Over many years recently, credit card data breaches at chain stores have exposed customers to hackers looking to make a quick profit off their victims’ information. In an effort to prevent such security violations, merchants have been urged to accept EMV chip cards ― or bear the cost of any ensuing fraudulent activity.
This initiative has resulted in chip cards comprising nearly 85 percent of United States card transactions, according to EMVCo. To help you understand the current state of EMV better ― and what it means for your business moving forward ― here’s an overview of its standards and expert advice for small business owners.
Editor’s note: Looking for the right credit card processor for your business? Fill out the below questionnaire to have our vendor partners contact you about your needs.
EMV, which is named after its original developers (Europay, MasterCard and Visa), is a global credit card standard that enhances the security of in-person card transactions. EMV technology allows sensitive cardholder data to be stored in a chip, rather than in the magnetic stripe found on traditional payment cards.
Since individual organizations can only do so much to stop cybercriminals, the credit card payments industry instituted EMV policies to fight credit card fraud. The government also stepped in to lead a nationwide effort to better protect consumers. In October 2014, U.S. President Barack Obama issued an executive order to implement enhanced security measures for consumer finances. Part of this order, which is detailed in a White House fact sheet, required payment card issuers to embed cards with secure EMV microchip technology by October 2015.
“The technology has been around for [three decades] … and is used in much of the world, but the chip-enabled cards have only really caught on in the U.S. over the past [decade],” said Mike Blang, regional director of sales at USA Today Network.
EMV technology is very simple on the customer’s end. Instead of swiping the magnetic strip of a credit card, you “dip” one end of the card into the EMV reader so it can scan the chip. For EMV technology to work, the point-of-sale (POS) system where the card is used must be equipped to read and communicate with the microchip. [Related article: The 12 Best POS Systems for Small Businesses]
At each transaction, the microchip creates a unique code that can’t be used again. This is different from the traditional magnetic stripe card, whose data can be copied easily by an inexpensive card-reading device and reproduced in counterfeit cards.
EMV cards provide an additional layer of security by requiring a PIN input instead of a signature when authenticating purchases, said Dax Dasilva, founder and executive chair of the board of directors of POS system provider Lightspeed.
EMV cards are simply industry jargon for “chip cards.” If you’ve paid for something with the chip on your card rather than by swiping your card, you’ve used EMV technology.
The largest card issuers, including MasterCard, Visa, American Express and Discover, announced that merchants and issuers that did not support chip technology by October 2015 would be held liable for any counterfeit fraud.
“However, the migration to EMV chip technology was not a mandate,” said Blang. “There are nuances, but the general idea is that in the past, the card issuer held counterfeit fraud liability. After Oct. 1, 2015, the entity that had invested least in chip technology, whether it’s the merchant or the card issuer, holds the fraud liability going forward.”
For example, if a customer has a chip card but the merchant does not have a terminal that is certified for chip card acceptance, then the cost of any fraudulent transaction will be that merchant’s responsibility.
“Some merchants didn’t know their level of counterfeit fraud liability since, in the past, issuers simply absorbed the loss,” said Blang.
“Many of the business owners we work with are unaware of this risk of not accepting EMV,” said Mark Guagenti, senior software engineer at Zoro US.
A lack of understanding of the liability shift is only one of the reasons some merchants have delayed implementation of EMV technology. Here are some other reasons why small business owners might still resist using EMV technology.
Some businesses are reluctant to take on the upfront investment for new hardware and software upgrades.
“Many business owners fear that the cost to upgrade to an EMV terminal is steep,” said Guagenti. This can be the case, especially for restaurants or businesses with multiple locations, he added.
Getting the appropriate certifications in a timely fashion has been another challenge for business owners, even those committed to the conversion process. In addition to adopting new software so that they can accept EMV, merchants and their newly EMV-compliant terminals must undergo a certification process.
“Many software providers underestimated the complexity and time of getting certifications completed,” said Blang. “In some environments using integrated point-of-sale systems, the software needed to process chip transactions was not certified by the date of the liability shift.”
This puts merchants in the precarious position of having their new terminals set up and ready to go but still waiting to be certified, even though they are already being held accountable for any fraud that occurs with customers who have EMV chip cards.
Though it’s a frustrating situation, Blang remains optimistic about the overall impact EMV will have on the marketplace and reminds merchants that every day, more providers are being certified and rolling out EMV to those who want it.
According to Blang, the U.S. is larger and more complex than any other payment card market in the world. This inherently slows the progress of widespread EMV adoption.
“This, combined with what was arguably a shorter migration timeframe, may lead one to believe that what was achieved was actually nothing short of moving mountains,” he said.
The U.S. is home to the world’s largest, most complex credit and debit card payment market.
The benefits of EMV technology have not gone unnoticed. Here are some key highlights of switching to EMV.
By far the most obvious perk of EMV, fraud reduction is the biggest payoff.
“The level of success is subjective, but some industry statistics indicate that counterfeit payment card fraud [rapidly decreased],” said Blang.
This effect was noticeable in just the first year after fraud liability shifted from credit card providers to small businesses. During this period, MasterCard reported that fraud decreased by 60 percent in terms of dollars among its top five EMV-compliant merchants.
According to Guagenti, EMV-compliant terminals provide endless add-ons and support mobile purchases with Apple Pay and Android Pay. Guagenti also pointed out that EMV technology provides pay-at-table and pay-in-aisle options, which allow customers to pay where they are, without their credit card ever leaving their hand.
“Today’s technology is making it even easier to integrate systems into legacy POS, and standalone systems are comparable to older machines,” said Guagenti. “Your new machines will provide you with a better customer experience and increased protections.”
Most customers will insert a chip when given this option instead of swiping a card. This is just easier — customers know exactly how to place the card, and there’s no such thing as swiping too fast. Offering even tiny conveniences like this can increase your customer loyalty.
Not all cardholders have received updated, EMV-enabled versions of their credit cards. This isn’t something merchants have to worry about as long as they have already made the switch to EMV technology.
“EMV-compatible terminals and machines are also set up so they can swipe traditional magnet stripe cards,” said Suneera Madhani, founder and CEO of Stax, a credit card processing solutions provider. “So, if a consumer walks into the business without an EMV card, they will still be able to process the transaction.”
However, the business will not be responsible for fraud-related losses from those swiped transactions.
“If a business has implemented the technology but customers don’t have a chip card, the liability burden remains with the banks,” said Matt Schulz, chief credit analyst at Lending Tree. “Generally speaking, the only case in which the liability burden shifts is when a credit card holder has a chip card but the merchant doesn’t have the technology to accept the chip card.”
“If a business hasn’t upgraded to EMV technology … they should make plans to do so as soon as possible,” Schulz advised. “While it is definitely expensive to make these upgrades, the reality is that the merchant risks facing far greater costs if they end up getting stuck with the bill for future credit card losses.”
“Switching to EMV will mean adding new in-store payment technology and internal payment-processing systems all while complying with new liability rules, but it’s a crucial investment,” added Dasilva.
Although EMV technology is a strong deterrent to fraudulent activity, it cannot protect consumers from all data breaches. Card-not-present fraud, which involves purchases made online, by phone or via mail order, will remain a problem for years to come.
But regardless of what new challenges may be on the horizon, EMV technology is already the standard around the world and shaping the future of payment processing.
“EMV is not a technology trend that will fall by the wayside,” Madhani said. “We are the last country to adopt this technology, and we will only continue to see the development of EMV and contactless technologies.”
Additional reporting by Max Freedman and Nicole Fallon. Some source interviews were conducted for a previous version of this article.