网络研讨会：EMV的普及——不再提心吊胆.pdf

EMV Chip Cards Not as Scary as it Used to be Brian Hamilton Senior Director – Risk and Authentication Products Visa Inc. October 26, 2016 Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should consult with your legal counsel to determine what laws and regulations may apply to your specific circumstances. The actual costs, savings and benefits of any recommendations or programs may vary based upon your specific business needs and program requirements. By their nature, recommendations are not guarantees of future performance or results and are subject to risks, uncertainties and assumptions that are difficult to predict or quantify. Assumptions were made by us in light of our experience and our perceptions of historical trends, current conditions and expected future developments and other factors that we believe are appropriate under the circumstance. Recommendations are subject to risks and uncertainties, which may cause actual and future results and trends to differ materially from the assumptions or recommendations. Visa is not responsible for your use of the information contained herein (including errors, omissions, inaccuracy or non-timeliness of any kind) or any assumptions or conclusions you might draw from its use. Visa makes no warranty, express or implied, and explicitly disclaims the warranties of merchantability and fitness for a particular purpose, any warranty of non-infringement of any third party's intellectual property rights, any warranty that the information will meet the requirements of a client, or any warranty that the information is updated and will be error free. To the extent permitted by applicable law, Visa shall not be liable to a client or any third party for any damages under any theory of law, including, without limitation, any special, consequential, incidental or punitive damages, nor any damages for loss of business profits, business interruption, loss of business information, or other monetary loss, even if advised of the possibility of such damages. EMV Migration- Not as Scary as it Used to Be Visa Public 2 Agenda Fraud Landscape EMV Update EMV Quick Chip Questions EMV Migration- Not as Scary as it Used to Be Visa Public 3 Fraud landscape today Counterfeit fraud represents 69% of card-present fraud and is growing Card-present fraud Total fraud by type Other Lost/ 5% stolen 11% Counterfeit 42% Other 16% Lost/ stolen 15% Card not present 42% Counterfeit 69% EMV chip will significantly reduce card-present counterfeit fraud Source: Visa Fraud Reporting System (FRS); Reporting window YE 2015; U.S. issued / U.S. acquired Visa debit and credit – debit includes interlink EMV Migration- Not as Scary as it Used to Be Visa Public 4 42% 42% Card Not Present 11% Lost and Stolen ENCRYPTION Counterfeit REAL-TIME PREDICTIVE ANALYTICS Fighting fraud from every angle EMV • Creates a unique cryptogram for each transaction • Not a silver bullet Tokenization Mobile proximity • If payment token is used as the PAN*, it will be identified as stolen and rejected VCAS 3D SECURE • Dynamic, riskbased authentication • Reduces friction at the POS **** eCommerce Biometrics • Fraudster must know PIN for card to work • Enhances cardholder verification • Static data set Visa Public *Primary Account Number PIN Source: Visa Fraud Performance Benchmarking. Reporting window YE 2015. Remaining percentage fall under “Other” fraud types. U.S. Fraud by Type (% = share of total) EMV Migration- Not as Scary as it Used to Be • Replaces PAN with unique digital alias • Reduces friction at the POS 5 How does EMV chip technology work? Because the cryptogram changes with every transaction, even if the card data is stolen, the information can’t be used to create counterfeit cards because the cryptogram would have already “expired” 4 0 0 0 1 2 3 4 5 6 7 ^ J O H N D O E ^ 0 1 2 0 1 7^ 1 0 1 ^ 2 1 7 ^… Card number Name Expiry Service code CVV (STATIC) 4 0 0 0 1 2 3 4 5 6 7 ^ J O H N D O E ^ 0 1 2 0 1 7^ 2 0 1^ 3 8 6 ^ 5 98 8 1 2 4 3 23 1 5 3 6 4 06 6 8 1 7 9 88 3 4 0 2 9 1 71 1 3 4 5 32 0 8 6 5 2 97 4 0 8 1 3 1 ^… 4 2 3 9 0 8 Card number Name Expiry Service code iCVV Cryptogram (DYNAMIC) 4 0 0 0 1 2 3 4 5 6 7 ^ J OH N D O E^ 0 1 2 0 1 7^ 2 0 1 ^ 3 8 6 ^7 93 8 1 2 4 3 22 1 5 6 4 05 6 8 1 7 9 86 6 3 4 0 2 9 1 70 8 1 3 4 5 30 1 8 6 5 2 23 9 4 8 1 3 1 ^… 4 2 7 9 0 8 Card number EMV Migration- Not as Scary as it Used to Be Name Expiry Visa Public Service code iCVV Cryptogram (DYNAMIC) 6 Visa U.S. EMV chip roadmap • In August 2011, Visa led the industry by setting a plan to move the U.S. to EMV chip technology • Successful globally, liability shifts have been the primary tool used to encourage both issuers and merchants to adopt EMV chip technology April 2013 April 2015 Acquirer EMV Chip POS Processing Mandate Acquirer EMV Chip ATM Processing Mandate   EMV Migration- Not as Scary as it Used to Be October 2015 October 2017 POS Liability Shift AFD* Liability Shift  ATM Liability Shift U.S. domestic and cross-border U.S. domestic and cross-border *AFD = automated fuel dispenser Card Terminal Liability Mag stripe only Mag stripe only Issuer Mag stripe only Mag stripe only Issuer Mag stripe only EMV chip Issuer EMV chip Mag stripe only Acquirer EMV chip EMV chip Issuer Visa Public 7 U.S. EMV chip migration status as of Sept. 2016 52% of US cards now have chips that resulted to 82% of payment volume Adoption 176.0M 196.9M US issued EMV Visa credit cards US issued EMV Visa debit cards 94% PV 68% PV US chip credit card chip on transaction chip PV adoption 40.8% by PV US EMV Visa acceptors 39% PV Fallback2 Usage1 32.2% 18.6% US credit card chip on 1.64M 16.1% 8.2% US debit card chip on USchip debittransaction card chip on chip PV adoption 23.0% by PV 2.1% 2.8% US EMV credit card US EMV credit fallback ratecard fallback rate 2.0% by PV 3.6% 5.7% US EMV debit card US fallback EMV debit ratecard fallback rate 3.5% by PV Sources: Current cards based on MARS data through September 30, 2016. 1Visa branded chip cards processed as chip transactions. 2Magstripe transactions using a Visa branded chip card in a chip terminal. EMV Migration- Not as Scary as it Used to Be Visa Public 8 Merchant Chip-on-Chip Transaction Rates Key Merchant Categories Have Made Significant Strides* Electronics Drug Stores/Pharmacy 79% 62% Food/Grocery Discount Stores 50% EMV Migration- Not as Scary as it Used to Be Home Improvement 57% Department Stores 49% 49% Visa Public *Source: VisaNet Data for August 2016 9 Chip Card Issuance by State Penetration of Chip Cards 70%+ 60-69% 50-59% 40-49% ME WA VT ND MT MN OR SD ID MI WY IA NE NV UT CA CO NY WI IL IN OH WV NC TN AZ OK NM SC AR MS TX VA KY MO KS PA NH MA RI CT NJ DE MD DC AL GA LA FL AK HI Source: VisaNet Data as of September 30, 2016. Chip card transactions at Mag Stripe or EMV terminals (based on 201 service code) EMV Migration- Not as Scary as it Used to Be Visa Public 10 U.S. EMV Chip Migration Status Counterfeit Fraud Continues to Decrease Source: https://usa.visa.com/visa-everywhere/security/chip-technology.html EMV Migration- Not as Scary as it Used to Be Visa Public 11 EMV Testing and Certification Update • Visa announced EMV chip roadmap in 2011 to give the industry time to plan and adopt EMV on their own timeframe • Visa has been working with acquirers, processors, and point of sale providers on programs aimed at increasing the speed of certifications • Visa has streamlined testing requirements for chip terminals that can reduce certification timeframes by as much as 50 percent – Published a revised set of “minimum” test scripts in Dec 2015 • Reduced the number of test scripts by over 50%, from 35 to 14 • Acquirers can self-certify and complete testing in less than an hour • Many merchants are dependent on Value Added Resellers (VARs) to develop and implement their terminal software – VARs can pre-certify their software solutions using 3rd parties to reduce the testing that the acquirer/processors need to do by up to 80% – Visa provides hands-on support to VARs who need technical information, education, consulting, and training. A dedicated team of experts are available to provide direct support. EMV Migration- Not as Scary as it Used to Be Visa Public 12 EMV Chargebacks In June, Visa announced the following changes to our chargeback policies – Minimum Chargeback Amount Effective 22 July 2016 through April 2018, a $25 minimum amount will be required for allowable counterfeit chargebacks on U.S. domestic card present transactions – Maximum Chargebacks per Account Effective from October 2016 through April 2018, a maximum of 10 counterfeit fraud chargebacks will be allowed per account in 120-day period for U.S. domestic card present transactions EMV Migration- Not as Scary as it Used to Be Visa Public 13 Visa Quick Chip for EMV® speeds up checkout times on chip transactions at the point of sale and optimizes the consumer experience while providing the same level of EMV security, including the cryptogram. Public and other countries. EMV is a registered trademark or trademark of EMVCo LLC in the UnitedVisaStates EMV Migration- Not as Scary as it Used to Be Quick Chip 14 With Quick Chip, merchants and their customers benefit from a faster EMV check out experience EMV Migration- Not as Scary as it Used to Be Visa Public 15 Reduce development & testing time by up to Implement Quick Chip in as little time as 85% EMV Migration- Not as Scary as it Used to Be 1 week Visa Public 16 Introducing Quick Chip 1 2 3 Insert the card face up, chip end first Remove card when prompted. Processing should take about 2 seconds or less. Follow prompts on screen to finalize transaction Insert card Remove card Follow prompts EMV Migration- Not as Scary as it Used to Be Visa Public 17 Counterfeit fraud mitigation best practices Point-of-sale merchants who are not EMV-chip enabled Read and compare verification Be on the lookout for highly suspicious transactions High-value purchases such as prepaid cards, electronics, jewelry or large amounts of merchandise Use common sense Know what behavior is normal for your business EMV Migration- Not as Scary as it Used to Be Visa Public 18 Visit www.visachip.com Online destination for merchants, acquirers, issuers, service providers and consumers EMV Migration Forum • www.emv-connection.com • gochipcard.com EMV Migration- Not as Scary as it Used to Be Testing Documentation • Visa Inc. U.S. EMV Chip Terminal Testing Requirements • Visa Minimum U.S. Online Only Terminal Configuration and Quick Chip • Visa Chip Bytes and more….. Visa Public 19 Questions? EMV Migration- Not as Scary as it Used to Be Visa Public 20 Upcoming Events & Resources • Upcoming Webinars – www.visa.com/cisp —November 16, 2016 – Top 10 Signs your Payment Network is Breached • Visa Data Security Website – www.visa.com/cisp —Alerts, Bulletins —Best Practices, White Papers —Webinars • PCI Security Standards Council Website – www.pcissc.org —Data Security Standards – PCI DSS, PA-DSS, PTS —Programs – ASV, ISA, PA-QSA, PFI, PTS, QSA, QIR, PCIP, and P2PE —Fact Sheets – ATM Security, Mobile Payments Acceptance, Tokenization, Cloud Computing, and many more… EMV Migration- Not as Scary as it Used to Be Visa Public 21