NFC TimesThe premier source for news, analysis and commentary on
Near Field Communication and all contactless technology

Visa Inc. has announced a major new migration plan to encourage U.S. merchants to support EMV chip technology, including incentives for accepting contactless cards and NFC-phone payments.

The plan is likely to finally get the huge U.S. payment industry moving toward adoption of the EMV standard to secure point-of-sale transactions. U.S. banks and merchants have yet to adopt a plan for migrating to EMV, unlike every other developed country. At present, U.S. payment cards and terminals use fraud-prone magnetic-stripe technology.

The incentives and requirements start to take effect next year, but it will be several years before EMV technology is rolled out across the United States, which has hundreds of millions of credit, debit and prepaid cards in circulation and 7 million-plus card-accepting merchants.

“Merchants have been sitting on the sidelines waiting for a clear roadmap to be announced, so they knew what technology to invest in,” Randy Vanderhoof, executive director of the Smart Card Alliance trade group, who called the plan by Visa the “ignition” needed to get U.S. payments industry rolling toward EMV. “Now that Visa has signaled that the future will include contact chips and mobile contactless payments, they know what the next generation of payments will look like.”

Perhaps the biggest incentive Visa is offering to merchants to move to chip begins in October 2015 with a liability shift that would saddle merchants with losses for fraudulent transactions that could have been prevented if the merchants had installed chip terminals. Gasoline retailers have two additional years to comply. At present, card issuers bear the cost of most fraudulent transactions, noted Visa.

Liability shifts by Visa and the other major payment card networks were instrumental in getting banks and especially merchants to move to EMV in other regions, such as Europe, the past several years. Visa is the largest payment network in the United States and worldwide.

Noteworthy is Visa’s plan starting in October of 2012 to waive requirements for many merchants to conduct annual assessments for compliance with the PCI Data Security Standard if at least 75% of their Visa transactions are conducted through point-of-sale terminals that accept both contact and contactless chip cards and NFC devices.

Visa introduced this so-called technology innovation program, or TIP, outside of the United States earlier this year, but did not include the requirement that chip terminals also accept contactless in order for merchants to forego the annual PCI compliance assessments. These merchants could meet the requirements–and realize the savings for avoiding the assessments–with contact-only EMV terminals.

Of course, the merchants both inside and outside the United States that participate in the program must continue to comply with the PCI standard, which is designed to safeguard payment account data. And if other U.S. card schemes, such as MasterCard Worldwide, don’t make a similar offer to waive the annual audits, the Visa program will not have a big impact.

“By encouraging investments in EMV contact and contactless chip technology, we will speed up the adoption of mobile payments as well as improve international interoperability and security," Jim McCarthy, Visa Inc.’s global head of product, said in a statement. “As NFC mobile payments and other chip-based emerging technologies are poised to take off in the coming years, we are taking steps today to create a commercial framework that will support growth opportunities and create value for all participants in the payment chain.”

PCI compliance annually costs merchants about $2 billion, according to that Merchant Advisory Group, said Vanderhoof. Other estimates, however, put the cost lower. It’s unclear how much avoiding the annual assessments would save, but it would be substantial. And the merchants would get the savings “even if issuers are slow to issue EMV cards before the 2015 liability shift,” Vanderhoof told NFC Times. The U.S.-based Smart Card Alliance, which represents EMV industry vendors, among others, has been pushing for a move to EMV for years.

Any move in general by merchants to EMV terminals will support the rollout of contactless, since many will probably upgrade to contactless at the same time they change their mag-stripe terminals. At present, fewer than 3% of U.S. merchants accept contactless cards and these contactless payments do not follow the EMV standard.

Also part of the EMV migration plan is a requirement by Visa that U.S. processors be able to handle EMV chip transactions, including the cryptographic messages in the transactions. The requirements and incentives by Visa support the dynamic-data-authentication, or DDA, option for EMV, which creates a unique cryptogram for each transaction, securing both online and offline transactions from cloned cards produced by fraudsters. Less secure static data authentication, or SDA, EMV transactions do not secure offline transactions as well.

U.S. banks and merchants are just starting to support EMV, but only on a piecemeal basis. A few large banks this year began issuing relatively small numbers of EMV cards, targeted at their higher-end customers who travel frequently. Some merchants, most notably the giant retail chain Wal-Mart, have been calling for a move to EMV in the United States. But merchants, in general, have not been keen to move to EMV because of the added costs. Very few U.S. merchants can accept EMV cards now.

U.S. banks also have resisted the call because of the billions of dollars in costs for moving their cards and back-end systems to EMV chip technology. Contactless cards issued by U.S. banks to date carry a relatively inexpensive contactless chip, not one supporting EMV.  

Some banks and payment networks have suggested that the lower interchange fees for debit transactions mandated by the Durbin Amendment of the Dodd-Frank financial reform law would make it less likely that the payment industry would foot the bill for the EMV migration–despite the substantial fraud losses the industry incurs every year from counterfeit cards and growing pressure from abroad to move to EMV.

But Visa’s announcement today shows it is onboard for the migration to EMV, even though more secure EMV transactions might provide additional justification for regulators to further reduce interchange. Banks and card networks contend that part of the interchange fees issuing banks charge are used to cover potential fraud losses, though merchants have argued much of the fees are used by banks for their card marketing and incentive programs.