EMV Technology
Commercialization in the
UK and Canada (and the
US)
Entrepreneurship and Innovation Strategy
Andrew Akers
Daniel Bogomoltz
Lisette De Later
Jonathan Mitchell
Shannon Mosier
Brian Ramirez
November 11, 2011
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
CONTENTS
SECTION 1 EXECUTIVE SUMMARY .................................................................................................................... 3
SECTION 2 EMV OVERVIEW ................................................................................................................................ 4
2.1
2.2
2.3
History of Consumer Credit and Debit Cards ........................................................................................ 4
Advantages of EMV.................................................................................................................................. 5
Existing Payment Card Ecosystem ........................................................................................................ 6
SECTION 3 IMPLEMENTATION OF EMV IN THE UK ......................................................................................... 8
3.1
3.2
3.3
3.4
UK Implementation Timeline ................................................................................................................... 8
Idiosyncratic Context of Payments in the UK ...................................................................................... 10
Commercialization Strategy of EMV in the UK .................................................................................... 11
EMV in the UK today .............................................................................................................................. 12
SECTION 4 EMV IMPLEMENTATION IN CANADA ........................................................................................... 13
4.1
4.2
4.3
Lessons Learned in Pilot Phase ........................................................................................................... 13
Liability Shifts and Delays ..................................................................................................................... 13
Successes in Mitigating Fraud & Converting Consumers ................................................................. 14
SECTION 5 RISKS AND CONSIDERATIONS OF THE US AND CANADIAN EMV STRATEGY AND
IMPLEMENTATION ......................................................................................................................... 15
5.1
5.2
5.3
5.4
Co-innovation Risk ................................................................................................................................ 15
Adoption Chain Risk .............................................................................................................................. 16
Relative Benefit ...................................................................................................................................... 17
EMV as a Disruptive Innovation ............................................................................................................ 20
SECTION 6 ADDENDUM: EMV IN THE US ....................................................................................................... 22
6.1
6.2
6.3
6.4
The Resistance to EMV .......................................................................................................................... 22
The Timing Seems to be Now ............................................................................................................... 23
Commercialization Strategy .................................................................................................................. 24
Strategy Risks and Considerations ...................................................................................................... 25
2
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
1 Executive Summary
EMV, a credit and debit payments system based on chip card technology, has defined a new global standard
for authenticating secure payment transactions. At the end of 2010, there were more than 1.24 billion EMVcompliant payment cards in use around the world. Developed in a partnership between Europay, MasterCard,
and Visa, EMV improves upon the magnetic strip technology used in conventional credit and debit cards,
providing enhanced security measures, increased speed of payment processing, on-chip data storage, and
versatility of use with contact and contactless terminals.
This paper examines the successful implementation strategies of EMV technology in two markets, the UK and
Canada, and then briefly assesses and contrasts the current implementation strategy of EMV in the US. In the
UK and Canada, fraud reduction was a necessary but also sufficient criterion to drive the adoption of EMV. In
the US, fraud remains a peripheral consideration, and the major card issuers are positioning EMV to prepare
the retail point-of-sale infrastructure for EMV-enabled contactless and mobile payment technologies.
We examine the various market commercialization strategies employed by the EMV partners in each market,
paying particular attention to fraud liability shifts instituted by Visa and MasterCard to mitigate adoption, coinnovation and adoption chain risk. We also assess the relative versus absolute benefits of EMV given the
technology’s limitations, as well as compare the disruptive innovation s-curves of conventional mag-stripe vs.
EMV technology.
□□□□□□□□□□□
3
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
2 EMV Overview
EMV (Europay, MasterCard, and VISA) is a credit and debit card technology that sets a global standard for
authenticating secure payment transactions. The full name is a reference to the joint effort between Europay
International SA (which was later absorbed by MasterCard), MasterCard and VISA in their effort to ensure that
their products are secure, inter-operable and accepted globally. However, the alliance is not limited to these
companies, and has grown in recent years to include JCB, which joined in 2004, and American Express, which
joined in 2009.
EMV technology, first introduced in 1996, aims to address pervasive payment and identity fraud. EMV
equipped chip cards are powered by an embedded microprocessor, which provides enhanced security features
that current magnetic stripe cards cannot. The microprocessor or “chip” is secured behind a 1cm square
contact on the front of the card. The chips enables contact and/or contactless technology to process secure
payments. When contact cards are placed into the card reader, the contact with the terminal provides power
for the chip to transfer secure data and complete the transaction. By contrast, the contactless chip cards can
be held a few inches from the contactless card reader, and the chip is powered through radio frequency
emissions to transfer the data for a secure transaction.1
2.1 HISTORY OF CONSUMER CREDIT AND DEBIT CARDS
The idea for credit cards emerged in the early 1900s from large companies such as department stores issuing
their own credit cards that could only be used at their stores. The idea was not to increase consumer
convenience, but to develop customer loyalty. It was not until 1946 that John Biggins introduced the first credit
card, which was appropriately called “Charg-It.” However, this was limited to Biggins’ customers in Brooklyn,
New York who kept their savings with Biggins’ bank. The Diners Club Card was the first credit card that saw
widespread use. The Diners Club Card debuted in 1949 after Frank McNamara decided to found the company
after he forgot his wallet for an important dinner and realized that he needed an alternative to cash. Within two
years of its founding, Diners Club had over 20,000 cardholders as customers.2
American Express, formerly a delivery service, introduced its own credit card in 1958 and the plastic credit card
in 1959. Soon after, it introduced credit cards in other countries’ currencies, and grew a user base of 1 million
cards worldwide by 1964.2 The magnetic stripe was first attached to the back of plastic payment cards in 1960
and migrated to credit cards shortly after.3 The industry grew exponentially thereafter, and in 1966, Bank of
America established the BankAmerica Service Corporation, which developed the concept of franchising credit
1
http://www.emvco.com/about_emv.aspx
http://www.creditcards.com/credit-card-news/credit-cards-history-1264.php
3
http://en.wikipedia.org/wiki/Magnetic_stripe_card
2
4
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
cards nationwide to banks. This eventually led to the creation of VISA and MasterCard, which still operate as
“open-loop” systems, as compared to the “closed-loop” systems of American Express, Diners Club, and
Discover Card, each of which issue their own cards direct to consumers.2
Credit card flexibility led to the creation of the debit card in 1984 when Landmark installed the first nationwide
debit system. This innovation allowed smaller banks to connect with each other across state borders. Debit
cards allowed consumers to withdraw cash more quickly than in person bank visits, provided more
convenience than a check, and eliminated the risk of carrying cash. Debit transactions eventually overtook the
number of checks written globally in 1998.4
2.2 ADVANTAGES OF EMV
The primary advantage of EMV is that it reduces payment card and identity fraud. Using chip technology
instead of magnetic stripe technology prevents “skimmers” from stealing card information during the traditional
“swipe” transaction when a consumer purchases goods at a merchant location or withdraws money from an
ATM.5 To skim card information, thieves alter merchant terminals or put fake fronts on ATMs to steal card data
from the mag-stripe as the consumer swipes his or her card. The thief can then clone the card by creating a
second mag-stripe card and use it to purchase goods or withdraw money from ATMs. With the introduction of
chip, EMV-enabled terminals and ATMs can now tell whether a card is supposed to have a chip embedded in
it. Therefore, if a thief clones a chip card, the EMV-enabled terminal or ATM will automatically decline the
transaction as fraud. Note, however, that cloned chip cards can still be used in non-EMV-enabled terminals
and ATMs, which are still utilized today in countries such as the United States.
One thing to note, however, is that while EMV reduces a significant portion of payment card fraud, mainly
counterfeiting, skimming and lost and stolen fraud, it does not address card-not-present (CNP) fraud6. This
rapidly growing form of fraud includes internet and phone transactions.
Additional benefits of EMV cards include faster processing than magnetic stripe cards and increased data
storage for cardholder information. Contactless card transactions are 53% faster than magnetic stripe card
transactions and 63% faster than cash transactions.7
4
http://www.brighthub.com/money/personal-finance/articles/42073.aspx
http://www.ncollin.demon.co.uk/Future/emv_chip.htm
6
http://www.emv-usa.com/faq_cardnotpresent.html
7
http://www.emvco.com/about_emv.aspx
5
5
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
2.3 EXISTING PAYMENT CARD ECOSYSTEM
The credit/debit card ecosystem primarily revolves around five main players:
 Cardholder: The cardholder provides information to the issuer when applying for a
credit or debit card, and is responsible for monitoring and paying his/her monthly
balance. During a transaction, the cardholder is responsible for presenting the card to
the merchant or for providing the card details during a CNP transaction.
 Issuer: The card issuer is typically a bank, or, in some cases, the credit card
company, as in the case of American Express and Discover Card, which operate
closed-loop systems. The issuer authorizes and settles transactions on behalf of the
cardholder. In addition it performs on-going tasks such as acquiring cardholders,
managing the account billing and monitoring risk, etc.
 Network: Networks, such as Visa and MasterCard, are the major players in the
payment ecosystem. They effectively “switch” or route transactions between acquirers
and issuers. Additionally, they create standardized operating rules, develop new
products and invest in brand promotion.
 Acquirer: The acquirer accepts card payments on behalf of a merchant. It plays a
similar role for merchants as the issuer does for cardholders, including authorization
and settling transactions as well as acquiring and managing merchant accounts.
 Merchant: The merchant is the entity that provides the good or service for sale. It
pays an interchange fee, typically 1-3% of the purchase price, to the accept payment
cards.
6
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
Additionally, secondary ecosystem players such as ATM and terminal manufactures and deployers as well as
Chip manufacturers play a role. We will discuss how these players become more important in the EMV
landscape when reviewing adoption and co-innovation risks.
7
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
3 Implementation of EMV in the UK
In 2002, the growing number of counterfeiting cases in the country was beginning to impact the credit card
payments system in the United Kingdom. Organized credit card crime rings accounted for losses of GBP 160
million in 2001, growing at 50% YOY8 compared to 2000. Additionally, consumer concern over the safety of
the payment industry was growing. This trend motivated the Association of Payment Clearing Services
(APACS), in partnership with the UK Government and the Home Office, to launch an initiative to reduce fraud.
It chose Chip and PIN as the technology to do so.
The technology was supposed to dramatically reduce the fraud on credit card payments at POS terminals9 by
adding a chip to payment cards and by requiring consumers to insert a PIN number in the terminal while
completing a transaction. The Chip and PIN technology represented a new standard for payment security that
in the future would be called EMV. The initial estimation of the total cost to implement the new system was
around GBP 1.1 billion10, and the target was to complete a full migration to the new system in 3 years11.
Performing such a large-scale migration was very challenging, and as a result, it took much longer than
expected to achieve a full EMV implementation in the UK.
3.1 UK IMPLEMENTATION TIMELINE
APACS launched the first trial of Chip and PIN (the commercial name for the implementation of EMV
technology) in May 2003. Involving 600 shops and 180,000 cards in Northampton, the trial ran until September
and was declared a great success by the public, retailers, and banks. 83% of the public in Northampton were
in favor of switching to Chip and PIN12. In addition to the security and fraud mitigation benefits, Chip and PIN
proved itself to be an efficient and customer-friendly system.
With the success of the trial, APACS started to roll-out the solution nationally. By January 2004, around eight
million chip cards were issued, which represents one out of six cardholders in the UK. On the retailer side,
approximately 100,000 businesses were accepting Chip and PIN card payments13. The first milestone was the
implementation of Chip and PIN in over 450 Safeway supermarket stores.
In the following months of early 2004, a series of articles were published strongly recommending small and
medium size businesses (SMB) migrate to Chip and PIN technologies. Market analysts and directors from Visa
8
http://goliath.ecnext.com/coms2/gi_0199-1617787/Unique-police-unit-pilot-to.html
A POS (Point Of Sales) terminal is the location where a transaction occurs, using hardware and software to realize a payment.
10
Frost & Sullivan Market Insight, 11 Feb 2002
11
http://www.foodanddrinkeurope.com/Financial/Safeway-first-UK-store-to-introduce-chip-and-PIN-technology
12
http://www.eft-pos.com/news-chipandpin.html
13
Chip and PIN Barometer. January 2004. http://www.chipandpin.co.uk/
9
8
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
warned SMB companies that fraudsters could set their sights on companies without Chip and PIN terminals
and significantly increase the level of fraud.
The implementation of EMV
technologies continued steadily.
77 million cards were issued to
approximately 36 million people,
with 400,000 individual retailers
included in the program, involving
more than 636,000 points-of-sale
by December 2004. However,
there was evidence that some
retailers struggled to justify the
expense of equipping stores with
the new systems, citing the fact
that they did not realize any
monetary benefit from reducing
fraud levels14.
On April 2005, although significant penetration of Chip and PIN had been achieved, some concerns emerged
about the ability for the UK to reach 100% adoption. At this point, Visa and MasterCard mandated the roll-out
of chip and pin systems by January 1st 2006, proposing a liability shift for fraud from issuers to merchants after
this date.
The actual date set to turn the key for the full implementation was defined as February 14th 2006, Valentine’s
Day. A big campaign was launched in the UK to acknowledge the implementation of the Chip and PIN
technology. Six months later, APACS issued an update of the progress of the implementation, noting15:
 99.8% of all chip and pin transactions were verified by a PIN
 Counterfeit fraud and fraud on lost and stolen cards was down by £60m (a drop of
24% year over year, from 2004 to 2005)
 92% of cards issued (130 million out of 141 million) were chip and pin enabled
 87% of all terminals in the UK were chip and pin enabled
14
15
Chip and PIN Barometer. December 2004. http://www.chipandpin.co.uk/
Chip and PIN Barometer. January 2004. http://www.chipandpin.co.uk/
9
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
The implementation was considered a success, and the UK became a model example followed by several
other countries in Europe. As of June 30, 2010, about 20 European countries have a 100% ATM compliance
with EMV.16
3.2 IDIOSYNCRATIC CONTEXT OF PAYMENTS IN THE UK
In 2003, there were 60 million credit cards issued in the UK, with the number aggressively rising by 6 million
compared to the 2002. With
respect to fraud, 2001 was a year
that scared the UK, with counterfeit
fraud growing from GBP 107
million to 160 million, and reaching
a peak of 0.183% fraud rate over
total credit card turnover in that
year17. The UK had one of the
highest fraud rates among
developed countries, and both
private and public initiatives
needed to be coordinated to fight
back18.
During the years of implementation of Chip and PIN, counterfeit fraud was “controlled” in the GBP 100 million
range (except from 2004, when it reached GBP 300 M) 19, signaling to the authorities that the efforts to prevent
fraud were effective.
With the full implementation of EMV in 2006, fraud on
cards issued in the UK migrated to international
markets, with fraudsters getting information from the
magnetic stripes of UK cardholders, and using it to
make purchases abroad.
In percentage points, during the introduction of Chip
and PIN fraud reduced considerably from its peak in
2001 to a rate of 0.095% in 2006, as can be seen in
16
https://www.european-atm-security.eu/content/files/EMV%20Numbers%2030-06-10(2).pdf
Financial Fraud Auction UK. http://www.financialfraudaction.org.uk/Financial-Lost-Stolen-Fraud.asp
18
http://www.financialfraudaction.org.uk/Financial-Lost-Stolen-Fraud.asp
19
Financial Fraud Auction UK. http://www.financialfraudaction.org.uk/Financial-Lost-Stolen-Fraud.asp
17
10
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
the fraud to turnover ratio chart.
3.3 COMMERCIALIZATION STRATEGY OF EMV IN THE UK
The case of the UK is considered the best example of successful implementation of the EMV technology, and
was followed shortly by several other European and non-European countries. The implementation was led by
APACS20, on behalf of the society and the government of the UK. The cost that the society was paying for
fraud was the major motivation driving the initiative. As a leader, APACS had to guarantee that all players of
the ecosystem would agree to migrate to the new standard. However, not all players benefited equally from
the movement to EMV. For example, while merchants had to pay to buy new terminals and update software,
they did not benefit directly from EMV. To counteract this concern, APACS worked with at least two main
levers of implementation: the organization developed financial stimulus to incentivize merchants’ acquisition of
new POS equipment, and by 2006 APACS also mandated a liability shift, in which merchants would be
responsible for fraud committed on terminals that were not Chip and PIN-enabled.
With the merchants’ adoption incentive “solved”, APACS also had to deal with banks that delayed investments
and missed deadlines of migrations. Although there were delays, it took the UK three and half years from the
first trial to the fully implement the solution.
UK banks had a big interest in the implementation of Chip and PIN. Before the implementation of the Chip and
PIN, whenever a fraudulent magnetic swipe card transaction occurred and it was not the fault of the merchant,
the issuing banks had to refund the retailers. However, with the introduction of the Chip and PIN, the liability
for these fraudulent transactions shifted to the retailers, creating a high incentive for them as well to adapt their
POS-systems to the new EMV-technology. As a result, most chains upgraded their system before the EMV
deadline. However, as the upgrade required a completely new POS-system and therefore a high investment,
many smaller companies were not able to adopt that quickly.
Also Card issuers played a significant role in the adoption process because they were required to replace all
old cards with Chip and PIN cards according to the bank’s requirements.
Consumers were individually contacted by their issuing banks and would initially receive new Chip and PIN
cards when their old cards were to expire. However, this created some major issues as many consumers’
cards were not set to expire until as late as 2007. As a result, issuers were forced to send out Chip and PIN
cards ahead of schedule to meet the EMV deadline.
20
The APACS is a United Kingdom trade organization that brings together all payment systems organizations and gives banks,
building societies and card issuers a forum where they can work together on non-competitive issues.
11
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
3.4 EMV IN THE UK TODAY
By the end of 2006 EMV was already considered fully implemented in the UK, with more than 90% penetration
among cardholders, and 87% penetration among terminals. Fraud levels, as seen above, went to the lowest
level in a decade (0.074% of total cards
transactions), and the lowest monetary
amount of fraud (GBP 365 million) since
2001.
Further, a recent study shows that EMV
implementation in Europe increased from
52% in 2005 to 95% in 2010. In the same
period, fraud losses remained in the €3045 million range, decreasing as a
proportion of overall volume of
transactions21.
21
“World Payments Report 2011,” Capgemini, RBS, EFMA. www.wpr11.com
12
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
4 EMV Implementation in Canada
Canada, which has the world’s highest payment card market share for non-cash transactions at 68%22,
followed the EMV lead in Europe with a mandate by Visa in 2004 to convert all credit cards by 2010.
MasterCard, American Express, and the Interac Association (which operates the debit network) joined Visa for
a pilot in Kitchener-Waterloo in 2007 and began a national commercial rollout at the end of 2008. The
implementation proceeded very smoothly given the lessons learned during the pilot, and by December 2010,
EMV compliance had been achieved for 70% of cards, 55% of POS terminals, and 90% of ATMs deployed by
financial institutions.23
4.1 LESSONS LEARNED IN PILOT PHASE
The pilots revealed that customers had more difficulty than expected in remembering their PIN, despite the
longstanding use of a PIN for debit transactions. Based on the pilot, banks opted to allow the user to select
their PIN or assigned the PIN already used with their debit card rather than a random PIN.
Terminals were also revised to prompt users to remove the card after the transaction was verified, as
customers had a tendency to forget the card in the terminal. Finally, consumer and merchant messaging was
revised to emphasize the increased security and risk that fraud would migrate to Canada as the rest of the
world adopted EMV, as the fraud reduction message alone did not resonate strongly given the relatively low
levels of fraud in the country24.
4.2 LIABILITY SHIFTS AND DELAYS
Despite the momentum and deadlines which were
set for conversions to EMV Chip and PIN by
October 31, 2010, Visa and MasterCard
separately announced a six month extension for
retailers in late September 2010, just weeks
before a planned shift in liability that would have
made retailers fully accountable for fraud if they
chose not to use the card chips in favor of the old
magnetic strip technology. MasterCard explained
that the extension came in response to Canadian
market dynamics and intended to give Canadian
22
EMVCanada.ca
“Canada puts down chip card roots,” Peter Lucas, Digital Transactions, 1 June 2011.
24
Ibid.
23
13
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
merchants more time to migrate to the Chip-and-PIN point-of-sale technology. Visa explained that the
extension had been requested by retail chains in Canada who were scrambling to implement EMV compliant
technology ahead of the busy holiday shopping season. The push-out was also caused by POS hardware
delays experienced by integrated merchants and automated fuel dispensers. Interac has set a final deadline
for conversion of all ATM transactions by December 31, 2012 and all POS transactions by December 31, 2015.
4.3 SUCCESSES IN MITIGATING FRAUD & CONVERTING CONSUMERS
Recent encouraging findings are showing that EMV enabled transactions are reducing fraud. Moneris
Solutions, a Canadian processor, released information that showed fraud had decreased with chip cards and
enabled terminals, citing the fact that merchants who processed greater than 40% of total transactions using
chip technology experience on average up to four times fewer chargebacks than those who processed less
than 40% of total transactions using chip-and-pin technology. Interac published results in March 2011 that
showed an overall 16% decline in fraud in 2010 over 2009. Although it has happened gradually over five years,
consumer perceptions have also shifted significantly. 80% of Canadian credit card holders say they now prefer
EMV chip technology over the old magnetic strip technology25. These positive signs for EMV in Canada are
already having knock-on effects in the US where fraud has been increasing.
25
http://www.transactionworld.net/articles/2011/june/innovative_iso.asp
14
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
5 Risks and Considerations of the
UK and Canadian EMV Strategy
and Implementation
The successful commercialization of EMV in the UK and Canada is best understood by examining the
approach taken through the lens of three key sets of frameworks:
 Co-innovation and adoption chain risk given an uneven distribution of costs and
benefits amongst value chain players
 Relative versus absolute benefit
 Disruptive innovation and the s-curve
5.1 CO-INNOVATION RISK
Co-innovation was not a significant risk by the time the UK and Canada began migration to EMV. The coinnovation risk from the chip manufacturer side had previously been mitigated as EMV uses a proven, massproduced, standardized technology with integrated circuit or “smart” cards. The smart card chips have been in
mass market use since the early 1980s with Telecarte for French payphones, and saw a major boom in the
1990s with the use of smart-card-based SIMs in GSM phones. By using uniform EMV standards, chip card
issuers were able to ensure that the payment cards they provided to their cardholders would work in EMV
compliant acceptance infrastructures anywhere in the world.
However, there was one co-innovation risk inherent in the system at the time during the time of initial launch in
the UK.
 ATM and POS Terminals. In order to implement the EMV technology successfully, all
ATM manufacturers have had to develop new readers and POS systems for ATMs and
terminals that could interface with the new EMV smartcards. Also, banks have found
themselves struggling to keep networks up and running using traditional, manual,
testing procedures26.
To be able to realize a cost-effective EMV migration process for ATMs, the ATM
manufacturer and financial institutions had to closely work together and match the
several requirements and protocols for both parties. However, at multiple points in
time, ATM manufacturers had a hard time catching up with the high demand for the
new technology migration.
26
http://www.atmindustryinfo.com/2010/03/challenges-in-migrating-to-emv.html
15
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
5.2 ADOPTION CHAIN RISK
The uneven distribution of costs and benefits between players generates considerable adoption chain risk for
the innovation ecosystem. This risk is further aggravated by the need to have 100% compliance or else fraud
will shift to any remaining unprotected users. Ultimately, the need for 100% compliance coupled with the
resistance by players who accrue costs but not benefits from adoption creates a dynamic in which ecosystem
leaders force adoption on weaker players in the value chain. The following section explores the adoption chain
risk from the perspective of each player in the ecosystem.
 Merchant. The merchant incurs the greatest discrepancy between cost and benefit,
strongly curtailing its desire to adopt the new technology. The benefit of reducing
fraud cost accrues to the issuer, whereas the merchant incurs the highest cost for
upgrading all point-of-sale (POS) terminals to be EMV-compliant. For example, this
cost burden has been estimated at $2.4-2.6B for the US alone.27
The burden is further increased for three types of merchants:

Larger merchants with integrated POS systems who own rather than lease the
hardware prefer to wait for technology upgrades (such as contactless) in order
to make upgrades that materially benefit their check-out process.

Restaurants, which traditionally take customers cards to swipe at a central
machine, have to invest in wireless terminals that can be brought to the table to
complete the PIN-enabled transaction without inconveniencing the customer.
Not only are these terminals more expensive, but the restaurant requires a
larger number of terminals in order to complete simultaneous transactions.

Automated fuel dispensers require more expensive hardware that conforms to
more stringent electromagnetic interference specifications given the flammable
environment in which they are installed.
Despite this strong disincentive to migrate to EMV, merchants have ultimately been
forced into upgrading POS terminals by the liability shift imposed by the credit card
brands, whereby they become liable for fraud occurring on non-EMV compliant
terminals.
The pattern of terminal adoption observed suggests that this liability shift has been a
very effective motivator of merchants in the commercialization process of EMV. As of
Q1 2011, in Canada and Latin America combined, 76.5% of terminals are EMVcapable while only 31.2% of cards have chips. Similar trends exist in other regions in
27
“EMV in the USA: Waiting on Debit, a Mandate, or Just the Opportune Moment,” George Peabody, Mercator Advisory Group,
Dec 2010.
16
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
which EMV is still gaining traction (Eastern Europe: 65.4% terminals, 12.7% cards;
Asia Pacific 43.0% terminals, 27.9% cards).28
 Issuer. Issuing banks incur replacement costs of $2.00 per EMV card or $2.35 if the
card also supports contactless payments29, the most widely adopted solution at this
point; however, the gains from fraud reduction outweigh the upgrade costs in most
cases and lessen the adoption risk from the issuers. Additionally, they must update
their own software as well as collect and load more types of sensitive cardholder
information on cards than before, increasing costs and management efforts.30
 Consumer. Given a national rollout, there is not significant adoption risk from
consumers as all of their payment cards can be replaced within a short timeframe,
thereby eliminating the option to favor non-EMV compliant forms of payment.
Furthermore, consumers are used to regular replacement cycles for their existing debit
and credit cards. The issues of customer education and training surrounding PIN and
terminal usage have been well understood and addressed during pilots in advance of
full scale commercialization.
 Payment Network. Payment brands benefit from the increased perception of security
when making payments. Therefore, as soon as one player converts to EMV, there is
an “adoption pull” as other players rush to match the perceived security benefits in
order to attract customers and ensure that fraud will not migrate to their networks. A
good example of this phenomenon was the rush by Interac, the Canadian debit
system, to support EMV as soon as Visa and MasterCard announced their intentions
to do so for fear that transaction volume would shift from debit to credit cards if the
latter were perceived as more secure.
 Acquirer. Acquirers must upgrade systems and replace terminals that are currently
rented by merchants. Given that they will see no financial benefit from moving to chip,
they have resisted EMV migration in the past.
 Government. Governments are becoming increasingly aware of and concerned with
consumer protection from financial services fraud. Explicit or implicit government
support has been a part of the successful commercialization of EMV.
5.3 RELATIVE BENEFIT
It is clear that Chip and PIN addresses many major payment fraud issues including skimming, counterfeiting
and lost and stolen cards. This is clearly a benefit that most ecosystem participants and countries have
deemed valuable enough to migrate from the previous mag-stripe technology to Chip and PIN. However, there
28
Smart Card Alliance webinar “EMV for Merchants and Acquirers: U.S. Migration Considerations,” 6 October 2011.
Terminalization and card data current as of Q1 2011.
29
Ibid
30
MasterCard Worldwide: “An Introduction to Chip for Issuers and Acquirers” 2007
17
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
are a number of fraud issues that Chip and PIN cannot address, which decrease the relative benefit that Chip
and PIN offers to stakeholders in the ecosystem. Often these issues require additional investments and/or
inconveniences for stakeholders, further decreasing the relative benefit of EMV.
Skimming of magnetic stripes
In 2011, almost 98% of the ATM’s in Europe are
EMV compliant. The chart to the right shows that
after some problematic years of the EMV roll out,
the second half of 2010 has seen declining fraud
levels that can be attributed to the effectiveness
of anti-skimming devices, where they have been
deployed, as well as to improvements in the
detection
and
monitoring
of
fraudulent
transactions, and to regional card blocking for
'card present' transactions.31
However, one of the security matters that still
keeps EMV developers busy as of today, is data stealing or ‘mag-stripe skimming’. First of all, while the service
code on the magnetic stripe might indicate that the chip must be used, inserting a card without a readable chip
can trigger a fallback to the magnetic stripe as some EMV card issuers authorize these ‘mag stripe fall back’
transactions. This obviously decreases the effectiveness of the EMV-technology. Secondly, as the US is not
using EMV-technology, EMV-cardholders are becoming vulnerable targets of fraudsters. Even though a
cardholder needs to use the chip and enter a PIN when completing a purchase, most cards still contain a
magnetic stripe which can be skimmed. Subsequently, the skimmed data can be copied to create a fake magstripe card which could then be used in the US.32
In fact, most of the international losses caused by fraudulent transactions (skimmed cards) occur in the US.
According to data of the “Organised Crime Threat Assessment” published by Europol “around 80% of non-EU
fraud against EU payment cards is committed in the United States.”33
It is a concerning fact that as long as 'mag stripes' are present on EMV cards, the cards are vulnerable to
skimming. International losses during the second half of 2010 were as big as €100 million. In trying to combat
these losses, some European countries have stopped accepting mag-stripe cards. In fact, as of January 2011,
Belgium no longer accepts mag stripe-based card transactions. In the case a Belgium card is skimmed, it will
be useless outside the Single Euro Payments Area.
31
32
33
https://www.european-atm-security.eu/content/files/EAST%20ATM%20Fraud%20Analysis%20Report%20Vs%201.1.pdf
http://www.bankinfosecurity.com/articles.php?art_id=3199&pg=2
https://www.european-atm-security.eu/content/files/EAST%20ATM%20Fraud%20Analysis%20Report%20Vs%201.1.pdf
18
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
Foreign cards
As explained previously, the idea of the EMV-technology is to replace the fraud-vulnerable magnetic stripe with
smartcard technology where credit and debit cards contain an embedded microchip with a personal
identification number (PIN) to authorize payments. In Europe and Canada, it has been shown to be quite
effective in reducing fraudulent transactions and since most countries have had a full transition to EMV, the
magnetic stripe becomes redundant. However, when dropping the magnetic stripe, EMV-card users will be
unable to use their cards in the US and other countries that have not (yet) adapted to the same technology. As
a result, in 2011 the magnetic stripe fallback is still accepted almost everywhere. Similarly, travelers from
countries that do not issue the EMV-technology (mainly US travelers) might experience problems when trying
to make payments with their cards on an EMV platform since some merchants may not accept their chip-less
cards. A short-term solution for the last mentioned problem is the pre-paid debit card that is already being
issued by a number of financial companies, allowing Americans to upload cash to these debit cards.
CNP (Card Not Present) Issues
Although the EMV-technology solves many (national and/or international) fraud issues for those countries
where it has been implemented successfully on a broad scale, the technology itself does not resolve the CNPfraud when realizing purchases by telephone, internet and mail orders. In fact, in 2009 CNP-fraud represented
50% of the total fraud issues in the UK.34 This decreases the overall relative benefit of chip in fighting payment
card fraud given that it won’t impact a significant and growing portion of fraud.
In response to this growing issue, VISA responded by launching the Emue
card, “a credit card with embedded keypad, display and microprocessor that
is used for authenticating web and
telephone based transactions.”35 After this
development, MasterCard introduced the
Display Card which has a small LCD display
and a touch sensitive button. These next
generation payment cards are still in the
introduction phase but might be an improved
solution to combat fraud-transactions.
Furthermore, the Verified by Visa service and the MasterCard SecureCode are
based on the new 3-D technology36 that adds a layer of security for online debit
34
35
http://news.bbc.co.uk/2/hi/technology/8046492.stm
http://www.emue.com/site/home.htm
36
3-D technology is a three domain model that ties the financial authorization process with an online authentication, combining the acquirer domain,
issuer domain and interoperability domain.
19
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
and credit transactions. While realizing an online payment, the customer is directed to a secured pop-up
window with a personal greeting in which the customer is required to insert a personal password. After the
password has been confirmed, the purchase will be completed. Although this is a more secure way of realizing
purchases online, not all merchants are yet participating in the 3-D technology. A reason for this might be the
fact that they need to purchase specific software to be able to connect to the Visa or MasterCard directory
server, which is an expensive investment that includes setup fee, monthly fees and per transaction fees.
Moreover, supporting 3-D Secure is complicated and, at times, creates transaction failures. On the other hand,
a merchant could benefit from the 3-D technology as it reduces “unauthorized transaction” chargebacks.
Security Key Generator
To avoid the effects of malware on an account holder’s computer that can copy information about the
smartcard and manipulate current or other online transactions, some banks in Europe have implemented the
idea to combine EMV smart cards (mainly debit cards) with an unconnected card reader. When entering a
payment platform, the cardholder inserts his card into the unconnected reader, followed by his/her PIN. Then
the customer has to enter a numerical password received from the bank's website on the device, which
subsequently provides the user with another 8-digit signature that has to be inserted to the banks website to
authorize payments.
Even though this is a very secure way of completing online payments, cardholders are obliged to carry around
these sometimes ‘inelegant fobs’ that might create big inconveniences when the cardholder is unable to realize
payments without such devices.
5.4 EMV AS A DISRUPTIVE INNOVATION
For most countries, EMV technology presented a significant
improvement in terms of security compared to the
traditional magnetic stripe credit cards. The pattern of
improvement in the credit card payment technologies can
be well represented using the concept of s-curves.
Initially, mag-stripe technology evolved in an s-shape
format. It took a while for mag-stripe to pick up. Early on,
credit card payments were made with paper, by scratching
a paper on top of a credit card and using a carbon paper to
obtain the credit card numbers, and validating the
ownership of the card through the customer signature. With
the consolidation of mag-stripe, incremental improvements were made through development of more
sophisticated and effective anti-fraud algorithms.
20
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
The development of EMV came as a much more secure technology, disrupting the old technology. But it took a
while to establish all the players in the ecosystem in order to launch the new system. After EMV was
successfully implemented, it surpassed mag-stripe in terms of performance.
□□□□□□□□□□□
The successful commercialization of EMV technology can be attributed to a number of unique factors facing
the payments industry. The uneven power distribution between leaders and followers in the ecosystem led to
a situation in which the dominant players, the payment networks and issuers, forced adoption on the
merchants and cardholders. The fact that the networks had the power to incentivize merchants to migrate
even when faced with heavy costs and little benefit was an important factor in success. Further, rising fraud
levels were sufficient enough to pose risk to the payment systems in particular, as well as to the broader
economies which relied heavily on electronic transactions. These risks were sufficient enough to incent
governments to support adoption of the new standard. Finally, the necessity for 100% compliance in order to
mitigate fraud created a consensus and collaboration within the industry to unite around and aggressively
implement a common solution. The EMV implementation success seen around the world demonstrates the
conditions around which the commercialization of a disruptive technology can succeed despite strong
inequality of costs and benefits between players.
21
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
6 Addendum: EMV in the US
As we’ve seen previously, EMV provides an effective way of reducing many types of card fraud. Therefore, the
majority of the world has already migrated to or is currently moving toward Chip & PIN. Despite this fact, the
US has staunchly resisted it for years. However, three months ago, Visa and MasterCard announced that they
will start pushing migration to EMV in the US. We felt that it would be interesting to look at the reasons behind
the original resistance as well as the change of heart. Further, the commercialization strategy that Visa and
MasterCard are employing in the US is different than the strategies utilized in many other countries around the
world. We felt it would be interesting to contrast these strategies and the inherent impact to commercialization
risks.
6.1 THE RESISTANCE TO EMV
The resistance to moving to EMV was mainly driven by the low level of fraud costs that the US faces annually
compared to other countries around the world and the high anticipated cost of roll-out. As of the end of 2010,
there were slightly over 1 billion cards in circulation (48% credit card/52% debit card split respectively), and
52.3 million transactions resulting in $2.9 trillion in purchases37. On that $2.9 trillion in card volume annually,
US issuers only bear fraud losses and related costs of about 0.04%38 compared to the 0.18% that the UK was
facing in 2001 prior to migration to EMV. To reduce this already low fraud percentage, US issuers alone would
face upfront costs of about $8 billion to complete all necessary steps to migrate to EMV, such as replacing
customer cards, updating systems, and replacing ATMs39.
The low level of fraud is largely due to the fact that US issuers have invested heavily in advanced fraud
algorithms. Additionally, almost 100% of transactions completed in the US are online authorization, meaning
that the issuer has the ability to run the transaction through its fraud systems prior to authorization. This
compares to some European countries that have less developed telecommunications systems and where the
majority of transactions are made offline, where the terminal simply checks that the card is legitimate, not
whether the transaction is typical consumer behavior, thus increasing the chance of fraud. For example, the
UK has primarily been an offline authorization market since the card ecosystem developed40.
37
Visa
ATM Marketplace, ‘ Preparing for EMV in the United States’, 2011
39
ATM Marketplace, ‘ Preparing for EMV in the United States’, 2011
40
Retail Payments Risk Forum, “Why U.S. issuers might be reluctant to adopt the EMV standard”, March 14, 2011
38
22
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
Looking at the S-curves
for the United Kingdom
and Canada compared
to the US, it is easy to
see why the US has not
moved to EMV. As seen
previously, as fraud
increased in the UK and
Canada, the incremental
improvement of EMV
over existing fraud
systems outweighed the
cost of migrating to the
new technology. In contrast, US issuer investments in advanced fraud systems and online authorization
increased the incremental improvement that could be seen on mag-stripe cards, narrowing the benefit of EMV
over mag-stripe. As a result, US participants have not deemed the fraud reduction benefit to be worth the hefty
implementation cost.
An additional reason for the resistance revolves around the ecosystem fraud structure itself. While much of
the fraud on Chip and PIN cards around the world occurs in the US, international issuers are the ones who foot
the bill for such fraud. Therefore, US issuers have even less of an incentive to push EMV since they aren’t the
ones facing the large losses on skimmed international cards.
6.2 THE TIMING SEEMS TO BE NOW
As a result of the reasons listed above, as well as many more, up until now Visa and MasterCard have
remained quiet on the topic of US EMV migration. However, this summer, Visa and MasterCard stepped into
the conversation and began pushing EMV in the US. In August 2011, Visa announced plans to accelerate
EMV migration in the US by instituting a liability shift as of October 2015 for all merchants that do not upgrade
terminals to take EMV cards41. Two months later, MasterCard announced plans to institute a liability shift for
all ATM owners that do not migrate their existing ATMs to EMV. As of April 19, 2013, EMV card issuers will be
able to charge back counterfeit ATM transactions to US ATM owners if the fraudulently used ATM is not EMV
compliant42.
Interestingly, the movement toward EMV in the US did not start with Visa and MasterCard, the current
ecosystem leaders. Instead, it started with the consumer.
41
42
Visa, “Visa Announces U.S. Participation in Global Pointof-Sale Counterfeit Liability Shift”, August 9, 2011
ATM Marketplace, “EMV deadline for U.S. ATMs… the race is on!”, November 13, 2011
23
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
As more countries abroad have moved toward chip and pin
and have begun removing mag-stripe from cards entirely,
US consumers have started to have difficulty when
purchasing goods abroad. Almost 50% of cardholders who
traveled to Western Europe between 2006 and 2009
experienced some form of problem using a U.S. payment
card43. As a result, US card issuers lost $3.9 billion in
transaction volume and $447 million in revenues because
9.7 million cardholders were unable to use their cards
abroad.
To counteract the growing consumer frustration and the
financial losses from incompatibility, some issuers recently
began offering chip and pin cards to select business
cardholders as well as those who frequently travel abroad.
For example, in April 2011, Wells Fargo launched a pilot
that provided 15,000 San Francisco based cardholders with
cards containing both mag-stripes and chip & pin
capabilities. In June 2011, Chase followed by offering its Palladium cardholders a chip & pin card as well44.
While current issuers have stated an interest in expanding the offer to other consumers and other issuers have
talked about offering a chip & pin option to select consumers, US issuers as a whole do not seem interested in
pushing EMV for the US.
At the time of these launches, most experts in the industry felt that these offerings would continue to be
restricted to select cardholder groups, and that the movement would not lead to large-scale US EMV migration.
6.3 COMMERCIALIZATION STRATEGY
However, Visa and MasterCard appear to have taken advantage of this nascent movement to find a reason to
step into the game. Interestingly, the timing and approach of the recent move by Visa and MasterCard to push
EMV migration in the US shows that they have a very different plan than the one we have previously seen for
Europe and Canada. Instead, they are using EMV as an opportunity to move contactless forward, hopefully
enabling them to be the ecosystem leaders of the payment system of the future – mobile.
An August 9th Visa press release states, “The adoption of dual-interface chip technology will help prepare the
U.S. payment infrastructure for the arrival of Near Field Communication (NFC)-based mobile payments by
43
Aite Group, ‘The Broken Promise of Anytime, Anywhere Card Payments: The Experience of the U.S. Cardholder Abroad’, October
26, 2009
44
CardRatings.com, “Chase upstages Wells Fargo with first major "chip-and-PIN" credit card launch”, April 14, 2011
24
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
building the necessary infrastructure to accept and
process chip transactions. Not only will chip technology
accelerate mobile innovations, it is also expected to
enhance payment security through the use of dynamic
authentication”. Therefore, the end game has very little
to do with fraud in the US and has much more to do
with Visa and MasterCard’s ability to push an initiative
that has been one of their priorities for years.
Looking at the S-curve, you can see why this decision
makes sense. EMV alone has not offered the US a
significant enough bump over what the mag-stripe plus
incremental improvements offers. With the addition of
contactless EMV, stakeholders get global compatibility
and fraud reductions, as well as the tremendous
potential benefits of mobile made possible through
contactless EMV.
6.4 STRATEGY RISKS AND CONSIDERATIONS
Interestingly, the timing of the EMV rollout allows Visa and MasterCard to minimize a few of the major risks
around both EMV and mobile adoption. For example, one of the major obstacles is the adoption risk by
merchants, issuers and ATM deployers. The cost of moving to contactless is extremely high in the face of
unproven consumer demand and an uneven distribution of costs/benefits that arise for each of the
stakeholders. Visa and MasterCard have created a way of dealing with these issues – they simply force
players to play the game.
Unlike the rollout in Europe, and even to some degree in Canada, Visa and MasterCard’s US migration
strategy is far from collaborative. Instead, by instituting a liability shift, Visa and MasterCard are forcing
issuers, merchants and ATM deployers to move even if they do not wish to do so. This is largely due to the
fact that Visa and MasterCard have pushed contactless technology for years in the US, hoping to gain traction
with little success. Without the compatibility and fraud issues, they could not step in and force stakeholders to
move to contactless. Now, EMV creates an opportunity for Visa and MasterCard to use a somewhat more
legitimate reason for the conversion, but still with the positive effect of getting contactless cards into the hands
of consumers.
25
EMV TECHNOLOGY IMPLEMENTATION IN THE UK AND CANADA (AND THE US)
Further, Visa and MasterCard are instituting deadlines that are significantly shorter than those seen abroad.
For example, it took five years for Europe to get from 52% to 92% ATM compliant, whereas US ATM deployers
must go from 0% to 100% compliant in 18 months45.
The reason for this is likely due to the recent launch of NFC phones by major carriers including Google and
Nokia, and the likely inclusion of NFC in the next generation iPhone. Analysts project there will be
approximately 7 million NFC enabled phones in the market at the end of 2011, and this will increase to 16
million by 201246. Acknowledging that it is imperative to have the infrastructure in place when consumers
begin testing NFC technology on their phones, Visa and MasterCard want to push issuers and merchants to
get on board ahead of consumers. Otherwise, consumers may reject NFC if they cannot use it where they
shop. Or, mobile network operators or service providers, such as Google and Apple, may move first and gain
control of the mobile payments ecosystem before Visa and MasterCard can establish their dominance, which is
potentially even more damaging to Visa and MasterCard.
It is too early to tell how implementation of the strategy will pan out. However, it appears that they have
learned from their experiences in Europe and Canada. By implementing liability shift early, they will force
movement at a faster clip than they have seen in other countries. This may enable them to jump into the
leadership position in mobile space. Whether other players are willing to follow is a question for another day.
45
46
ATM Marketplace, “EMV deadline for U.S. ATMs… the race is on!”, November 13, 2011
“The Future of Online and Mobile Payments,” Business Insights, June 2011
26