The Retailer’s Guide To Chip & Pin Cards

After four years of anticipation, the October 1^st EMV liability shift deadline has come and gone. If you’re like most merchants, you aren’t quite ready to get on board and are going to be a tad late to the party. Fortunately, it’s fashionable to arrive late and we’ve still got the information you’ll need to take on all these liability shenanigans.

What’s EMV Again?

This article goes into more detail, but EMV stands for Europay, Mastercard, and Visa, and basically this shift means that your business has just taken on a lot more responsibility for the money spent at your store.

Traditionally, if you were to accept a magnetic stripe card at your terminal and it turned out to be a fraudulent charge from a lost, stolen, or forged card, the card issuer (Europay, Mastercard, or Visa) would be responsible for reimbursing the customer. However, since banks have developed chip and PIN cards that are more secure than their predecessors, if someone still manages to complete a fraudulent transaction (because you don’t have a chip and PIN machine), you’re now responsible for it.

The whole point of this transition from magnetic stripe cards to chip and PIN cards is to boost security since it is much harder to skim a chip’s information than a magnetic stripe’s information. However, if merchants don’t have a reader that can process the chip’s information then the effort is nullified. The banks are doing their part by issuing more secure cards, now retailers have to do their part by purchasing machines that can process those cards. Whoever fails on their end—either the bank for neglecting to issue chip cards or you for lacking a way to accept them—takes on the liability for any fraudulent charges.

Do I Really Need a New Reader?

I’d read this article for the whole story, but essentially the answer is: yes and no.

The Gestapo isn’t going to show up at your doorstep in the middle of the night demanding that you acknowledge the EMV shift or else, but it could be just as painful if you don’t. Sure, if the majority of your transactions go through Dwolla or PayPal and you don’t process credit cards anyway, then you don’t have anything to worry about. On the other hand, if you do accept credit and debit cards without a chip and PIN reader the only types of fraud you’re not responsible for are: (1) the use of a lost, stolen, or counterfeit magnetic stripe card or (2) the use of a lost or stolen chip and signature card.

Side Note: Chip and PIN cards are different from chip and signature cards. See this article for clarification.

Now some of you might be thinking, “But no one is using these fancy chip cards yet,” and you’d be partially right. According to CreditCards.com, there are still about 1.2 billion credit cards that still have to be upgraded to chip cards, but there have already been 60 million U.S. chip card transactions processed in August alone. By the end of 2015, it’s estimated that 60% of U.S. credit cards will be re-issued as EMV cards and possibly only 40% of retailers will be compliant by then. I don’t like those numbers, and I don’t know about you, but I’d rather be safe than sorry.

How Will This Change the Way I Do Business?

First of all, you’ll need some new equipment, and this may or may not be a hindrance. For one, chip card readers are more expensive than their magnetic stripe-reading counterparts. We’re not talking a thousand dollar difference, but there’s still a noticeable markup. This is most obviously seen among mobile processors who used to offer free magnetic stripe readers with a subscription to their processing services. Now, however, you’ll be charged anywhere between $30 and $50 for a reader that—if you’re a particularly small business (and you probably are if you’re using a mobile processor)—you might never use. Again, we’re not really breaking the bank here, but it is an extra expense you’ll have to take into account.

Another element of your business that may have to evolve is the process of performing transactions over the phone. In one of the many articles currently available about the liability shift, one woman expressed her concern over this issue:

“What I’m not seeing is what happens to our business? Most of our credit card transactions are keyed entries, I never see or handle the card at all. Our clients call us with the card information and I key it in.” –Jeri Rogers

Just because you’re not coming in contact with the card doesn’t mean you’re not responsible for verifying the identity of the person trying to purchase something from you. If you process a fraudulent transaction over the phone, you may receive a chargeback and – in some cases – be liable for the transaction amount. And if the keyed-in data is compromised or hacked and that leads to fraudulent purchases, you may be on the hook for a large chunk of cash. But the new chip cards will not impact these transactions, because they are “card-not-present” (CNP). The liability shift only applies to card-present transactions, where the merchant comes in contact with the card. Having the chip on the card would not have helped to prevent fraud if the card was not present anyway.

Finally, your business can also be affected in a pretty major way by this whole chip and PIN business simply because not all POS systems are EMV compliant yet. Instore, in particular, is taking a “wait and see approach.” They assure their users that they are testing prospective chip and PIN machines, but since “EMV devices and standards are a moving target” there are too many unanswered questions that will ultimately affect your decision to observe the shift. You can read Instore’s take on it, but I disagree with their assertion that your risk of fraud is relatively low (especially if you’re a small retailer) and that this justifies ignoring the shift. Even if you have a limited fraud history, it could take just a few large fraudulent charges to deal some serious damage to your business. Certainly more than a $200 EMV reader will cost you.

Where Can I Buy an EMV Chip Card Terminal?

We have a FAQ article on buying EMV chip readers that you can reference, but I’ll give you the SparkNotes version.

You can basically purchase a new chip reader from any of the places you would get a non-EMV terminal (your merchant services provider or some third-party supplier if you can find a better price). Most chip and PIN card readers—as long as you buy the model compatible with your POS software—can be programmed to work with your merchant account. Of course, merchant services providers reserve the right to charge ridiculously high fees to do this or they could simply refuse to reprogram the device at all. Taking this into account, it might be easier to just pay what they’re asking for the device or it might be a good time to reevaluate whether or not you even want to stay with your provider.

As for leasing any kind of card reader, EMV enabled or not, we strongly advise against it. By the time you’ve escaped the standard 48-month lease, you will probably end up having paid thousands more in interest than the device is actually worth. You can get the whole picture here, but the moral of the story is just don’t do it.

Conclusion

To recap, here is what we’ve learned:

• The EMV liability shift is ultimately designed to better protect against fraud, but if you don’t do your part in this effort, it could cost you.
• Ultimately, you don’t need to be EMV compliant, but by the end of 2015 it’ll be pretty unwise to remain so unless you don’t accept credit or debit cards.
• Like any major transition, your business may need to evolve. Closely evaluate how this change is going to affect your business and try to stay ahead of it.
• You can purchase an EMV-compatible terminal from your merchant services provider, but you may not want to. Take a gander at our article on how much you should be paying for credit card processing and if you think it’s time to switch, all of our favorite merchant accounts offer very reasonable options for EMV-compatible devices.
• If you’re thinking about leasing a new EMV reader, please don’t. It’s not worth it.

We understand how stressful any kind of major business transition can be and we are here to help. If you have any questions concerning this post or EMV compliance, please ask in the comment section below. Otherwise, you can contact us directly for help with lowering your processing fees or for help with choosing anything from a new point of sale system to loyalty rewards software. In any case, please feel free to let us know how we can make your job easier.