US EMV deadline set for 2015

Powered by SC Magazine
 

Non-compliant merchants bear fraud costs.

Visa has issued a set of best practices for implementing chip technologies used to secure debit and credit card transactions.

The document offers guidance for merchants, card issuers and processors.

It comes as Visa will extend its Technology Innovation Program (TIP) to the US on 1 October which will pave the way for EMV in the country.

EMV involves recognising unique microchips embedded in credit and debit cards to validate that they are legitimate. It has been credited with the declining fraud rates.

In Australia, EMV is required to be installed in new point of sale terminals by April and in credit cards a year later.

TIP eliminates the requirement for US merchants to annually validate their compliance with the Payment Card Industry Data Security Standard (PCI DSS) if at least 75 percent of their Visa transactions originate from chip-enabled terminals.

To qualify, retailers must outfit their locations with terminals that accept contact and contactless chips, according to Visa. Other major card brands have said they will follow suit.

But there's a downside for merchants, too.

If they fail to implement EMV by 2015, they will be on the hook to recoup customers for counterfeit fraud-related costs, not the banks that issued their cards, as has been the long-standing agreement.

Visa is trying to jumpstart the process with the new guidance. It includes recommendations on how to build and maintain an "always online" infrastructure for authorisation and authentication, as well as how to offer flexible verificiation methods, including signatures, no signatures (for low-risk transactions) and PINs.

But Gartner analyst Avivah Litan had said EMV adoption will likely push fraud to other channels like to card-not-present environments.

Some banks may be able to avoid upgrading cards to the new standard if mobile device payments take off.

Last year Starbucks launched mobile payments in all of its US stores that allowed customers to download a mobile application and pay by holding the displayed barcode to a countertop scanner.

The PCI Security Standards Council offered an update in June on which types of mobile payment apps meet its requirements. Further guidance is expected.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


 
 
 
Top Stories
Beyond ACORN: Cracking the infosec skills nut
[Blog post] Could the Government's cybercrime focus be a catalyst for change?
 
The iTnews Benchmark Awards
Meet the best of the best.
 
Telstra hands over copper, HFC in new $11bn NBN deal
Value of 2011 deal remains intact.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  4%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  3%
 
A Federal Government agency (ATO, Centrelink etc)
  19%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 1883

Vote
Do you support the abolition of the Office of the Information Commissioner?