Chip and PIN– Tackling the New Payments Revolution in Parking
You will be using ‘chip and pin’ in 18 months, are you ready?
By Jeremy Gumbley
The introduction of a new payments standard known as EMV, or chip and PIN, has revolutionized payments around the globe. The parking industry, which relies on payments systems across its various networks, is directly affected by this technology shift.
So far, however, the U.S. has delayed its adoption of EMV, which replaces magnetic-stripe payments with chip-based transactions. This is all about to change, with the U.S. now having its migration plan in place. However, lack of awareness poses a major challenge, with many organizations unclear on the new EMV requirements and its potential full impact.
The reality is that EMV is the future of payments and affects every payment system, device and application. Whether it is multispace or single-space meters, garage or barrier parking, mobile, unattended or online, manufacturers and parking operators must tackle the technology implications and deploy EMV-ready solutions across their infrastructures.
EMV is a global standard for credit and debit payment cards based on chip-card technology, replacing traditional “swipe” cards – also known as magnetic-stripe or “mag-stripe.” Instead of a mag-stripe, the “smart” cards include an embedded chip to store data, which all terminals must read to then authenticate the transaction, often in combination with a PIN (personal identification number).
The term EMV itself stands for Europay, MasterCard and Visa, the international organizations that began developing the specifications in 1999. The EMV standards and associated compliance processes are now managed by EMVCo, an organization owned by American Express, JCB, MasterCard, UnionPay and Visa.
More than 1.62 billion EMV-compliant payment cards were in use worldwide as of Q4 2012, according to EMVCo. Europe has led the way; in parts of the region, 95% of terminals were chip-enabled as of Q4 2012. Canada, Latin America and the Caribbean are also well-advanced, with 79% of terminals meeting the EMV standard.
In the U.S., parking operators and manufacturers must act now to define their project parameters and timelines if they are to meet some important deadlines. There are penalties for those that do not comply in time. However, EMV also offers major commercial benefits and the opportunity to put in place a foundation for future innovation.
EMV and the parking industry
Any organization in the parking payments “ecosystem” will need to ensure that their systems meet the new EMV requirements. Parking operators need to pay close attention to this, as those that fail to migrate successfully risk penalties from the “liability shift.”
The so-called liability shift deadline is Oct. 1, 2015, and it is an important factor in the transition. This will see parties that are not EMV-compliant bear some of the cost from fraud.
For example, a person might carry out a fraudulent transaction using a mag-stripe card on a non-EMV-compliant terminal. In this case, the parking operator, as the owner of the terminal, will be liable for the cost if everyone else in the chain is already compliant. This chain begins with the card plans, then extends to processors and finally to the parking operators as the ultimate merchant.
This is a reflection of one of the most important drivers behind EMV – the need to reduce payment fraud. Regions worldwide that have adopted EMV have dramatically reduced fraud because it is much more difficult to copy the cards.
According to The Nilson Report, a trade newsletter, in 2011, U.S. payment card fraud losses reached an estimated $3.56 billion, representing 47$ of all reported worldwide fraud losses. In contrast, Canada saw a significant drop in fraud since the national roll-out of chip and PIN in 2008. Losses from “card skimming” in Canada fell to CAD$38.5 million in 2012, according to the Interac Association. This represents a reduction of more than 70$ since 2009, when figures hit CAD$142 million.
A particular problem in the parking sector is so-called card skimming, which is on the rise according to a report earlier this year from the European ATM Security Team. It found that five European countries experienced an increase in card-skimming devices attached to transport ticket machines.
These devices capture data from the mag-stripe on users’ cards so the fraudsters can then create cloned cards. However, these cloned cards work only in terminals that still accept mag-stripe cards. As a result, counterfeit fraud using cards from “mature” EMV countries is actually migrating to regions that have yet to transition to the new standard, such as the U.S..
Plastic card fraud in the U.S. using UK cards still carrying the mag-stripe reached almost $25 million in 2011, according to Financial Fraud Action UK. In addition, card fraud is known to migrate across borders to non-EMV domains. With Canada and Mexico well-advanced with EMV, this opens up further threats to the U.S..
The figures highlight how the U.S. parking industry is a particularly vulnerable target. As a result, it stands to benefit considerably from the anti-fraud measures that EMV provides.
Navigating technology hurdles
The transition to EMV requires manufacturers and operators to upgrade or replace every payments terminal and for banks to re-issue credit and debit cards. With a vast payments ecosystem, the scale of the task is probably why the U.S. has taken so long to tackle the migration.
The requirements cover hardware and software, as well as transaction types and host systems. Faced with further fraud losses and increased liability, parking operators will need to rely on their system manufacturers to help deploy an EMV upgrade solution. As a result, manufacturers have the challenge of determining an appropriate and cost-effective migration path.
The process of replacing every terminal is costly and time-consuming for manufacturers. In addition to the hardware expense, they will need to integrate the systems. The alternative is to provide EMV upgrades, which must incorporate the necessary card readers with EMV Level 1 and Level 2 “kernels,” along with PA-DSS and PCI DSS compliance.
Testing and certification presents a further challenge. Terminals must pass extensive testing and certifications before they are EMV-ready. Responsibility for this will sit with the manufacturers and solution providers, and covers two key areas.
The first is EMV Level 1 and Level 2 testing at the terminals. The problem for manufacturers is the amount of time and resources required to build and test their own devices, along with the EMV card reader and applications. These resources are in short supply – not only among manufacturers, but also across the payments industry. EMV tests are conducted by a small number of laboratories, and signs point to a shortage of labs to do the work.
The second is end-to-end testing. This covers the integration of the messages from the terminal through the payment gateway and to the payment processor. This is a laborious process, and parts of the testing need to be repeated for each processor. The processors will be receiving high volumes of testing requests, so there could be major delays when it comes to scheduling the test slots.
Issues in both of these areas could create major bottlenecks, hindering efforts to bring EMV-ready solutions to the market.
Tried and tested approaches
One advantage of the U.S.’ being later to EMV is that the parking industry can now make use of tried and tested approaches. In particular, existing pre-certified plug-and-play EMV solutions – which have addressed many of the problems and are already on the market – offer one way to overcome the technology hurdles. They can provide a quick-to-market, EMV-ready payment system and significantly reduce the risk of testing failures.
A priority for manufacturers is to deliver the right technology to the operators, and it is through this type of best-practices approach that the parking industry can make considerable time and cost savings.
With a smooth migration path, operators can benefit from the increased security of EMV and also put in place a platform for the next wave of payments innovation. Crucially, they can avoid being left behind in a rapidly developing and competitive market.
Jeremy Gumbley, Chief Technology Officer for CreditCall, can be reached at Jeremy.firstname.lastname@example.org. For more information, go to www.creditcall.com.
Article Abstract from August, 2013