Security Experts:

Visa Hits EMV Milestone in U.S., Looks to Accelerate Adoption

Visa today announced that U.S. banks have issued an estimated one million Visa-branded, EMV chip-enabled cards as the end of 2011. The milestone shows progress the industry is making toward implementing the more secure card technology, but the U.S. is far behind Europe in terms of adoption.

EMV, which stands for Europay, MasterCard, and Visa, uses an embedded microchip and a personal identification number (PIN) to validate the card, the consumer, and the payment transaction instead of a cardholder’s signature. The technology is popular in countries outside the U.S.

The solution provides customers with improved security and acceptance, offering greater control over fraud since Chip point-of-sale (POS) terminals are more commonly brought directly to the customer who then enters a PIN number to complete the transaction, often not having to hand the card over.

Sometimes misleadingly referred to as "chip and PIN," EMV chip is commonly deployed with a variety of cardholder verification methods including signature as well as PIN. Visa said that both methods, as well as "no signature required," will be available to issuers and merchants in the U.S. according to their choice. The critical security advancement is the EMV chip, which protects the cardholder by generating a unique code every time it is used, effectively eliminating the problem of counterfeit cards. The same chip technology also enables mobile NFC payments.

"Migrating the U.S. market to chip will help build an infrastructure for accepting NFC mobile payments, enhance international acceptance and reduce fraud," said Stephanie Ericksen, head of authentication product integration, Visa Inc. "Since announcing our roadmap last year, we have seen strong interest among U.S. issuers large and small to invest in chip technology, as today's milestone shows. The progress is all the more significant considering that just 18 months ago, there were no Visa-branded EMV contact chip cards issued in the U.S."

Consumer EMV chip card programs are available from financial institutions such as Chase Card Services, State Employees' Credit Union, United Nations Federal Credit Union, U.S. Bank, and Wells Fargo. In November 2011, Bank of America Merrill Lynch announced that it would be offering the technology in corporate cards for U.S. international travelers.

"In 2011, Wells Fargo led the way with an EMV smart card pilot to 15,000 customers who travel frequently to countries where chip-based payments is the standard," said Eric Schindewolf, vice president of product development for Wells Fargo Consumer Credit Card. "Based on the overwhelming success of the pilot, we are now considering making this program more widely available."

To support continued issuer adoption of chip payment technology, Visa is introducing Visa Chip Services, a suite of new and existing solutions to help issuers implement programs using EMV chip technology, including NFC-based mobile payments. Built on Visa's extensive chip expertise, Visa Chip Services will help issuers adopt the latest payment technologies efficiently and with minimal infrastructure investment. Several U.S. issuers have already taken advantage of Visa's services to introduce chip card programs, primarily targeted to international travelers, which represents a first step in a more broad-based migration. More than a dozen programs have been introduced since 2010. As issuers become more familiar with chip technology and leverage the groundwork they have already created, interest in more broad-based card programs as well as mobile NFC-based payments is growing as well.

"State Employees' Credit Union was able to build on Visa's expertise and solutions to engage quickly and launch an EMV chip card program in a matter of months, not years," said Leanne Phelps, senior vice president, Card Services, State Employees' Credit Union. "The jump-start helped us to be a leader and provide our members the products and services they want and need."

In addition to consulting services, best practices and testing tools, Visa is able to provide chip data processing and authentication services for issuers who have not made the back-end host system upgrades to be able to recognize and process more complicated chip transaction data.

The services suite has four key components:

• Visa Chip Authenticate is a service where Visa validates the EMV cryptogram on behalf of the issuer, minimizing the need for issuers to make authentication-related host system changes to verify chip transaction data. Issuers can choose to use this solution as a long term solution or on a interim basis while host system changes are in progress.

• Visa iCVV Convert is a chip data conversion and verification service that reduces chip data-related issuer and processor host system changes by converting the chip-based ICC Card Verification Value (iCVV) to the magnetic stripe-based Card Verification Value (CVV) and removing the chip data prior to sending the transaction to the issuer for review and response.

• Visa Streamlined Chip Setup accelerates issuers' time to market through a turnkey setup and testing service for issuers that require a streamlined online-only EMV compliant solution.

• Visa Custom Chip Setup provides issuers requiring online and offline PIN capability with customized guidance on key implementation decisions to develop an optimal chip issuance program.

The Chip Services are consistent with a set of implementation recommendations Visa introduced in early 2012 in order to help financial institutions and merchants make informed decisions as they evaluate competitive vendor offerings. The recommendations focus on using online processing rather than offline functions that can increase cost and complexity for chip card programs.

“The migration to EMV in the U.S. is inevitable. We can anticipate that there will continue to be a strong push to migrate to a new chip and PIN payment architecture in the United States, fueled by multi-national merchants who have seen fraud/chargeback benefits from implementations in other parts of the world,” according to Christopher Justice in a SecurityWeek column. “The migration will be neither fast nor inexpensive, requiring a hefty investment in new technology and new processes. Both merchants and consumers will need to continue to build a compelling business case for migration to chip and PIN cards in order to convince issuers and acquirers to change the payment infrastructure that is currently in place,” Justice added.

Suggested Reading: Will the U.S. be Able to Fend Off the EMV Card Standard Invasion?

view counter
For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.