Until recently, Americans could be a bit old school when it came to credit card processing. Before this past fall, the U.S. was one of the only countries in the world that continued to rely on credit cards with magnetic stripe technology on the back.
As a result, more than half of the world’s credit card fraud takes place in this country. However, in October 2015, that changed, and dealers who accept credit or debit cards for payment in both sales and service need to be prepared for this change.
Similar to the rest of the world, electronic payment associations and regulators have mandated that U.S. card issuers embed smart chips into their cards. Through this new electronic payments industry initiative called EMV (Europay, MasterCard and Visa), retailers (including automotive dealers) were required to upgrade their card readers to be able to read encrypted information and authorizations communicated from the chip card by October 1, 2015.
The purpose is to reduce credit card fraud, which is rapidly on the rise in the U.S. given the static nature of cards with magnetic stripes and the ease with which to counterfeit them. The new chip card provides a different sequence of credentials (a unique one-time transaction code) for every use. If a hacker steals the chip information from one transaction, the stolen transaction number wouldn’t be usable again and the card would be denied. This makes chip cards very difficult to counterfeit.
Payment Liability Shift
In addition to implementing the latest chip-card technology, this initiative includes a payment liability shift for disputed charges between merchants and their customers for point-of-sale transactions. The liability shift means that retailers using non-EMV-compliant devices that choose to accept transactions made with EMV-compliant chip cards assume liability for any and all transactions that are found to be fraudulent.
MasterCard defines it this way: The party, either the card issuer or the merchant, who does not support EMV, assumes liability for counterfeit card transactions. They will also assume chargeback liability for customers who dispute charges. In effect, the liability will shift to whichever party is the least EMV-compliant.
So if a dealer is still using the old system, she can still run a transaction with a swipe and a signature. But the dealer will be liable for any fraudulent transactions if the customer has a chip card. The converse also holds true: If the dealer has a new EMV terminal, but the bank has not issued a chip and PIN card to the customer, the bank would be liable.
Cards-Not-Present and Mobile Payment Liability
The EMV liability shift only relates to face-to-face card-present transactions and not to card numbers you key-encrypt where the card is not present, such as an Internet or phone sale.
Dealers using mobile payment devices such as Square also have to purchase new equipment to read the chips on EMV cards. Square has designed two EMV-compatible card readers for Android and iOS devices — one for swiping and one for dipping. These will cost approximately $29 and $39 respectively but also will require programming changes. Until the dealer upgrades, the new EMV cards will be processed without the additional layer of encryption security the chip provides.
Transitioning to a Smarter Card
EMV compliance begins with acquiring new point-of-sale card readers. Systems conversions to accept the cards and training is also required. In effect, you are changing from swiping a card to “card dipping,” which is inserting the chip card into the new terminal reader and waiting for it to process.
The new terminals contain a slot to insert the card on the top or side that looks like a sim card. They also allow you to swipe the old magnetic stripe cards but also insert the portion of the card with the chip in it into the reader to read the chip data. The new chip cards will have a magnetic stripe on the back to be used with merchants who have yet to upgrade to EMV.
The card-dipping chip-verification process takes a little longer than a magnetic stripe card swipe. The card issuer determines whether the customer will use a PIN or a signature; most chip cards use a signature. Like today, the customer will sign on the point-of-sale terminal to take responsibility for the payment.
What Should I Do Next?
If your dealers have not already converted their card acceptance devices, they should contact their merchant acquirer who processes their card transactions and discuss appropriate solutions for implementing EMV at the dealership. There will be a lag time in obtaining the new chip card-reading devices and making software changes to be able to read the chip cards and implement the EMV technology. The dealership’s acquirer should be familiar with these processes and work with the dealer for an EMV-compliant solution that is cost-effective for the dealership.
Also, the liability shift risk should be weighed against the compliance costs. It doesn’t take many sales or service transactions that are disputed to make the liability shift generate significant losses for your dealership. What is your chargeback history or experience with counterfeit cards in all aspects of your business — sales, service and parts? Fraud losses on magnetic stripe cards have doubled over the past seven years and swiping magnetic stripe cards is clearly yesterday’s technology. The time to start planning is now and it should begin with a call to your acquirer. Get a sense of costs and timing (don’t forget to include training of employees) and go from there.
