What are chip-and-pin cards? How EMV cards work.
With credit card fraud becoming easier and large breaches from major corporations like Target and Home Depot becoming the norm, there is a big push toward a new system of credit card use. But, what are chip-and-pin cards and how will they help protect your identity and credit information?
Creating a New Standard
You may have noticed your new card has a metal chip embedded above the account number. These are EMV cards — Europay, MasterCard and Visa — named after the three companies that created the standard years ago. Since its creation, EMV has become globally accepted with all the major credit card companies signing onto the new system.
It's been used around the world for years and the U.S. is one of the final markets to become EMV compliant. With many corporations holding to an October 2015 implementation deadline and President Barack Obama recently signing an executive order calling for the transition, EMV cards are coming fast.
How it works
In order to understand how EMV works and why it's considered a safer method, let's first look at the current standard. The magnetic strip standard was first developed by IBM in the 1960s. The credit card information, including the account number, is stored on the strip and is transmitted to banks at the point of sale. Hackers can easily intercept the information stored on the strip as it is sent to the banks or by way of unsecured networks storing information that shouldn’t be stored such as the recent breaches we’ve all heard about.
EMV cards change that process. The information stored on the chips are encrypted, unintelligible to anyone other than the issuing bank, which can decrypt the information and process the payment. Even if the encrypted information is stolen and re-transmitted by hackers attempting to make a purchase, the issuer will know it is being done without the chip. EMV cards also require the cardholder to enter a PIN at checkout, offering a second level of protection.
It’s important to keep in mind that, during the transition to EMV card technology across all the retail platforms, the current magnetic stripe will still work even after October 2015. If a retailer chooses not to upgrade to the EMV chip, they will take the risk of loss rather than the card issuer.
EMV FAQs
1. Why are EMV cards more secure than traditional cards?
It's that small, metallic square you'll see on new cards. That's a computer chip, and it's what sets apart the new generation of cards. The magnetic stripes on traditional credit and debit cards store contain unchanging data. Whoever accesses that data gains the sensitive card and cardholder information necessary to make purchases. That makes traditional cards prime targets for counterfeiters, who convert stolen card data to cash. If someone copies a mag stripe, they can easily replicate that data over and over again because it doesn't change.
Unlike magnetic-stripe cards, every time an EMV card is used for payment, the card chip creates a unique transaction code that cannot be used again. If a hacker stole the chip information from one specific point of sale, typical card duplication would never work because the stolen transaction number created in that instance wouldn't be usable again and the card would just get denied.
EMV technology will not prevent data breaches from occurring, but it will make it much harder for criminals to successfully profit from what they steal. Experts hope it will help significantly reduce fraud in the U.S., which has doubled in the past seven years as criminals have shied away from countries that already have transitioned to EMV cards.
2. How do I use an EMV card to make a purchase?
Just like magnetic-stripe cards, EMV cards are processed for payment in two steps: card reading and transaction verification. However, with EMV cards you no longer have to master a quick, fluid card swipe in the right direction. Chip cards are read in a different way.
Instead of going to a register and swiping your card, you are going to do what is called 'card dipping' instead, which means inserting your card into a terminal slot and waiting for it to process. When an EMV card is dipped, data flows between the card chip and the issuing financial institution to verify the card's legitimacy and create the unique transaction data. This process currently isn't as quick as a magnetic-stripe swipe so will take a tiny bit longer for that transmission of data to happen.. If a person just sticks the card in and pulls it out, the transaction will likely be denied so we should encourage members to have a little bit of patience if they are using the EMV “Card Dip”transaction.
3. Is card dipping the only option?
Not necessarily. EMV cards can also support contactless card reading, also known as near field communication(NFC) which you may have heard of relative to smartphone technology. Instead of dipping or swiping, NFC-equipped cards are tapped against a terminal scanner that can pick up the card data from the embedded computer chip. Contactless transactions are more consumer-friendly because you just have to tap. Around the world, there is a move to make EMV cards dual-interface, which means contact and contactless. However, in the U.S., most financial instructions are issuing contact cards as dual-interface cards and the equipment needed to scan them are expensive. Right now, the first step is to successfully integrate EMV cards into the U.S. shopping scene.
4. Will I still have to sign or enter a PIN for my card transaction?
Yes and no. You will have to do one of those verification methods, but it depends on the verification method tied to your EMV card, not if your card is debit or credit. Chip-and-PIN cards operate just like the checking- account debit card you have been using for years.
Entering a PIN connects the payment terminal to the payment processor for real-time transaction verification and approval. However, many payment processors are not equipped with the technology needed to handle EMV chip-and-PIN credit transactions. We have not required the PIN-EMV transaction at this point but we will be encouraging members with credit cards to create and use a PIN going forward. In most cases our members will use the magnetic-stripe credit card and sign on the point-of-sale terminal to take responsibility for the payment when making a chip-and-signature card transaction.
Once the transition to EMV is under way in the U.S., chip-and-PIN cards will be transitioned in. The card production demand today is really based on chip-and-signature cards. It will probably take two to three years to fully convert to “chip-and-PIN."
5. If fraud occurs after EMV cards are issued, who will be liable for the costs?
Today, if an in-store transaction is conducted using a counterfeit, stolen or otherwise compromised card, consumer losses from that transaction fall back on the payment processor or issuing bank, depending on the card's terms and conditions. After Oct. 1, 2015, deadline created by major U.S. credit card issuers MasterCard, Visa, Discover and American Express, the liability for card-present fraud will shift to whichever party is the least EMV-compliant in a fraudulent transaction.
The major credit card issuers each have published detailed schedules about the upcoming shift in liability. The change is intended to help bring the entire payment industry on board with EMV by encouraging compliance to avoid liability costs. Any parties not EMV-ready by October 2015 could face much higher costs in the event of a large data breach. Automated fuel dispensers will have until 2017 to make the shift to EMV. Until then, they will follow existing fraud liability rulings.
6. So by Oct. 1, 2015, the transition to EMV technology will be complete?
Not Exactly. Although the upcoming deadline is strong encouragement for all payment processing parties to become EMV-compliant as soon as possible, most experts do not believe everyone will comply by that date. Most expect about 50 percent of banks and retailers to be completely transitioned over by the October 1st deadline. All out credit cards are EMV cards. Members with that have debit cards that are expiring in the later part of 2015, will likely be transition to chip cards. Very few point-of-sale systems can accept debit EMV in the U.S. right. The upgrade specs were issued only late last year they just aren't in consumer hands right now.
7. If I want to use my chip-card at a retailer that doesn't support EMV technology yet, will it work?
Yes. The first round of our EMV cards which members received, will be equipped with both chip and magnetic- stripe functions so member use is not disrupted and merchants can adjust.
If a member finds themselves at a point-of-sale terminal and are not sure whether to dip or swipe your card, they can rest easy. The terminal will walk you through the process. For example, if they enter a card into the chip reader slot but the reader isn't activated yet, it will come up with an error and they'll be prompted to swipe the card in order to use it. And vice-versa. If a member tries to swipe a chip card instead of inserting it, an error will appear and they will be prompted to insert the card for chip processing instead. If chip-card readers are not in place at a merchant at all, our EMV credit cards can be read with a swipe, just like a traditional magnetic-stripe card.
8. Will I be able to use my EMV card when I travel outside the country?
Yes and no. The U.S. is the last major market still using the magnetic-stripe card system. Many European countries moved to EMV technology years ago to combat high fraud rates. That shift has left many U.S. consumers who have magnetic-stripe cards looking for other forms of payment when they travel. Since many foreign merchants are wary of magnetic-stripe cards, consumers who hold some type of chip card may run into fewer issues than those without one. Just the existence of the chip will likely make European merchants more willing to accept transactions that they wouldn't have likely accepted if a customer presented a mag-stripe card.
However, chip-and-PIN cards are the norm in most other countries that support EMV technology. So members may still find merchants who are unwilling or unable to process their card, even though it does have an embedded chip. Unmanned payment kiosks in Europe -- such as bike rental stations, train ticket stations and parking permit dispensers -- may give U.S. travelers the most difficulty since most are set up to strictly accept chip-and-PIN card only.