EMV: What is the "Liability Shift" and What Does it Mean for You?
July, 2015
by John Van Horn
There has been considerable confusion and downright misinterpretation over the upcoming changes in how the liability is placed concerning the new “chip” cards that are becoming prevalent in the U.S. Much of this is due to information that has been spread at parking conferences like PIE and the IPI.
Often the presenters of seminars are from companies that have a “dog in the fight,” so to speak. The equipment vendors and the companies that provide clearing services for the banks and card companies were concerned for two reasons.
First, they might see considerable sales from upgrades to replace existing equipment, and, second, if they make recommendations, they might be wrong and cause pain and loss to their customers. So they hedged their bets.
The presenters at trade shows didn’t mislead, but they had difficulty answering specific questions. This is natural.
Parking Today went to Visa, and found it had produced a document two years ago that answers many of the questions being bandied about concerning the changeover, taking place Oct. 1, 2015.
We have excerpted the Visa document below, with our comments. Note that the exact words from Visa are in standard type, with PT’s comments in italics.
From Visa
As the U.S. migration to EMV chip continues, merchants who are not yet supporting chip processing are encouraged to carefully assess their point of sale (POS) environment in an effort to weigh the costs and benefits of upgrading/replacing their existing system capabilities. This is especially important for small-ticket unattended merchants with low-value, low-risk transactions (e.g., parking meters, laundromats, carwash terminals, etc.).
Before making any chip terminal hardware or software decisions, merchants in these segments need to clearly understand the what, why and how behind EMV chip processing to select the right solutions for their business.
As with any large-scale payment infrastructure change, merchants can often receive mixed and sometimes confusing messages from outside sources. With chip payment technology, any kind of misinformation can lead to invalid assumptions and ultimately faulty business decisions.
Myth vs. Reality
The following addresses some of the most commonly held myths about EMV chip payment acceptance in the small-ticket unattended merchant environment.
Myth: All U.S. merchants must be set up to accept chip payments by 1 October 2015.
Reality: U.S. merchants are not required to support chip processing. However, effective 1 October 2015, the Visa global POS counterfeit fraud “liability shift” will be instituted in the U.S.. With this liability shift, the party that, due to their lack of chip technology, is the cause of a contact EMV chip transaction not occurring (i.e., either the issuer or the merchant’s acquirer) will be held financially liable for any resulting card-present counterfeit fraud losses. Issuers retain counterfeit fraud-related liability if they do not issue chip cards. Conversely, acquirers assume counterfeit liability if the magnetic-stripe data from a contact chip card is copied and used at a noncontact chip terminal.
What it means:
One purpose, among others, of issuing the chip card is to prevent fraudulent duplication of the data on the card (which is relatively easy with a mag-stripe card). So, if a card is duplicated (copied) and used, the card issuer (bank) and the acquirer (organization that handles the transaction for the merchant and through them, the merchant ) are responsible for the fraudulent amount charged if the issuer did not distribute chip cards or the acquirer/merchant did not install chip card readers.
This is for transactions where the card is present. It is not true for transactions where the card is not present (e.g., over the Internet). It also is not true if the card is stolen and used before the theft is reported. The liability is placed on the merchants only if the card is counterfeited and used at a terminal that is not chip-enabled.
Visa is shifting liability only on counterfeited cards. Note: MasterCard, Discover, American Express also have a liability shift for lost or stolen cards. After October 1 2015, the liability for lost or stolen cards will also shift to the merchant if the card is pin-preferring and used at a terminal that doesn’t accept chip and pin.
What is your liability assuming you do nothing? It’s the cost of a parking space. If it’s on-street, it may be only a few dollars, and besides, how often are counterfeit cards used for small-ticket items. Off-street, when dealing with long-term parking, such as an airport, and monthly permits, may be different. Also, if you are a city or a university and have many different potential charges on the cards, the risk may be higher.
Unfortunately, you have to review carefully your potential liability and decide whether to upgrade equipment now, or wait until you would normally upgrade, at the end of your equipment’s natural life.
Myth: U.S. merchants that choose to upgrade their terminal to support EMV chip payment acceptance must install a PIN pad.
reality: Small-ticket unattended merchants must support the processing of transactions without a Card Verification Method (CVM). Unattended merchants are not required to support PIN acceptance. However, if the chip card is presented that supports PIN, and the unattended terminal has a PIN pad, the transaction must be processed with a PIN, if requested.
What it means:
Nope - Assuming you elect to do anything at all, you don’t have
to install a PIN pad. However, if the chip card is used that supports
a PIN, and if there is a PIN pad present, then the transaction must
be processed with a PIN, if the terminal requests it. Note; For non-Visa cards, liability shifts on lost or stolen cards if the card requests a pin and no pin pad is present.
Myth: All U.S. merchants are going to have to invest in chip technology. The magnetic-stripe is going away.
reality: All Visa-branded chip cards will include a magnetic-stripe on the back. Currently, there are no specific plans in place to eliminate the magnetic-stripe.
What it means:
The word “specific” stands out. This probably means that sometime in the future, the long-term future, the mag-stripe will go the way of the dodo bird. Remember, all terminals that merchants use have to be replaced with chip card readers, and there are millions and millions of them.
Myth: Small-ticket unattended merchants that opt to accept EMV chip payments will lose the “No Signature Required” program advantages they have today.
reality: EMV chip payment acceptance does not impact the “No Signature Required” or the Visa Easy Payment Service (VEPS) program. It will continue to operate in the same manner it does today in the magnetic-stripe environment.
What it means:
If, as in many garages, no signature is required on small-amount transactions today, that will not change with the issuance of the chip cards.
myth: Merchants that process EMV chip card transactions do not qualify for the Custom Payment Service (CPS).
reality: EMV chip payment acceptance does not affect small-ticket unattended merchant CPS transaction qualification criteria or interchange rate reduction rules.
What it means:
Some programs that Visa has relative to merchants will not change. Check with your bank.
Thinking About Implementing Chip? Where to Start
How and when you proceed has a lot to do with your existing POS system capabilities and whether you own or lease your equipment. Your acquirer has the chip validation tools to assess your EMV chip acceptance options and help you select the terminal hardware and software that are right for your business and meet all EMVCo and Visa standards. Though not required, small-ticket unattended merchants that are thinking about implementing chip technology in their locations should also consider the following key factors:
Dual-interface Terminal Reader Implementation
If you are going to go through the expense of implementing or upgrading your card readers, you should also consider implementing dual-interface terminal readers, so that you can support contact and contact-less chip acceptance. There are four key reasons that this makes good business sense:
Generally, there is minimal incremental hardware cost, if any.
The message formats are the same for contact-less quick Visa Smart Debit and Credit (qVSDC) and contact EMV chip.
The global POS counterfeit liability shift does not apply to contact-less transactions. Merchants are protected from counterfeit chargebacks made under the EMV Liability Shift if they have deployed EMV-approved contact chip-enabled terminals.
Issuers are liable for all online authorized fraudulent EMV chip transactions (contact and contact-less) that originated at an EMV-capable unattended terminal (excluding ATMs) that supports the processing of transactions without a CVM.
If you are planning to deploy new Visa payWave-accepting contact-less readers, you must ensure that your devices comply with the Visa Contact-less Payment Specification 2.1 or higher.
Dual-interface terminals are able to process chip transactions from various payment products, including contact chip cards, Visa payWave (contact-less), mobile devices and wallets, and magnetic-stripe cards.— End of Visa-supplied material.)
In the end, the onus is on the merchant to decide whether the liability is great enough to upgrade or replace their equipment. If you are in the process of replacing or upgrading, by all means proceed. If you aren’t, consider all your options before you act. Discuss it with your equipment vendor, your credit card processer, and there are consultants who deal with this issue.
More information on this topic can be obtained in a white paper produced by the Smart Card Alliance and the IPI. It can be downloaded here:
www.smartcardalliance.org/publications-emv-and-parking/
John Van Horn is Editor of Parking Today. Contact him at jvh@parkingtoday.com.
