EMV and 'chip and pin' support in MyCard
Posted by Jeff Tweddale on 25 Mar 2015 03:21 PM
What is EMV "chip and pin" and what does it mean for MyCard?
There is a regulatory change occurring in North America where the liability for fraudulent credits cards containing a 'chip' will shift with the advent of the 'EMV' change. EMV is the global standard for smart card payments and acceptance devices, named after the developers: Europay, MasterCard, and Visa. EMV microchip-enabled cards provide stronger security and other capabilities not possible with traditional magnetic stripe cards. Credit card companies are already issuing EMV/chip cards. A special card reader is required to read these EMV chips, but you can still swipe the cards through the same magnetic stripe readers you're using today. However, to encourage businesses to adopt the more secure technology of EMV/chip cards, a liability shift went into effect. Prior to EMV, if you swipe a counterfeit or stolen card, the bank assumed the loss. With the liability shift, if you swipe a counterfeit or stolen EMV/chip card with a magnetic stripe reader, you could be liable for that charge. Liability is with whichever party is the least EMV-compliant in a fraudulent transaction. Thus, depending on how the card was swiped/dipped (pin & chip)/tapped (NFC or 'Apple Pay')/keyed-in, the liability for approving an authorization could be with either the merchant bank or the merchant.
Credit cards processed via MyCard (the payment gateway used within MyPMS - More details) have - and will - continue to work after the 'EMV Liabiity Shift' just like computers did after Y2K - don't get alarmed.
BookingCenter has been working to certify MyPMS with EMV-certified devices for swiping, dipping, and NFC payments. We DO NOT expect to be EMV-ready with devices until the end of 2019. The delays in acquiring card approval, which is granted independently by each 'card brand' (such as Visa, MasterCard, Discover, etc) has caused both delays (we're finally through certification and now awaiting aplication delivery certification) and costs (upwards of $45,000 for full certification 'hard' fees, not including the hundreds of 'human hours' required to certify). This has pushed the expected date for BookingCenter EMV certification.
What should a MyPMS customer do?
Because there are so many thousands of credit-card accepting facilities that do not have EMV-certified hardware and software, the 'liability shift' in North America did not upset the relationship between merchant and merchant provider. Also, few BookingCenter customers see 'pin and chip' credit cards that present fraud. For any manually keyed-in transaction, online booking, or card present transactions with a 'swipe' track and no 'pin & chip' (the vast majority of transactions right now), there is no change required in your use of MyPMS or liability shift. Just keep doing things as traditional.
For card holders who come to your property and present a 'pin & chip' credit card, if you swipe the card and that credit card is found fraudulent, the new 'liability shift' means that the property owner ('merchant') may be liable for fraud costs. Because the card holder possessed a 'pin & chip' credit card, the 'liability shift' governing 'card present' payments (i.e., entered via a swipe or manual entry) will no longer protect the merchant who doesn't use an EMV device to authorize 'pin & chip' cards.
Option 1 : For those concerned with the 'pin & chip' credit card 'liability shift' (i.e., you have exposure to guests who present fraudulent cards, a very small minority in N. American hotels), you may want to request an EMV reader from your merchant provider in order to process 'pin & chip' card present transactions. This would mean posting an 'offline' credit card 'receipt type' in MyPMS, as explained in the article here, as these 'offline' transactions won't process within our MyPMS system. Such an approach would be a mix of processes for your front desk:
This would be 'best practices' behavior in avoiding any fraudulent 'pin and chip' transactions. But it is a mix of processes, which can cause errors when staff is trained on exceptions. We have a more detailed article on using EMV terminals with MyPMS here.
Option 2: Another alternative is to not worry now about the EMV 'liability shift', and continue to run all credit cards as you have done in the past, swiping the 'pin & chip' credit cards for your 'card present' discount rates, which will still work. When BookingCenter is certified with EMV devices, then we will sell subsidized devices to our customers to enable EMV within MyPMS. The liability to this strategy is that if you were to swipe a 'pin & chip' credit card, and it was later found to be fraudulent, you might find your merchant processor won't protect you for fraud costs. Ask your merchant account rep to know more about that situation. Also, we don't have a fixed date as to when our EMV certification will be complete.
Option 3: Another alternative is to never worry about the EMV 'liability shift', and continue to run all credit cards as you have done in the past, swiping the 'pin & chip' credit cards for your 'card present' discount rates, which will continue to work. The liability to this strategy is that if you were to swipe a 'pin & chip' credit card, and it was later found to be fraudulent, you might find your merchant processor won't protect you for fraud costs. Ask your merchant account rep to know more about that situation.
If you want to order an EMV reader...
Then it is necessary to know which EMV devices BookingCenter is in the process of certifying. Any of the devices listed at: http://www.bookingcenter.com/point-of-sale-hardware-and-forms/ are EMV ready. Read the details to make sure the one you choose supports the method for connecting (either ethernet cable or wi-fi) and also whether or not you wish to use NFC (which is what ApplePay is, for example).
If your merchant banker can provide one of these devices for you to use for your 'EMV' transactions, then once we complete certification for the 4 major card brands, we will be able to install our BookingCenter app onto the devices listed on the page at: http://www.bookingcenter.com/point-of-sale-hardware-and-forms/ to make integrated EMV-approved transactions. No additional device will need to be purchased, as the PAX devices listed at the URL above will all work. BookingCenter is not selling our EMV devices yet, but once we begin to ship them, we will notify you via a Newsletter.
EMV is a complex subject and there has been much written about it. There is a good overview with common questions and answers presented here: http://www.creditcards.com/credit-card-news/emv-faq-chip-cards-answers-1264.php.
BookingCenter will make more information available on this article as we near completion of the EMV certification process.