A guide to Visa's merchant incentives for chip-and-PIN compliance

By Brian O'Connell

Visa has made it official. It's climbing aboard the "chip-and-PIN" bandwagon -- and in a big way.

The financial behemoth announced in early August that it would begin pushing for a U.S. migration toward EMV contact and contactless chip technology (chip and PIN), which is currently used in Europe, Asia and Canada and is believed to help significantly reduce fraud.

Chip-and-PIN credit cards rely on embedded microchips that hold and process customer credit card information in place of (or, in some cases, in addition to) magnetic stripes. Customers simply hold the card near a reader, then enter a PIN number on a keypad. In order to process chip-and-PIN credit cards, merchants must upgrade their point-of-sale systems, which EMV proponents acknowledge can be costly.  

"Visa is leading the way for the widespread commercial deployment of EMV technology in the U.S," wrote Ellen Richey, Chief Enterprise Risk Officer for Visa in a blog post about the announcement. "The programs we are announcing are designed to enable dynamic authentication, improve fraud prevention, enhance international acceptance and provide a commercial framework to support the acceleration of NFC mobile payments." 

Visa has been talking with clients and merchants about "chip and PIN" for several years, wrote Richey in the blog and the company has concluded that "chip is the right direction for the U.S. Over the last year, for example, we've seen financial institutions issuing chip cards to international travelers. And some large merchants have already begun installing chip terminals."

So far, industry analysts seem to agree. James Van Dyke, founder and president of Javelin Group commented in a recent blog post that the announcement is "quite compelling because it includes pragmatic and long-term incentives for major camps in the card payments industry." Van Dyke added that he was "impressed with Visa's announcement because they've communicated specific incentives aimed at changing the behaviors of card-issuing banks, merchants, and merchant-acquiring banks in an effort to get cardholders to go chip (and eventually, mobile)."

So what's in it for merchants? And what do they need to do to comply with the new technology?

Compliance-wise, Visa says it will still support an array of cardholder verification platforms, including signature, PIN and no-signature for low-value, low-risk transactions. However, the company says that, down the road, it anticipates that technologies like signature and PIN will be edged out of the equation as even newer, fresher cardholder verification technologies are rolled out.

A primary plank for encouraging merchant compliance with chip and PIN will trigger on October 1, 2012. That's when Visa says it will launch its keystone Technology Innovation Program (TIP) to the U.S.

Here's what Visa advises merchants on the new program, in three key steps:

Step  No. 1: Visa says that TIP will end the mandate for merchants to validate their compliance with the PCI Data Security Standard (PCI DSS) for any year where 75 percent of the merchant's Visa transactions stem from chip-based terminals. To accommodate the Visa mandate, merchants must use terminals that support contact and contactless chip technology. Visa also says that contact chip-only or contactless-only terminals will not be eligible for use by U.S. merchants.

"Qualifying merchants must continue to protect sensitive data in their care by ensuring their systems do not store track data, security codes or PINs, and that they continue to adhere to the PCI DSS standards as applicable," said Visa in a statement.

Step No. 2: Visa also insists that U.S. acquirer processors support merchant acceptance of chip transactions no later than April 1, 2013. "Chip acceptance will require service providers to be able to carry and process additional data that is included in chip transactions, including the cryptographic message that makes each transaction unique," said Visa. Visa will provide "additional guidance as part of its bi-annual Business Enhancements Release for acquirer processors to certify that their systems can support EMV contact and contactless chip transactions."

Step No. 3: Visa has also mandated a "U.S. liability shift" for U.S.-based and overseas counterfeit card-present point-of-sale (POS) transactions, effective October 1, 2015. Right now, POS counterfeit fraud is usually handled by card carriers. With the new rules on liability, if a contact chip card is used as payment to a merchant who is not using contact chip terminals, liability for counterfeit fraud lands with the merchant's acquirer.

The result for U.S. merchants?
It's actually cut and dried. Visa's three-prong program should result in lower costs for merchants who play ball with Visa. But if not, merchants could be raising unnecessary risk for themselves if they elect to ignore the new technology and fail to upgrade their point-of-sale systems.

Now, merchants have to wonder if that's a risk worth taking.

Published: August 23, 2011