EMV deadline has arrived and merchants and retailers scramble to comply with new regulatory guidelines, Visa is still emphasizing that “it’s the chip, not the PIN” that is essential for card security.
"There's a lot of confusion around the myth that EMV means 'chip-and-PIN,'" Stephanie Ericksen, Visa Head of Authentication Product Integration, said in a blog published Jan. 13, 2012. "It doesn't in many countries, including the U.S. That's because, in the U.S., we can rely on online processing where transactions are transmitted in real time to the issuer for approval. With that in place, there's no need for the offline authentication that was the genesis of chip-and-PIN."
One benefit that the United States has as a late adopter of EMV is learning from mistakes and successes of other nations. Erickson noted, “"Our telecommunications system means we can rely on online processing that is fast, and where transactions are routinely analyzed with our real-time fraud scoring system prior to issuer review. By adding the dynamic cryptogram of the EMV chip to online authorization, we'll increase transaction safety even more, yet without the more complex and expensive cards, terminals and processing capabilities that are needed to support offline authorization."
Fast-forward three years, and Visa is still touting the benefits of chip without PIN. “More than 60% of U.S. payment card transactions do not use any signature or PIN, and we expect that trend to continue,” said Stephanie Ericksen, VP of risk products for Visa, in a conference call with Chain Store Age.
Citing supporting figures from other countries that already use chip-and-PIN authentication, Ericksen explained that for transactions under a certain amount (for example $25 in retail and $50 in grocery categories), not only is PIN verification not required, but neither is a customer signature.
Mark Nelson, senior vice president of risk products and business intelligence at Visa, explained that biometrics are replacing PIN or signature verifications of many chip card transactions. “Biometrics add incremental security,” said Nelsen. “It’s more convenient way to verify you are the genuine cardholder.”
Tokenization and encryption of data are also being employed by many retailers as a means to reduce card fraud, and Nelson explained, “Security is being enabled more and more easily by mobile devices.”
And, of course, implementation does not happen overnight. “It takes time for encryption to be built out on the card side and the enablement side,” said Ericksen. “That’s why we initially announced the 2015 deadline in 2011, to streamline adoption and ensure clarity of the requirements.”
Ericksen estimated that 30%-40% of POS terminals on the market are equipped with EMV-compliant hardware, meaning they may still need a hardware upgrade and software installation. Thanks to the availability of devices like an EMV-compliant $49 Square reader and desktop POS terminals that cost $100-$200 each, she said the hardware implementation cost in the U.S. is “negligible” compared to the cost in previous EMV rollouts.
