EMV-4

Guest Analysis: EMV Lessons from Our Neighbors to the North

PHILIPPE BENITEZ

As the U.S. continues its rollout of EMV technology, it may be useful to look to Canada’s example. Canada officially made the switch to EMV in October 2010 and is now further rolling out contactless EMV to increase the speed of transactions at the point-of-sale (POS). While the U.S. is a much larger market and migration than Canada, the two countries share many similarities that make key takeaways applicable to U.S. stakeholders.

LESSON #1: CHANGE TAKES TIME, SO RECOGNIZE YOUR RUNWAYS
Many Canadian banks and retailers underestimated the complexity and time investment it takes to make the switch to EMV. That should serve as a cautionary tale to U.S. businesses. Migrating issuance, customization and cryptographic systems, as well as educating employees and call centers on fraud procedures, are significant undertakings. Banks need to figure out if they can issue EMV cards through standard cycles or if they need to do special rounds of issuance. As a guidepost, many Canadian issuers started distributing cards over a year in advance of their liability shift. U.S. banks are well within that window.

LESSON #2: EDUCATE CONSUMERS
They need to understand the how’s and why’s of EMV as well. In Canada, multiple stakeholders ran a two-year trial in Kitchener-Waterloo that wrapped up before the official shift, which went a long way in helping to understand obstacles. One of hardest things for Canadians to grasp was that all chip cards (credit included) would require a PIN, something the U.S. has already learned from in deciding to move forward with chip and signature for credit instead of chip and PIN.

LESSON #3 LEAN ON YOUR PARTNERS
Canadian companies demonstrated that cooperation between businesses was key to successful EMV migration and interoperability. Banks need to work together with card bureaus, brands and card or equipment manufacturers. Visa, MasterCard and American Express also have resources to help banks and merchants make the shift.

LESSON #4: EXPECT FRAUD TO MOVE ELSEWHERE
If the effects of the Canadian migration are any indication, plan to keep a close eye on fraud patterns. While counterfeit card fraud will drop sharply, it’s highly likely that online and card-not-present (CNP) fraud will increase. In Canada, CNP fraud jumped from just over $128 million in 2008 (pre-shift) to more than $259 million in 2011 (post-shift). Issues such as ATM fraud will also continue to be an issue. Additionally, banks should realize that outdated magnetic strip transactions will still need to be supported at retailers opting to lag behind on the EMV upgrade.

LESSON #5: PLAN FOR CONTACTLESS EMV
Because EMV-ready terminals are generally supportive of contactless card and near field communication (NFC) payments, start thinking about this next frontier. In Canada, the number of people using contactless cards is estimated to have nearly quadrupled between 2009 (pre-shift) and 2013 (post-shift). In parallel, as of mid-2014, 75 percent of major Canadian retailers accepted contactless payments. Not only do contactless payments significantly increase consumer spend, they also simplify the POS payment experience to “tap-and-go” instead of “dip-and-pay.” Average POS transactions take 12.5 seconds with contactless EMV, as compared to 26.7 seconds with contact EMV cards or 33.7 seconds with cash.

Mobile payment EMV also needs to be addressed post-migration. Industry groups like EMVCo have learned from the Canadian migration and are prepared to handle the specifications for mobile this time around.

If U.S. companies keep these lessons in mind, the results can be extraordinary. With 105 million cards active in Canada, the country went from 48% of transactions protected by EMV chips in December 2010 to greater than 75% protected by December 2013. That paid major dividends, as losses from debit card fraud fell from a high of $142 million in 2009 (pre-shift) to $38.5 million in 2012 (post-shift) – a 73% drop.
[team id=”1249″]


The views expressed in the posts and comments of this blog do not necessarily reflect those of ETA.