The U.S. migration to the EMV standard is no longer a matter of "if", it,s a matter of "when". While some countries saw a postponement after their initial migration date was announced, the U.S. merchants and issuers will not have that luxury - there are too many compelling factors driving the United States to the EMV standard. To understand the trajectory of the U.S. EMV migration, Aite Group interviewed executives from 15 of the top U.S. 40 issuers by purchase volume, representing approximately 56 percent of the total U.S. network-branded cardholder population.
While EMV is a well-established standard in the rest of the G-20 countries, the United States has long been a holdout. In western Europe, where EMV was developed and first took hold, EMV was a response to the fraud resulting from the offline environment in which many card authorizations took place; the U.S. telecom infrastructure that facilitated online, realtime authorizations was not feasible in many Europe countries due to the high cost of telecommunications at the time. Thanks to online authorizations and robust fraud analytics, U.S. issuers and merchants did not have the same early problems with fraud, and have not been able to make the business case for EMV work until very recently.
The approach to cardholder verification is a hot topic in the U.S. migration, since the payment networks have taken diverging approaches.
- Visa encourages chip-and-signature as the preferred method,
- while Mastercard, Discover, and American Express are encouraging adoption of online chip-and PIN.
Cards can support more than one mechanism, and issuers will list the CVM mechanisms supported by the card in order of preference. At the time of transaction, the POS terminal sequentially runs through the list of CVMs supported by the card until it finds one that the terminal can support, and the transaction process continues.
The U.S. Migration: Why now?
The costs to migrate to EMV have long been a significant deterrent to the U.S. migration. They are not insignificant:
- 12 million POS terminals at US$ 250 to US$ 300 apiece,
- 410,000 ATMs requiring US$ 2,000 to US$ 3,000 per ATM to upgrade,
- 1.7 billion network-branded credit and debit cards, at a cost of US$4 per card (inclusive of mailing costs).
This brings the total hardware and plastics cost alone to between US$ 10 to 11 billion. When the IT cost to integrate the new technology at issuers, acquirers, and merchants is factored in, along with the opportunity cost of resources focusing on EMV instead of other, revenue-creating initiatives, the business case has not made sense - until recently.
A number of factors have converged to make EMV a reality in the United States. These include the need for interoperability, decreasing costs, increasing fraud, and the drive to create a mobile payments infrastructure based on Near Field Communications (NFC) technology.
1. Interoperability
As the last G-20 country still relying upon the mag stripe, it is increasingly difficult for U.S. cardholders to use their mag stripe cards overseas, particularly at unattended kiosks (for example ticket machines at the train station), which will only accept offline chip-and-PIN EMV cards. Conversely, non-U.S. issuers are increasingly frustrated with the vulnerability of the U.S. payments infrastructure. As illustrated in the previous section, issuers in EMV-enabled countries continue to suffer losses due to criminals taking advantage of the United States' reliance of the mag stripe. International issuers are applying increasingly rigorous risk controls to transactions originating in the United States, which helps them to reduce their risk exposure, but also inconveniences their cardholders who are transacting in the United States for legitimate reasons.
2. Decreasing costs
The cost to upgrade to EMV has decreased for merchants and issuers alike. The cost of chip-enabled plastics has been reduced by 50 percent over the last couple of years, coming down from US$ 3 per card to an average of US$ 1 to $ 2 per card (depending on volume and features). While still much more expensive than mag stripe-only cards (which can be as inexpensive as US$ 0.10 apiece), this reduction in price still represents a big improvement in the business case for issuers.
For merchants, the cost to perform terminal upgrades has also come down. Once an optional add-on, EMV is now part of the standard package for most new terminals. The terminal manufacturers serve a global market and embed EMV in their standard offering rather than creating a one-off version of their terminals for the United States. Thus, as the terminal refresh cycle progresses, merchants will eventually receive EMV-enabled terminals whether they like it or not.
3. Increasing fraud
Thanks to the online authorization infrastructure and sophisticated analytic routines, card fraud was relatively stable for U.S. issuers for much of the last decade, hovering around seven basis points for credit cards and substantially lower for PIN-based debit cards until early 2011.
Then three converging factors began to steadily drive up credit and debit card fraud in the United States:
- Data breaches and skimming: There has been a sharp increase in data compromises that are providing the criminals with ample supply for their counterfeit and CNP card fraud activities. In addition to big processor breaches such as the March 2012 Global Payments incident, in which 1.5 million credit card accounts were breached, cybercriminals are actively targeting retailers' POS systems with malware. The trajectory and sophistication of these attacks promise a continued escalation for some time to come.
- End of the recession: Credit card originations dropped off sharply during the 2007 to 2009 U.S. recession. In the first quarter of 2011, originations began ramping up again, and with the more aggressive account acquisition strategies came a corresponding increase in fraud.
- EMV migration of the UK, Mexico, and Canada: With the United States' closest neighbors' EMV migration well underway, and the fact that 80+ countries around the world are now on the standard, the United States represents a very attractive target for the organized crime rings behind much of the financial fraud. Just as the UK saw a big increase in fraud as its neighbors in continental Europe migrated to EMV, the United States is now experiencing a similar uptick since its payments infrastructure now represents the path of least resistance.
Many of the U.S. issuers interviewed for this report cite 30 percent to 50 percent yearover-year increases in their card fraud losses, which makes the business case for a U.S. migration much more attractive from the issuers' perspective.
Establishing a mobile payments infrastructure
One of the payment networks' stated goals in initiating the U.S. migration to EMV is to help create an incentive for merchants to upgrade to terminals capable of supporting NFC. NFC is a critical component of a card-emulation-based mobile payments infrastructure, and the payment networks have a vested interest in seeing card emulation be the form of mobile payments that takes hold, given that cloudbased mobile payments represent significant potential for the disintermediation of the networks at the POS.
While mobile payments are a long way from a mainstream reality, a robust infrastructure capable of supporting NFC is essential for the card emulation model to work1) .
Decision points for issuers
The U.S. migration will be very different from the others that the industry has seen to date. The market is very fragmented, with no central oversight body willing or able to issue a top-down mandate. The four credit card networks, while aligned on many key points such as the liability shift date at the POS, diverge in other key ways, such as the preferred CVM.
Given the different CVM preferences among the networks, and the fact that the U.S. migration is being presented as a "plan" rather than a mandate, U.S. issuers have many more variables and decision points than their peers in most other countries. Key decision points in issuers' planning process include the migration timeline, whether they will roll out early support for international travelers, preferred CVM, ATM upgrade strategy, chip type, and issuance methodology.
Planned deployment timeline: Issuers don't want to migrate too early - given the continued increasing incidence of database breaches, and the frequent need to reissue cards, issuers don't want the more expensive chip cards in circulation before they are usable at the POS. At the same time, issuers don't want to lag behind their peers and have their cards targeted as the weakest link in the chain.
Eleven of the 15 issuers that Aite Group interviewed expect to have the majority of their portfolio migrated to the EMV standard by October 2015. Four issuers will begin issuance in late 2013, five issuers will begin in 2014, and two issuers have just started the planning process, but are working toward the October 2015 liability shift date. One issuer will begin general issuance in 2015, while another has not yet begun the planning process (Figure 1).
EMV for International travellers: With only three percent of U.S. POS terminals equipped to support EMV, U.S. cardholders traveling outside the United States reap the greatest benefit from chip cards today2) . Due to the increasing difficulty associated with using mag stripe cards outside the United States, the international travel use case represents a logical starting point for EMV deployment for many issuers. Financial Institutions are able to gain experience with EMV with a targeted group of customers, while also providing an important service to a valued client base, since international travelers tend to be higher net worth and higher spending customers. Indeed, the Financial Institutions that have deployed international cards are beginning to reap the benefits, with issuers reporting higher spending associated with those cards, likely because the traveler has the assurance that they will work in a seamless fashion (although seamless may be an overstatement, since many U.S. issuers have chose signature as their preferred CVM for their international travel card, meaning they will not necessarily work in unmanned kiosks.)
When asked about plans to begin issuance against the international travel use case, four respondents indicated that they do so today, two plan to begin issuance to international travelers in 2013, two intend to do so in 2014, while seven have no current plans to focus on this use case (Figure 2).
Cardholder verification method: One of the unique aspects of the U.S. migration is its non-uniform approach to cardholder verification. In most other countries that preceded the United States in migrating to the EMV standard, there was concurrence among the key stakeholders driving the change regarding whether that country would employ chip-and-PIN or chip-andsignature. In the United States migration, there is no driving regulatory mandate, as existed in the UK. The result is that the Visa roadmap for EMV encourages a reliance on chip-and-signature for credit card transactions, which the Mastercard and American Express plans encourage chip-and-PIN.
The unquestionable outcome of the dueling cardholder verification methods will be increased consumer and merchant confusion. Consumers have been trained to expect a uniform experience when transacting with credit cards, regardless of the issuer, and now there will be different experiences depending on the issuer's choice of CVM. The majority of respondents (8) plan to use signature as their preferred Cardholder Verification Method, including all six of the top 10 Financial Institutions interviewed for this report. One top ten issuer also plans to make offline PIN available on request to frequent international travelers.
Interestingly enough, one of the eight Financial Institutions plans to perform an initial roll-out with signature preferred, then migrate consumers over to PIN. Three issuers plan to use PIN as the preference, and three are undecided (Figure 3).
While many issuers are leaning toward signature as the preferred cardholder verification method, this does not address the interoperability issue for international travelers. One solution that some issuers are considering is placing an offline, clear text PIN as the last priority in the cardholder verification method list on the card for cardholders that frequently travel internationally.
Dual interface versus contact chip: The decision of whether to provision cards with a dual-interface capability or only as a contact chip is one which many of the issuers interviewed are still debating. Dual interface cards are slightly more expensive (a few pennies per card at high volumes), but do provide the benefit of being used as both a contact-chip as well as contactless. They also are a good way to begin to train consumers to tap and go, in the hope of eventually migrating consumers to NFC-based mobile payments. Contact chip transactions are more secure, since contactless cards are readable within a range of 4 centimeters and there is the possibility of unintended readouts. Further, U.S. consumers have not to date shown much interest in the tap and go payment method enabled by contactless cards (though this may change as consumers need to change their behavior to a dip instead of a swipe with the transition to EMV.)
Aite Group surveyed 66 financial institutions executives at the May 2013 First Data Leadership Conference to understand their plans regarding chip form factor. The majority of respondents were undecided, while one-third of respondents plan to deploy a dual-interface card, and 9 percent plan to deploy contact-only cards (Figure 4).
EMV at the ATM: Three EMV milestones will shift liability at the ATM, whereby the ATM owner will bear liability for any fraudulent transaction that takes place if the card is EMV-enabled and the ATM is not. The expense associated with upgrading the ATM to support EMV is considerable, with estimates ranging from US$ 2,000 to US$ 3,000 per ATM. The timing is challenging for financial institutions and ATM operators, many of whom spent a considerable amount of money on upgrades and retrofits in recent years to comply with accessibility requirements mandated by the American Disability Act.
While all financial institutions expect to have their upgrades complete in time for the 2016/2017 liability shifts, the path and timeline that each will take to get there differs slightly, as shown in Figure 5. Many financial institutions prioritized their higher risk ATMs for the April 2013 Maestro deadline, in areas that have more likelihood to be used by international travelers. A large regional bank said that it is targeting late 2015 for its ATM upgrades; it processes just 100 cross-border Maestro transactions per year at the ATM, so didn't feel much urgency to upgrade any sooner. The only financial institution that had all of their ATMs upgraded in time for the April 2013 Maestro liability shift indicated that it was more a product of luck than good planning; the financial institution had performed a wholesale upgrade to its ATM infrastructure just prior to the Maestro liability shift announcement; it made the decision at the time to include EMV, cognizant of the fact that it was likely coming soon to the U.S. market.
Portfolio prioritization: A key question that many issuers are wrestling with is how to sequence their EMV rollout. The majority of issuers interviewed are prioritizing the credit card portfolio first. The reasons for this are twofold:
- credit cards represent increased exposure, thanks to the higher lines of credit;
- and the difficulty associated with determining debit card routing procedures, described earlier in this report as "Durbin's Dilemma", caused many issuers to delay their debit card planning process until the AID issue was resolved.
Four respondents plan to roll out debit and credit concurrently, one issuer has a relatively small credit card portfolio and plans to roll debit first, and one issuer is still undecided (Figure 6).
Implications for non-U.S. issuers and merchants
As the last G-20 country to embrace EMV begins its migration, what does this mean for issuers and merchants in the rest of the world? For one thing, the incidence of U.S. consumers who clog up the queues with their antiquated card technology will begin to gradually dissipate.
More importantly, though, issuers and merchants around the world will begin to experience a second wave of migrating fraud. The United States has represented a fertile environment for monetizing stolen card data, and with the migration to EMV, much of that opportunity will dry up. The organized crime rings behind much of the financial fraud will look to other targets, and any merchant that enables CNP transactions will see attempts against it increase significantly. Cross-border fraud on transactions originating from the remaining non-EMV countries will also spike. Issuers and merchants around the globe should take heed and begin preparing to defend themselves and their customers from an increase in fraud in 2015.
Comments
1) For more detail on mobile payments and the card emulation model, see Aite Group's report Digital Commerce Enablement: The Case for a New Payment Network, May 2012
2) See Aite Group's report, U.S. Merchant Acquiring and EMV Readiness, April 2012.