Heading Towards Chip & PIN
Raja Ray, Director of Product Marketing, Trintech Ltd.

UK cardholders are about to experience the biggest change in card payments since the introduction of electronic card payment processing. The UK will become the first country to introduce what is now widely known as 'chip and PIN' - EMV (Europay/Mastercard/Visa) chip-based credit and debit cards with cardholder validation by keying a PIN number rather than by signature.

The decision to move to chip and PIN is driven by fraud. Credit card fraud in the U.K. is growing rapidly and currently costs the industry over £400 million a year - equivalent to £4 for every credit and debit card issued in the country. Over the next two years, fraud levels are expected to rise to over £800 million.

Retailers and merchants are currently liable for only a small amount of this fraud - an estimated £20 million. Most of the cost of fraud falls on card issuers and banks. From 1 January 2005, the card schemes have mandated a liability shift so that UK merchants become liable for fraud unless they accept EMV chip cards. Whilst reducing fraud, chip and PIN will also lead to a displacement of credit card crime - as more and more retailers start accepting chip cards, those who do not will find themselves targeted by organised crime and fraudsters.

Fraud reduction is a strong argument for chip and PIN but implementation comes at a cost. The industry needs to upgrade or replace over 100 million debit and credit cards, 750,000 point of sale terminals and 35,000 cash machines. The total cost to UK banks and retailers is estimated at £1.1 billion. The business case for the banking industry is clear, as the financial industry will cut its fraud bill dramatically.

The case for retailers is less obvious as they currently see less than 5% of card fraud. There is little immediate return on the estimated £350 million merchant investment, although some will benefit from preferential bank charges. Retailers should see less fraud and chargebacks and there are other benefits such as the reduced back office costs for dispute and chargeback administration. But the most compelling benefit for retailers is the protection against increased exposure and liability to fraud in 2005.

Smaller retailers who use bank-supplied stand-alone payment terminals will rely on their banks to replace or upgrade their POS terminals. However larger retailers, representing about 350,000 points-of-sale and the bulk of payment transaction volumes, have built-in card processing and need to add integrated chip and PIN capability to their EPoS system. There is a wide variety of EPoS equipment running on DOS, Windows, Unix and other platforms, all of which need to talk 'chip and PIN'.

Many merchants are looking for a solution that is cost-effective with minimum implementation effort. Retailers will need to invest in EMV level 1 chip card readers, secure PIN entry devices and also EMV level 2 certified application software. EMV certification ensures compatibility between cards, hardware and application. Newer solutions in the market have taken the innovative approach of combining all of this functionality into a single cost-effective PIN Pad unit.

This has the added benefit of being easy to integrate to almost any EPoS equipment and also shields the merchant from any risk of EMV re-certification, a time-consuming and expensive process. PIN security is a critical issue but at this moment UK security and certification requirements for PIN are still to be finalised. Some solutions in the market already meet stringent and established European standards such as ZKA/T-Systems (formerly DEBIS) in Germany. This type of certification should give comfort any retailers evaluating these devices.

Retailers also need to consider operational issues such as who controls the card. In almost all countries that have implemented PIN, the customer holds onto the card. Some retailers will expect customers to handle chip cards from the beginning. Others have decided that the cashier handles the card to maintain the existing customer experience and avoid confusion during the transition period from magnetic swipe to chip.

In any case, cardholders will quickly become comfortable in handling the card themselves and have a growing desire and expectation of retaining the card. A PIN pad that features an integral card reader offers a good solution for both cashier and customer card handling, particularly where the card reader is vertical so that the card can be inserted easily from both sides of the till. Other solutions, where the card reader and PIN pad are separated, will need to tackle the added requirement and complexity of secure triple DES encryption of messaging between the two devices.

A handful of retailers have signalled their intention to be part of the industry town trial in Northampton early in 2003. Others have begun looking at the various solutions in the market. But for many, time is running out. December 2004 is not as far away as it seems.

Please contact Raja Ray, Director of Product Marketing, if you have any queries.