The Weakest Link: Merchant Processing Liability Changes October 1
EMV/chip roll out requires action by retailers
Magnetic stripe credit cards have been around for decades, but that’s changing as the U.S. adopts what is considered a more secure payment technology—EMV (a new payment processing standard that stands for Europay, MasterCard & Visa). EMV cards, which are commonly called “chip” or “chip and PIN” cards are widely used in hundreds of countries outside the U.S. to reduce payment fraud.
EMV cards use a microchip on the front of the consumer’s card to produce unique transaction information each time a purchase is made, making it much more difficult to steal cardholder information, in contrast to magnetic stripe cards which contain enough cardholder data to be profitable for criminals. Some EMV/chip cards take the extra security step of requiring the cardholder to use a PIN number to complete the transaction.
Liability Shift?
With the change in card technology comes changes in liability for merchants beginning October 1, 2015. Under the new liability, generally when fraudulent or counterfeit cards are used the liability—or who pays for the charges—shifts to the party with the least secure system (the weakest link).
As an example, if a customer presents an EMV/chip card to a merchant and the merchant chooses to process the transaction using the magnetic swipe process because the merchant doesn’t have a terminal with chip technology, the liability for the fraudulent transaction rests with the merchant. In the case where a customer presents an EMV/chip card and the merchant’s processes the transaction as a chip transaction, liability for the fraudulent transaction rests with the issuer, not the merchant.
The change in technology and liability shift means merchants need to take a moment to consider upgrading their processing terminals to accept EMV cards. For some merchants, their average sales, their volume of sales, and their current amount of fraud will drive the decision to make the $350-$500 investment in a new terminal. For many, it’s a no-brainer as the cost of one single fraudulent transaction will justify the investment.
October 1 (Or After!) Checklist
Merchants are not required to change their hardware to accept the new EMV/chip cards, but given the liability shift and the security features, it makes sense to properly evaluate that decision. Here’s a checklist merchants can use before (and even after) October 1.
1. Determine Your Risk Tolerance: Look at current fraud rates (ask your processor if you don’t know), average purchase price, and number of purchases to determine if a change in liability might have a financial impact. Remember that the new liability model is different than today—just because you haven’t seen chargebacks for fraud don’t assume fraud doesn’t happen. (Tip: card-not-present transactions (over the phone, on-line) will work the same what they do today.)
2. Plan To Evaluate In The Future: No matter what is decided today, make evaluating risk tolerance and payments systems a part of an annual business review.
3. Discuss Terminal Options: A quick call to the credit card processing vendor makes sense. Obtain pricing information for a terminal that accommodates how and when customers pay. In many cases a standard, new terminal will be $350 to $500. (Tip: Consider asking for a terminal with NFC or “near field communication” capabilities to accommodate new “tap” payment technologies. It’s generally an inexpensive upgrade.)
4. Plan For Implementation: Thinking about how and when to upgrade a terminal should include thinking about how and when a customer pays. An equipment upgrade is a great time to consider where data or phone lines should be and customer access to the terminal. (Tip: When processing a chip transaction with a PIN, the customer needs access to the terminal to input their PIN number.)
5. Train Employees And Customers: Customers often times want to slide their EMV/chip card in and out of a terminal just like they have done for years when paying with their magnetic swipe cards, however a chip transaction requires the card be kept in the terminal through the whole transaction (including adding a tip and entering a PIN). A transaction can take up to ten seconds so employees often times need to walk the customers through it from start to finish. (Tip: To ease with the transition, most EMV/chip cards still have a magnetic stripe on the back and can be processed either way, however this can be confusing for customers and employees.)