New payment tech requires changes for cards, points of sale
Just months away, in October 2015, the more secure EMV payment technology hits the U.S. Many campus card programs and virtually every institution will feel the effects. If your campus has not started to plan, the time is now.
Europay, MasterCard, Visa (EMV) is a smart card standard used by the majority of the industrialized world for payment cards. It started its global rollout region-by-region way back in the mid-1990s, and the U.S. is one the last markets to jump on board.
Payment card data breaches like those at Target and Home Depot are part of the reason that the move to the more secure payment technology is finally underway. Another cited reason is that with the rest of the world using the technology, U.S. cardholders need EMV cards more and more when traveling abroad.
Why should colleges and universities care?
First, if an institution issues a combined student ID and branded debit card – Visa, MasterCard, Discover, etc. – EMV will change the card and how it is issued. The new cards will have to include the EMV contact chip in addition to any technology the university requires for on-campus functions.
This only impacts a select number of institutions, as campus cards with on-board branded debit functionality is not widespread. More commonly combined cards included non-branded debit – often called ATM cards – and more recently branded prepaid accounts. Neither of these are impacted by these EMV rules. Often when branded debit is the offering, a separate companion card is issued so again, this would impact the bank card but not the campus ID.
Second, all institutions will need to prepare to accept EMV payments at any and all locations accepting branded credit and debit cards or be liable for fraudulent transactions made on campus.
What is EMV?
Traditional EMV payment cards have a contact chip, and when making a purchase the consumer inserts the card into a reader, enters a PIN and conducts the transaction.
In the U.S. this will be slightly different, as consumers will insert their card and then sign for transaction, rather than enter the PIN.
A major security benefit is that EMV doesn’t transmit the payment card number as it is shown on the card, but instead creates a one-time number that is usable for that specific transaction. If that transaction is intercepted, it cannot be reused and the card number is not compromised so fraud is reduced.
EMV will be big business in the U.S. with 185 million cards shipped in 2014, according to the Smart Payments Association.
While there isn’t a mandate for banks to begin issuing cards or for merchants to begin accepting them a liability shift takes effect in October is driving the migration. In the past, the merchant has been responsible for covering the cost of fraud from payment cards, but the liability shift puts the onus on the party with the weaker technology – either the merchant or the card-issuing bank.
For example, if a merchant has upgraded the point-of-sale terminal and backend system to accept EMV but the issuing bank has not provided an EMV card, the bank will be responsible for a fraudulent transaction. The opposite is also true. If a bank has issued an EMV card but the retailer has not upgraded systems, fraudulent transactions will be the responsibility of the merchant.
Financial institutions are quiet
Several banks with campus partnerships told CR80News editors that they will support EMV, but none would reveal details of how they intend to do it.
Generally speaking, a campus with a combined branded debit and campus ID will first have to look at its card printer and find out if it’s capable of printing smart cards, says Alyssa Arredondo, director of Global Instant Issuance Marketing at Entrust Datacard. Additional changes to the software might need to be made in order to properly encode the chip on the smart card.
What your campus should do to prepare for EMV
There’s a lot of confusion about EMV, what it is and how it’s going to impact campus card banking relationships. For example, a Midwest university interviewed for this article reported that it began issuing EMV cards in January. Upon further investigation, that wasn’t the case. They were issuing a new contactless card that can be used for closed-loop payments on campus, but this is quite different from EMV. The campus card includes Visa-branded debit so the program does fall squarely into this fall’s liability shift impact. There will likely be some big changes coming to that card program if the card-issuing bank decides to avoid the liability shift and issue EMV cards. New equipment will have to be used in order to encode the contact chip, updates to backend systems will be required and existing cards will need to be reissued. Universities with these types of programs need to work with their financial service partner to find out how they will accommodate these changes, determine a plan and decide if any modifications will be enacted in the coming months in advance of the October 2015 deadline. The liability shift is a only months away, so if banks aim to hit the deadline new cards will have to be issued when students come back in the fall.
Preparations also need to be made to prepare for the financial impact of issuing these new cards. The EMV chip will drive per card costs up significantly compared to mag stripe-only cards, Arredondo says. Even more significant costs arise if the campus utilizes technology cards, such as contactless, and these must be reissued. Questions remain as to who will cover these reissuance costs?
Campuses that issue non-branded debit cards need not worry about EMV, at least not for now. Similarly, branded prepaid cards also are not impacted by the current liability shift. Experts suggest, however, that these are only the first steps and future rules may expand areas of impact.
Acceptance also an issue
The EMV piece that will impact far more institutions involves the acceptance of branded payments cards – the many situations and locations in which the campus operates as the merchant.
Any campus that accept credit or debit cards should be preparing for the liability shift. Point-of-sale systems in the bookstore, dining facilities and even vending machines will have to be upgraded if branded cards are accepted and the university wants to avoid the liability shift.
According to one campus card industry expert who wished to remain anonymous, card providers and campuses are racing to meet the liability shift. Upgrading point-of-sales systems, payment terminals and back-end systems is a priority so universities will be in compliance in order to accept EMV cards by October.