EMV FAQ’s for Merchants

What is EMV?
EMV stands for EuroPay, MasterCard, Visa, the three entities that worked together to create worldwide standards for
the chip card to ensure global interoperability. EMV is a microchip-based technology designed to reduce the
fraudulent use of credit and debit cards at the point of sale. Banks are beginning to issue payment cards with these
embedded chips, which also support contactless payments. EMV chip cards generate a one-time code with every
transaction, making them nearly impossible for counterfeiters to duplicate and use for in-store fraud. EMV also
supports enhanced verification methods such as PIN and signature verification, although these verification methods
are not a part of the initial U.S. rollout.

How does EMV affect me?
As part of the EMV initiative, the four major card brands have announced a “liability shift” which will become effective
on October 1, 2015. This liability shift will apply only to certain networks and only under very narrow circumstances,
as follows:

Counterfeit fraud liability (applies to all four major card brands):
A merchant may be liable for a chargeback resulting from fraud when a magnetic stripe card that was counterfeited
from an EMV chip card is swiped at a POS device that is not EMV-enabled, and the transaction is successfully
processed. This liability shift only applies to transactions where the magnetic stripe was read and does not apply to
contactless transactions.

Lost or stolen chip-and-PIN card liability (applies to American Express, Discover, and MasterCard only):
A merchant may be liable for a chargeback resulting from fraud if a lost or stolen “chip and PIN” card:

• is presented at a magnetic stripe-only POS device, and the card is processed as a magnetic stripe transaction;
  or
• is presented at a chip-enabled POS device that does not support PIN, and is processed as a signature chip
  transaction.

There is no expected change to Visa liability for lost or stolen card fraud, so this liability remains with the issuer.
Nevertheless, the lost/stolen scenarios might have little consequence to U.S. merchants because most card issuers
are not issuing “chip and PIN” cards, and are instead issuing “chip and signature” cards.
Merchants will have to assess their situation to determine if and when it makes sense for them to migrate to EMV. If,
for example, card-present transactions are a small percentage of a merchant’s transaction volume, the merchant may
decide to defer upgrading their payment terminals until a later date and simply accept the risk that they may be liable
for any counterfeit chip card transactions.

What changes will merchants see with EMV?
Many parts of the payment process will change with EMV technology. The flow of a transaction will change due to
the use of dynamic authentication of the card, which requires an EMV-capable terminal. To complete a standard
transaction, a chip card must stay in contact with the chip reader throughout the entire transaction. An alternative to
this flow will be terminals equipped with wireless, non-contact readers.

What will I need to do if I choose to upgrade my point of sale solution to meet EMV standards?
To benefit from EMV technology, merchants must use payment terminals, applications, and devices that all pass
several levels of EMV certification. To be EMV ready, you will need to replace all of your payment terminals, including
any existing Verifone MX915s, with ABC’s EMV-certified version of the Verifone MX915 terminal. You will also need
to have ABC’s EMV Services installed on each connected workstation.

Will ABC have an EMV-ready point of sale solution in place before the October 2015 liability shift?
No. ABC is currently developing an all-encompassing EMV-ready solution to be integrated with its payment
application and terminal. However, the delivery date for this solution is not entirely within our control due to EMV’s
complex certification requirements. Unfortunately, offering an EMV-complaint solution is not simply a “plug-and-play”
process—it is an elaborate multi-step process involving several third parties. Procuring EMV-certified payment
terminals is only the beginning. Certification also requires that we successfully complete testing phases with our
payment processor and each of the four major card brands, all of whom have their own unique tests and requirements.
And, while ABC has been prepared to begin certification development for months, our processor did not allow us to
start until late August 2015. For these reasons, even though ABC is focused on this development as a top priority, it
will not be complete by October 2015.

Will cards still be issued with magnetic stripes, and will my existing equipment work after the liability shift?
Yes and Yes. Chip cards will still be issued with magnetic stripes for the foreseeable future. The liability shift will have
no effect on the operability of existing equipment, which will continue to work as it did before the shift.

Will customers with magnetic stripe cards be able to use EMV terminals?
Yes. For the foreseeable future, magnetic stripe readers will continue to be a feature on EMV terminals. This will
allow EMV terminals to process transactions from the large base of magnetic stripe cards in the market, and will also
support transactions when the terminal cannot read a chip card.

Can an EMV card be used in a magnetic stripe terminal?
Yes. EMV cards are issued with a chip on the front of the card, but still contain the familiar magnetic stripe on the
back of the card. This enables backwards compatibility with existing non-EMV-capable devices.

Do EMV transactions take longer to process than magnetic stripe transactions?
EMV transactions will take a few seconds longer to process than magnetic stripe transactions. Also, the overall time
“in lane” will increase due to the additional interaction the cardholder is required to have with the transaction.

Since the customer must leave their card in the terminal during a transaction, what can be done to reduce
the number of cards forgotten in the terminal?
ABC-provided payment terminals will be programmed to produce an audible beep and on-screen prompts indicating
when the card should be inserted or removed, and the customer’s receipt will be printed only when the transaction
has successfully completed.

What happens when a consumer has a chip card but insists on swiping the card instead?
If a chip card is swiped, the system will reject the swipe and force the consumer to insert the chip card. The swipe
capability will only function for non-chip cards or if the terminal cannot read a chip card. However, in the case of a
non-EMV terminal, the chip card must be swiped. In addition, manual entry is available as a backup method on most
terminals, including the terminals ABC is developing.

When do I need to have an EMV-ready POS system?
There is no mandate for merchants to use EMV certified systems. However, beginning October 1, 2015, merchants
without an EMV solution may be liable for certain types of fraud (see “How does EMV affect me?” on page 1).

Does adoption of EMV eliminate the need for End-to-End Encryption or Tokenization?
No. To provide the most secure payment experience for you and your customers, it is important to evaluate all three
technologies.

EMV is a fraud-reducing technology that can help protect your business and your customers from financial loss if a
criminal uses a counterfeit chip card at your point of sale.

Encryption and Tokenization provide card data security during a transaction. Encryption protects the data at the
point of sale and throughout the entire transaction process. Tokenization replaces the personal account number with
a surrogate value that is used during the transaction.

Are Tokenization and Point-to-Point Encryption (P2PE) options with EMV?
Yes. ABC will support EMV with P2PE and Tokenization.

Does EMV impact my card-not-present business?
No. Card-not-present transactions are currently not within the scope of EMV, since there is no card-terminal
interaction. ABC’s card-not-present channels include online signup, DataTrak’s card-on-file, club account charges
settled through ABC, and ABC’s dues billing.

How does EMV impact PCI requirements?
Merchants are still required to maintain PCI compliance, but PCI does not require a merchant to be EMV compliant.
However, merchants may be eligible for a waiver of the annual PCI Validation. To be eligible for the waiver, 75% of
the merchant’s transactions must be processed through EMV-capable terminals that support both contact and
contactless transactions. This does not mean that 75% of the transactions must be chip card transactions. It simply
means that the transactions—whether chip or magnetic stripe—must process through EMV-capable terminals.

How do I learn more about EMV?
For more information about EMV, please contact your ABC Account Executive.