Title: Session 11 UK EMV Implementation Case Study
1Session 11 UK EMV Implementation Case Study
- Richard Sanders, Business Consultant
- ACI Worldwide
2Agenda
- Chip and PIN - a project of exceptional scale
- Drivers
- Solution the UK project structure
- The challenges
- The Public Trial in Northampton key issues,
learning and conclusions - Customer Research and Communications
- Views on Success of and Learnings from the
project
3Drivers of the UK Chip and PIN Project
4UK Industry Issues prior to project
- Escalating card fraud trends
- UK PIN infrastructure - LINK ATMs required to
provide sufficient PIN change/unblock services - EMV Migration from UKIS and magnetic stripe
- Scheme interchange rates liability shifts
favoured EMV - Commercial negotiations between retailers and
acquirers - Approach to roll out pilot, regional or big
bang - Fallback to magnetic stripe and customer bypass
requests - Readiness of US issuers/small APACS members
- Chip card transaction times to be improved
(originally 6.1 seconds slower than magnetic
stripe) - Issuer/acquirer business case imbalances
5Chip and PIN, a ground breaking initiative to
tackle card fraud in the UK
- UK card industry losing 1m a day to card fraud
perceived need was to be first to adopt EMV as -
- Impacting customer confidence
- Funding other serious crime
- Banks/Retailers partnership required for Chip and
PIN Rollout - Regulatory encouragement - Domestic and EU -
SEPA - Chip and PIN - the technology of chip combined
with PIN to protect against counterfeit and lost
and stolen fraud. - Chip and PIN - biggest change to payments in the
UK since Sterling decimalisation a deterrent
to, but not the panacea for, plastic card fraud - Seen as a migration plan to multi-application etc
6Chip and PIN The Do Nothing Option
7UK Card Fraud The Facts Prior to Rollout
425
450
411
402
400
317
350
300
250
millions
189
200
135
130
122
150
97
97
83
100
50
0
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
Source, APACS
- UK lost over 400 million through plastic card
fraud in 2001, 2002 and 2003 - Card fraud had affected one in three people in
the UK - A fraudulent transaction was taking place every 8
seconds - Without Chip and PIN forecasts indicate that UK
fraud losses would reach 800m pa by 2005.
8UK Issuer/Acquirer EMV Business Case
- Primary driver anti fraud
- Reduction in Counterfeit fraud (2000-2001 50),
- Lost/Stolen (2000-2001 12) fraud
- Avoid liability shift and future fraud avoidance
- Improve credibility of, and consumer confidence
in plastic card payments (and drive migration
from cash and cheques) - Control of operational costs off-line
auths,chargebacks - Deliver greater certainty of payment
- Protect against international fraud migration
- Secondary drivers
- Infrastructure for new income streams - ID
authentication, , loyalty and multi-application,
prepaid, biometrics - Improved customer service
- Review of need for hot card files
- Greater use of unmanned terminals
- Reduced cash usage
9Retailer Business Case Some argue there isnt
one BUT
- Retailers had a case if avoidance of liability
shift fraud counted as a benefit - resisted
change in this despite pressure from particularly
Spain - Retailers (in aggregate) had a case for Chip and
PIN without fraud avoidance as there are
non-fraud benefits - - Virtual elimination of need to respond to RFIs
and therefore reduced cost of chargeback handling - No need to retain payment receipts for most
domestic transactions - Onus of identifying the cardholder shifted from
POS staff to technology - Opportunity for staff and operational savings
through introduction of self pay technology
(market benefits) and loyalty schemes etc - Reduced telephone costs through revised
authorisation strategies - Large merchants delayed adopting Chip only (UKIS)
due to a 7 year hardware replacement cycle
waiting for EMV to provide internal system
improvements trial data would assess business
impact - Need to support the Card Industry for business
growth - customers expect retailers to protect
them too
10Implications for Banks in Delaying EMV
Implementation
- Reputational Risk
- Failure to Meet Payment Scheme timescales
- Fraud increases as a result of migration to
non-chipped parties - will be apparent to
marketplace and consumers - Without smart cards will appear more vulnerable -
Low technology is not a good message - Compliance Risk
- Increased costs as a result of Payment Scheme
liability shifts - Legislation
- Strategic/Operational Risk
- Missed revenue opportunities in secure e-/mobile
commerce - Operational problems in charge-backs/authorisation
s and reduced Customer Service compared to
competitors - Transaction risk as they will not be off-line and
lower cost - Valuable operational learning and opportunity to
strengthen customer relationship for multi
application cards will be lost - Forced reissue of cards may be required rather
than replacement within existing card expiry
process
11The Solution
12Why the solution was EMV Chip and PIN
- The Chip
- A microchip embedded in the card to provide
powerful processing intelligence to make
decisions - Effective fraud deterrent - expensive and complex
to counterfeit. - Platform using secure methods of identifying
cardholders at POS - EMV standards ensure global interoperability
- Liability shift to non-Chip and PIN party.
- Longer life expectancy than stripe cards
- What happens is on the card - sealed by
cryptograms - A platform for future developments
- The PIN
- PIN not Pen protection against lost and stolen
fraud at POS - Acceptable to most customers
- Only current viable option - international
standards already exist - Consistent with International vision
- The Stripe Card becomes a smart card
13A project of exceptional scale over a period of
3 or more years
14The UK Banking Industry Approach
- Radical change to card payments infrastructure
meant a consensus project - Banks
(Issuing/Acquiring) and Retailers working
together - Formation of an independent central Programme
Management Organisation (PMO) - Primary
objectives co-ordinate activities, track KPIs
to ensure EMV maturity liability shift achieved - Key work streams to co-ordinate
- Trial eventually took place May-July 2003 then
Implementation - Technical/Operational Issues
- Communications
- Vendors/Processors (later) (MVEG)
15Success of the implementation was built on
engaging successfully with multiple
stakeholders, who can have conflicting objectives.
16The Critical Path
17Key Performance Indicators
18Key Indicators agreed to track performance/success
of UK rollout
- Debit 95 Chip and PIN by end 2005
- Faster rollout than credit
- Credit 95 Chip and PIN by end 2005
- Not achieved US Issuers/Processor issues and
some reissue problems with bureaux ability to
supply silicon - Terminals accounting for 65 of card transactions
enabled for Chip and PIN - Achieved 66.4 enabled January 2005
- 90 of Customers to be within 1 mile of ATM
offering Reciprocal PIN Services - Achieved January 2005 .
- Technical Fallback
- Pin to Signature (PIN Pad Failure) Achieved
- Chip to Signature plan in place
19Chip and PIN - Key Indicators
- KPI 50 POS Chip and PIN enabled by end 2004
- Actual 44.2 by end 2004 Target of 80 set for
end 2005. - KPI PIN Bypass
- Bypass to be removed 14 February 2006
- Issues
- Foreign cardholders especially US where there
are no EMV plans - Hard Core Resistors amongst cardholders
- Technical Fallback will still occur
- Disabled who cannot use PIN- Chip and Signature
cards issued after detailed discussion of
requirements with disabled customers - Mid tier merchants who are slowest to move
- Vendors/Processors engaged late in the process
- KPI 90 of Cardholders to be aware PIN is coming
80 to know their PIN - Achieved January 2005 Research shows awareness
97 . Knowledge of PIN 91 debit 73 credit
20The Challenges
21The Challenges
- Consumers behaviour will cardholders adapt or
use another payment method, Can they be prevented
from writing down PIN numbers, Are there specific
groups impacted ? - Retailers - to enforce the regime on fallback
- Communication APACS/Scheme led generic messages
provided over a long time - from early trials
through rollout to maturity - Website key -
www.chipandpin.co.uk - Technology - Type approval and certification by
Payment Schemes and EMVCo, MI,Transaction timings - Training - bank and retail staff
- New technology but not so different to ATM use
- Help-desk support and training material specially
written - Beware mystery shopping exercises by external
parties - Key messages for issuers, acquirers, merchants
and vendors - Be proactive, plan well ahead, lobby suppliers.
- We can only do this together
22The Trial in Northampton
23Why Northampton?
- Trial Wish List
- Geographically isolated
- Local shoppers shop locally
- Limited number of visitors
- Range of major and specialist retailers of all
sizes - Socio-economic profile to match UK
- Test communications via media
- Ease of access for project members to visit
- Major Bank branches/ATMs
- Northampton fitted
- It was a success when used previously
- Good feedback
- Retailer familiarity
- Chip awareness
- Central location
- Concentrated location
- Volumes of bank staff
24Objectives of the Trial - to test how well Chip
and PIN works
- Monitor consumer and merchant reaction
- Effectiveness of cardholder communications to
formulate comprehensive strategy to communicate
the change to customers and retailers for rollout - Evaluate end-to-end operational processes and
procedures - Monitor technology performance/reliability
- Performance of ATM PIN Management Services
- Ability to measure fraud related to Chip and PIN
- Build confidence in the technology in a live
environment following pre trial phases IPT, CTT
and OTT to ensure satisfactory technical testing
25Chip and PIN Trial
- Starting in May 2003 a - 3 month Trial was held
in Northampton By end of trial - Over 200,000 Chip and PIN cards issued by 11 FI
s - 200,000 transactions, 25,000 per week
- 1400 POS terminals accepting Chip and PIN
including shops restaurants pubspetrol
stations - Around 170 ATMs PIN Management Services upgraded
- Many UK household names to drive volume- Asda,
Co-op Retail, The Link, McDonalds, Next, Shell
Morrisons, Marks Spencer, Safeway, UK,Scottish
Newcastle Retail, Spar,Tesco, Wilkinsons - UK Chip and PIN Trial is the biggest in the world
so far
26Chip and PIN Trial Conclusion
- End of Trial Report - Chip and PIN - a success !
- Communications successful
- Chip and PIN received very positively by
customers - and retail staff.
- High knowledge and awareness levels achieved
- Training effective communication critical
- Consumer reaction positive but sensitive to
existing PIN - knowledge and usage
- Technology works but need to continue testing
- Privacy/accessibility/disability issues
identified - PIN Services (ChangeandUnlock) are essential
- Transactions faster than those they replace
- UK Home Office Minister extremely happy
- BUT Overall NOT fully proven based on
- original KPIs
27Chip and PIN Trial - Not Proven ?
- Rejection of the scheme amongst customers minimal
- Card rationalisation/decreased usage/attrition
did not occur - Trials main problem - lack of Chip and PIN
enabled outlets - 11 large retailers not 16 with 9 entering the
trial late - Bank owned terminal switch on slower than
expected - Lengthy EMVCo approval and Scheme certification
process - More customers than expected bypassed PIN
- Research suggests forgotten PIN or never advised
of PIN - Partly driven by lack of retailer POS
availability time lag to use - Fewer customers than expected used their cards
- Lack of opportunity to use their new card,
working against the awareness / motivation of
cardholders - Overlap period between cards meant continued to
use stripe card - A number of incidents highlighted card and
terminal incompatibility e.g. legacy cards in new
terminals
28Key Learning from Trial
29Key Learning from Trial
30Customer Research
31Cardholder reaction to EMV Chip PIN
- Messaging
- Cards part of everyday life
- Lots of fraud about
- Its a real hassle when it happens to you
- Banks Retailers working together to develop a
solution - Findings From PMO Market Research
- Majority of cardholders positive about Chip and
PIN and awareness grew as project progressed - No migration to other payment methods
- Fraud is prime motivator for cardholders to adopt
Chip and PIN, but banks must not over emphasize
and cause alarm. - Five waves of research to track changing customer
reactions/effect of communications from pre-trial
through rollout
32UK Research Customer Segments prior to EMV Project
Not comfortable using PINs - concerned about
using new scheme
PIN Fearful
Sceptics
Concerned about fraud - but do not think new
system will work
Happy Coasters
Relaxed about fraud - happy to adopt scheme
Convenience Seekers
Early adopters - convenience is driving concern
Information Hungry
Very concerned about fraud and personal
safety Want to know exactly how it will work
33Segment size based on Research Data
Represents 7.8m people
Represents 11.1m people
Represents 5.7m people
Represents 10.7m people
Represents 5.3m people
Q
Base All respondents (n1264)
34Summary of likely adoption
Most enthusiastic
Information Hungry
Welcome it as solution to fraud
Welcome it because its new, modern and may make
life easier
Convenience Seekers
No barriers to adoption, but no real motivation
Happy Coasters
Concerned about PINs
PIN Fearful
Reject concept outright
Sceptics
Least enthusiastic
35A communications package was needed to inform
generally and have specifics for identified
groups
- Deliver greater customer confidence and peace of
mind and.. - Remove the worry, hassle, and inconvenience of
card fraud - Although fraud is a prime motivator to adopt,
Programme needs to ensure that our consumer
education and communication is effective to drive
- Action for 5 identified customer segments
Reassure that they can cope, educate
36Communications Plans
37UK Advertising Campaign To Cardholders 2004
MAR
APR
MAY
JUN
JUL
AUG
SEP
NOV
DEC
ANNOUNCE
Chip and PIN is coming!
Cut Card Fraud Remember your PIN
INFORM
MANAGE EXPECTATIONS
How Chip and PIN actually works
INFORM/ANNOUNCE
REASSURE
Ways to remember your PIN
ANNOUNCE
Chip and PIN is here!
CALL TO ACTION
INFORM/ PROMPT
Use Chip and PIN wherever you can! Its ok to
guard against shoulder surfing
REASSURE/ PROMPT
Get out there and start using it!
Strapline Safety in numbers
38Views on Success and Learnings from the Project
39The changing make up of fraud after EMV in the UK
Counterfeit and Lost and Stolen have been reduced
Fraud Breakdown 2000
2
3
6
35
20
BUT
34
- Growth in e-commerce fraud
- Growth in CNP fraud
- Growth in identity theft
- None of which EMV addresses directly
SourceAPACS
40UK Fraud 1994 - 2006
Source APACS
41UK Fraud changes Jan-Dec 2006 APACS figures
compared to same period in 2005
42Explaining Fraud Trends in 2006
- Chip and PIN has made it more difficult for
fraudsters to commit card fraud - Domestic UK
Fraud has fallen by 13 to 309.8m from 356.6m
in 2005 - Reduced rollout of cards by Issuers following
record levels to beat the liability shift has
meant fewer cards to intercept - Terminal base virtually fully EMV compliant
- Fallback/bypass at customer request - an area for
fraudster to exploit withdrawn 14 February 2006 - However
- criminals are still targeting UK cards and
copying the magnetic stripe data to create
counterfeit magnetic stripe cards to be used in
countries that havent upgraded to Chip and PIN.
This has caused an increase in fraud abroad
losses for UK Issuers over the last 12 months of
43 (118.2m compared to 82.8m in 2005) and is
the reason total counterfeit has risen slightly - card-not-present fraud losses now account for
just under 50 of all card fraud losses. - losses as a percentage of plastic card turnover
equated to 0.095 in 2006 significantly less
than the 0.141 figure in 2004.
43The Changing Make Up of UK Fraud
44Even with EMV Card fraud is still big business
- Fraudsters are still targeting cards and the
internet - High return for low investment while stripe
remains on the card - Not technically challenging stripe / SDA
- Organised crime can fund
- Information/attack methods easily dispersed via
internet - Fraud moves easily across borders
- There are a number of fraud options
- Consumers now more aware of transaction security
but still Customer apathy
Known card fraud
- Unreported fraud
- By customerBy bank
- Fraud reported as bad debt
- Identity theft/CNP
- Chargeback fraud
- Fraud migrated to other channels
45Was is it a Success ? The Bankers View
- Yes - lost and stolen and counterfeit fraud
reduced - BUT - Business case payoff has not been seen as fraud
rose initially - Rollout took longer than expected
- Technical Issues like SDA failures persisted
- Bypass and technical fallback too high and not
tackled early enough in the programme - Credit much slower than debit
- Misinformation at POS and in the Press as
liability shift and removal of PIN bypass
approached - Time lag between receipt of card and usage longer
than expected - Counterfeit and Lost and Stolen Fraud reduced but
now need to tackle Card Not Present and Account
takeover by Installing CAP. - Cross border fraud issues especially with ATMs
and MI - Contactless EMV is the next Challenge and learn
from the Face to Face Implementation
46Was it a Success ? The Retailers View
- Wanted a date for withdrawal of Bypass as it
causes problems at POS - confirmed for 14
February 2006 - Large retailers created business cases driven by
liability shift but some mid tier still
outstanding and some major chains not fully ready - Contactless cards will require further
development of terminal base and utilise a subset
of EMV who pays 7 year replacement cycle - Growth of Internet channel usage does not use
Chip and PIN technology now need to develop
Verified by Visa/Secure Code/CAP and maybe proxy
numbers. AVS also needs to be developed further - Authorisation levels still high.
47Was it a Success ? Cardholder View
- Cardholder reaction tracked in a series of
research waves mostly positive - Hard core still bypassing PIN and there were no
issues after February 14th despite the press
proCmoting otherwise - Disabled still have issues
- Does not work on the Internet or MO/TO
- Contactless provides new options and a
potential re-run of EMV implementation but not
all retail sectors will be involved - Two Factor Authentication some banks trialled
bespoke solutions but APACS have now agreed
specifications - In Essence its still about fraud to customers
48UK - The Key Learnings from Chip and PIN
- Migration timelines extended despite strong
central co-ordination - Scheme and Acquirer Certification issues impacted
merchant plans - Engaging Mid-tier merchants remained a
challenge - Vendors/Processors should have been engaged
earlier - Time lags-
- between bank-owned terminal deployment and
activation - between issuance and first usage of cards
(particularly credit) due to reissue timeframes
US monolines slower - Reciprocal PIN management delivery key
- Consideration of disability discrimination
requirements key - Effective communication underpins success and
limits need for force reissue of cards to
customers - Resist calls for changes to liability shift it
is a main driver - Major changes to be avoided at Peak business
periods - Adequate measurement of performance against all
Programme maturity KPIs
49UK - The Key Learnings from Chip and PIN
- The Business Case involves Merchants, Hardware
and Software Vendors and Banks Issuer and
Acquirer arms working together ( Government ?) - Disallowing PIN bypass more difficult than
originally envisaged and withdrawal should be
planned before rollout starts to avoid an
unstructured end to the programme - The customer will accept EMV provided he is
informed COMMUNICATE more than once using all
available channels - ATM networks need to offer reciprocal PIN
Management services to all Issuers for all
Schemes to drive adoption - Migration of Fraud will happen as EMV restricts
Counterfeit and Lost And Stolen Face to Face
Fraud prepare for it. - Chip and PIN enable branch counter terminals if
you are a Bank - Manage the end of the Programme
- Look at this as the first stage of a revolution
as to how cards will develop opportunities will
arise from a common platform.
50Two Major Issues Disability and Fallback/Bypass
51Disability Top Line Findings
- Overall, positive attitudes to Chip and PIN for
most 86 of people happy to use and fears
allayed by usage - More secure than signing (less likelihood of
fraud) - As convenient, and in many cases, more convenient
than signing - Specific strengths emerged for Elderly Deaf/hard
of hearing Blind/ visually impaired BUT - Learning and remembering PIN causes apprehension
- A problem for people with learning/manual
dexterity difficulties - Knowing that PIN be easily changed alleviates
concern - PIN exemption could be an important option for
severe cases, but requires careful management and
communication by banks - Security and Vulnerability shoulder surfing
especially wheelchair bound customers - PIN Pad design
- Banks retain liability if they issue a Chip and
Signature card meant additional development for
those migrating from stripe cards
52Disabled Groups Special Cases
- Extensive consultation with disability groups
took place banks previous indicator was a
braille statement flag - During rollout no suitable, certified portable
Chip and PIN terminals available meant disabled
Drivers Association pressure group allowed
disabled drivers to continue to sign - After Strategic Risk reviews some banks issued
Chip and Signature Cards under special
application procedures to certain groups, others
relied on by-pass procedures - RNIB Mystery Shopper exercises for the blind
and partially sighted exposed poor disability
training/knowledge in Bank call centres and
limited access to Chip and Signature cards - Removal of PIN bypass in February 2006 ensured
Issuers and Retailers complied with the
Disability Discrimination Act - Specific communications for the disabled were
required along with extensive bank (customer
facing/call centre) and retailer staff training.
Some pin pad changes made.
53What is a Fallback transaction ?
- A Fallback transaction is where the main or
preferred technology cannot be used, and a weaker
technology has to be used to complete the
transaction. There are 2 types of fallback - Technical Fallback Where the best card
technology supported by both card and terminal
cannot be used, the transaction is completed,
according to Scheme and product rules, using the
magnetic stripe for Chip cards ( paper or PAN Key
Entry for magnetic stripe). Scenarios where the
PIN is locked (and a transaction is completed
using chip and signature), or where the PINpad is
not working but a chip and signature transaction
can be completed are also forms of technical
fallback and are covered by EMV processes (rather
than scheme rules) - Signature Fallback Where a chip and PIN card has
met a chip and PIN terminal, the card chip has
been read but the PIN has not been verified
because the cashier has taken a proactive step to
bypass PIN entry. PIN bypass often arises because
the cardholder does not know their PIN at the
time of purchase or the cashier has deliberately
chosen not to ask the customer for it
54What is not a Fallback Transaction
- Definition of Technical Fallback does not include
- Chip cards meeting magnetic stripe only capable
terminals - Magnetic stripe only cards meeting Chip capable
terminals - Magnetic stripe transactions initiated following
a declined chip transaction for the same card in
the same terminal - Definition of Signature Fallback does not include
- Chip and PIN cards meeting non-Chip and PIN
terminals - Non Chip and PIN cards meeting Chip and PIN
terminals - Cards (typically foreign issued cards ) which do
not support off-line PIN verification - UK cards used overseas in terminals not
supporting off-line PIN - Cards issued without a PIN for disability reasons
- PIN locked or PIN pad not working transactions
55So why did UK Banks allow Fallback ?
- Issuers agreed position Non competitive for
Issuers - To safeguard/maintain customer service standards
during the period of transition to Chip and PIN
maturity - Retailer requirement to progress Chip and PIN
Programme (Paradoxically many later agreed with
Banks original position - that it should have been disallowed)
- Priority to build confidence in new processes and
technology - Customer market research suggested it would be
beneficial during the transition period - EMV rollout in other countries (Japan) had
utilised fallback and bypass (but high rates 50
retained because they did not address early in
the programme) - French model (non EMV) did not allow fallback -
customers received a request for another card
56Risks associated with allowing Fallback
- Bank Risk (Issuer Liability) vs. Customer Service
Trade-off - Risk preferred no fallback but needed by
marketing and customer services during
transition to maturity. - Card Schemes - Issuer liable for approved
fallback transactions. - Concerns surrounding high levels of PIN bypass
first raised in Trial when rates observed were
30-35 credit and 15 debit - Retail staff offer it due to lack of training
etc. - Failure to maximise return on investment
- Fraud reduction transaction efficiency benefits
cannot be fully realised while EMV is by-passed
as it prevents a change in cardholder behaviour.
- while bypass was available some cardholders
will continue to use it. - Fraud Loophole
- By-passing the 2 main security features of a
card gives fraudsters an opportunity for
continued counterfeit and lost/stolen fraud . No
direct link has been proven between fraud and
fallback as these transactions are subject to
100 online authorisation
57UK Industry Activity on Fallback/Bypass
- Do nothing is not an option. Japan still have
issues. Ultimate goal - a No PIN, No
Transaction but still problems with foreign
issued cards e.g. the US with no plans to migrate
to EMV and the disabled - Collaboration between banks, retailers and
Payment Schemes to agree fallback removal
strategy and track rates to meet pre-defined
KPIs. Combined approach, as merchant or issuer
only approaches had significant drawbacks - Heightened expectation on issuers to be actively
monitoring rates and communicating with
cardholders who bypass PIN - No soft (i.e. no specific date attached) PR
announcement of the removal of PIN Bypass -
cardholder communication occured via central PR
and issuer direct communication - PMO Workgroup set up to manage and communicate
withdrawal
58PIN Bypass Withdrawal Issues
- Sectors where goods have been consumed prior to
purchase e.g. Petrol and Hospitality - Requirements of disabled customers after PIN Day
particularly groups like disabled motorists - One agreed measure for PIN Bypass rates,
- Scheme data to identify merchants with high
fallback rates - Key retailers providing independent data
- Technical fallback rates blended with signature
fallback a distortion - Misreporting of terminal capability and incorrect
terminal configurations - The continued acceptance of international cards
must be in accordance with card scheme rules. - Mid tier retailers and Vendor support
- I love PIN campaign aimed at hard core resistors
hence Valentines day withdrawal four months
notice
59(No Transcript)