Webinar- Payments Fraud Trends & the U.S. EMV Card Migration: What You Need to Know

Hello everybody and thank you for joining us today for our Payment Fraud trends and EMV what Small Businesses need to Know Webinar and I would now like to begin today's conference and turn the call over to Meredith from the SBA for opening remarks.

Great.

Thank you so much, Tony. And thank you to @&t for helping us out today. On behalf of the U.S. small Business Administration, we're thrilled to be partnering with the Federal Reserve on this important education effort.

Thank you to Kathy, Katie Jacobs and.

Mary Hughes of the Federal Reserve who are providing their expertise on this topic.

And thank you to all the folks.

On the line who joined us for today's important presentation on payments fraud trends and the upcoming EMV card migration. This is a really timely topic. It's important to small business owners that we want to make sure that you all have the information you need both around how you assess and mitigate payments fraud and to make you aware and understand the tools and resources around the migration in the United States to chip card technology. Here at the sba, our core mission is to provide small business owners with access to capital counseling and contracts. We advocate on behalf of America's 28 million small businesses and we work with a national network of business counselors around the country, Small Business Development Centers, Women's Business Centers, Veterans Business Centers, and SCORE counselors to make sure that no matter where you're located in the US you have access to free or no cost, free or low cost counseling advice and training tools to help you start and grow your business.

So with, thank you for being here today.

Thank you to the Federal Reserve for partnering with us on this education effort. And with that I'd like to turn it over to Katie Jacob with the Federal Reserve in Minneapolis.

Thanks Meredith. And we really appreciate the opportunity to partner with SBA as well. Mary and I both work for the Payments Information and Outreach Office of the Federal Reserve bank of Minneapolis where we see education around electronic payments, payment fraud, EMV and these types of topics towards businesses as one of our main missions. So this is a great opportunity for us as well. We're basically going to divvy up this webinar into two main sections. I will be covering some information about payments fraud. I will start by giving a very general lay of the land statistics on what's happening with payments fraud in our market in the US and talk about how businesses can understand their risks. And then I will get a little bit more specific about understanding what you might see from as far as fraud trends and mitigation opportunities by different payment Types. And then I'm going to pass it over to Mary Hughes, who will take you through some slides on the EMV migration that Meredith outlined. And we should just say at the beginning that the opinions and the information that you'll hear are Mary and mine alone and are not representative of the Federal Reserve bank of Minneapolis, the Federal Reserve bank of Minnesota, or the US Small Business Administration. So in order to go through just a little bit of the lay of the land, we won't try to do too many statistics here, but we have a very robust and complex payment market in the U.S. one thing that we will be talking about throughout this presentation is the card market. Obviously that's what is important when we are talking about EMV migration. And in the very first slide we can see that in the US Consumers and businesses love their payment cards. We conduct a lot of financial transactions with our debit cards and our credit cards. This slide comes from a survey that the Federal Reserve does every three years of electronic payments. And you can kind of gauge this over time. And debit cards have become an extraordinarily popular payment method in this country. It's not necessarily the card trends that we see here are not necessarily the same in other markets that don't have kind of a long lasting credit card market the way we do here. But the important thing to notice here is that while cards are very popular, they're also very prone to fraud. So we can see on the right side of the slide the unauthorized volume, the number of transactions that could be considered fraudulent is also high for cards. And this will be a theme that we'll come back to, and we'll come back to it here. Actually, when we were in the last slide, we were looking at volume, so that is the number of transactions. One thing that's important to differentiate though is if you think about the way you as a consumer engage in financial transactions, you're probably not using your debit card for very high value transactions. When we make our mortgage payments or our car payments or other large payments, we're probably using the ACH method of kind of a direct payment out of our checking account. Checks are still quite popular in this country, whereas in some other places that might not be the case. So one thing that we see that's interesting about cards in particular is that while they might represent a small portion of the overall value of the transactions that we make, we still have this disproportionate number of unauthorized value on the card side. At the same time, if we're thinking about an individual Fraudulent transaction. What is the damage that is being done? We still see that checks show the highest average value of unauthorized transactions. And if you think about, again, the way that people make payments and what they write checks for, and as opposed to what you might use a credit card or a debit card for, that does make sense. So that's just a general lay of the land of overall statistics of what we're seeing in the market. We'll have the opportunity. The unauthorized transaction statistics are fairly new to the Federal Reserve payment study, so we'll have an opportunity to see over time how those trends change. I want to switch gears a little bit and give an overview of how businesses can understand their risk from payments fraud. And it's obviously a very complicated market and is a lot to think about from your business perspective. But we would recommend thinking about your risk with three basic components that are actually relatively simple on the face of things, but contain a lot within them. And one thing that I think small businesses have an advantage in, in some ways over very large businesses, is that in this first component that you might be more likely to know your customers. That might not be the case, but this is one of the things that can really help to reduce payment fraud, and that is knowing who you conduct your transactions with and being able to tell if something doesn't seem right. But then there's also keeping abreast of what your risk is. What is the probability of fraud attempts by payment type, which is why we're talking about that today, and then thinking about what your portfolio of transactions looks like and how that compares to where more fraud might be occurring in the market, and then also understanding what that means from a potential loss perspective. So we see a lot in the news these days about payment fraud data breaches that are highly publicized, and we see millions of records have been breached. But what does that mean? And it's important to understand that often fraud attempts don't necessarily lead directly to successful loss of funds. So there's a lot to kind of keep track of there. And one of the most complicated things for businesses to understand is that just as our payment market is very robust, we have a very complex way of assessing liability for fraud. And that's not necessarily the way that other countries have managed their liability for different types of payment fraud. But there are a variety of laws, regulations, and contracts on a federal and a state level that determine who is liable, what party is liable for different fraudulent transactions. This can be different based on whether or not this is a consumer or business transaction. And interestingly, Most of our laws and regulations have really are really different based on the type of payment instrument that you're using. And this is something that I think is not often understood well by consumers or small businesses as well. And that is that depending on how a payment is made, whether it's a check or a debit card, if it's made, you know, in person, if you're physically handing your card, you know, or inserting it into a machine at the point of sale, or handing it to a person, that could be, that's a, a card present transaction as opposed to when you and I sit down and make payments on our phone or a computer through Amazon and our actual physical card might be sitting somewhere else. All of these things affect how liability is assessed. And I think that usually when people are making a payment, they just want to make a payment and it might not be obvious to them what their rights and responsibilities are based on what type of of payment they're making. So that's something that's important to keep in mind. And when we talk about a few slides from now, some different types of fraud that are perpetrated based on payment type, liability issue can definitely come into play. So the next slide, I think I actually.

Hi Katie, this is Tony, your moderator. It looks like you have lost the connection to our connect session here. So if you do want to just try and reconnect and while you are reconnecting, you can just prompt me to advance the slides for you.

Sure, that would be great. I want to talk next about on slide 10, the main barriers to fraud mitigation that we hear about from non financial companies. So in addition to the Federal Reserve's study of payments, the Federal Reserve bank of Minneapolis issues a survey that focuses specifically on payments fraud every two years. And we ask both financial institutions and non financial companies about their experiences with payment fraud. And one of the things that we ask so when we're, when I'm talking about non financial services companies, you can think of these as the corporations that we survey. We ask about if it's understood that fraud is a serious issue, what are some of the barriers to implementing a successful fraud mitigation program? And what we've heard about kind of time and time again from many companies is that there just might not be staff resources available to do this. That obviously companies are in the business of running their business and this might not be, they might not have the expertise or just the resources to invest on the staff side. Also, if fraud hasn't been a problem in the past, there might be a lack of a compelling business case or a cost benefit analysis done. And if not a lot of loss has occurred up until this point, there might not be a good case for investing in a lot of new infrastructure. We also hear from many companies about concerns around customer privacy and other data issues or more competitive issues that may or may not be more of an issue for larger companies. So going to the next slide, which is slide 11, related to the main barriers to fraud mitigation, at the same time when we ask, okay, so we understand that there are barriers to trying to mitigate fraud. What are some of the more effective things that can be done to control fraud losses for corporations? And so in this slide you'll see some of the key changes that are made to payments, risk management practices and whether or not they were successful. And some of these are very basic things that have to do with staff training and education, as well as just using authentication methods and other ways of understanding how payment transactions occur at your company. So now I want to go through some of the issues that you might see depending on what type of payment you are accepting. So I would like to go to slide 13 to begin to talk a little bit about unauthorized transactions by payment method. Again, this is just a different way of looking at what we talked about at the very beginning of the presentation. But one thing that I really want to showcase here again, since we are to some extent going to be focusing a little bit on card payments because we want to talk about EMV in the second half of the presentation and that is when we when you see here, this is the payment types that have the highest loss rate due to unauthorized transactions per $10,000 spent. We see very low fraud rates. For ACH transactions, for example, you see kind of a really large range from in the sense into the highest number we see here is for signature card present debit transactions at $12.45. The reason we have this arrow posting here is to point out that. When we think about what types of payments you're accepting and the fraud reduction methods that might be kind of inherent to the payment type. If you compare signature transactions to pin, really what we can see here is that the PIN is actually a very useful and valuable fraud reduction method. A signature, if you think about using that yourself at the point of sale, is relatively easy to forge. A lot of times no one is really looking at the signature to verify that it matches what's on the back of the card. A PIN is obviously something that you need to know in order to use it. So it is a, you know, you can think of it as a successful fraud mitigation tool that is kind of inherent to that payment type. The next slide, slide 14, looks a little bit at check fraud. Now if we think back to the very beginning when again we were focused on the fact that cards kind of eclipsed some of the other payment types in the amount of fraud that we see here in the US it's important to keep in mind that checks are still used particularly in the business to business space, and probably aren't going anywhere anytime soon. And some of the things that make checks very valuable as an efficient and effective payment type are the things that make checks vulnerable to fraud as well. So, so all of the information that you need to know about the payment is available directly on the check and that can make them vulnerable to fraud as well. But one of the main reasons that check fraud is still an issue is that the kind of low tech nature of the payment type makes it easy to forge. Again, people are very good at forging checks and you know, this is just something that doesn't take the kind of technical acumen that some other types of payment fraud necessitate. So we do, you know, have an electronic check market here in the US and we've seen some innovations such as the ability to do remote deposit capture that could create new fraud risks. Things like dual presentment where one check might be, might be presented in person as well as through an image. And this can cause some issues. For additional possibilities for ways that checks can be vulnerable to fraud, the next slide focuses on card fraud. This is slide 15. And we kind of separate this into two different ways of thinking about cards. When we're thinking about purchasing cards or commercial cards. This is something that's specific to the business market that we wouldn't see when we're just talking about consumer payments. Some of the reasons that these cards can be subject to fraud include employee misuse, the use of lost or stolen cards, again, the ability to counterfeit these cards that are used online or at the point of sale. And in a few slides I'll talk about some of the general methods that businesses can use to avoid these types of problems. But on the other hand, that's in kind of using a commercial card when accepting card payments just to use card payments as a way to make transactions happen at your business. We think back to all of the different things that were discussed just a few minutes ago as far as whether or not you're accepting card, present transactions, card not present transactions, the risks that that might pose to you and whether or not cards can easily be used if lost or stolen. So those are some issues to keep in mind when making decisions about accepting cards for payments. And the next two slides we're on slide 16, focus on fraud that involves ACH that affects businesses. And what I would like to focus on here is that in the next slide, I'll talk about one of the things that again, is often in the news and that many companies are concerned about, and that is corporate account takeover. But one thing to consider when hearing about any type of payment fraud is that there's another kind of fraud to consider that isn't specific to the payment type, and that is, you know, just general identity theft or account information theft. So something our statistics bear out when we saw this at the very beginning of the presentation, that ACH is actually a fairly safe payment method. We see very low loss numbers for ACH payments. This is not an area where businesses are necessarily seeing the most fraud, but it does happen. Fraud is available in every payment type. But the main way that ACH transactions can be vulnerable to fraud is through the compromise of information about your bank accounts. And this can happen through a variety of methods. But basically, if a criminal can find a way to get information about your business accounts and thereby create fraudulent transactions or unauthorized ACH debits against your business bank account, that's what we're talking about here. So this happens through a variety of kind of social engineering methods. It can happen through an email scam, basically a criminal finding a way to get into information that will allow them to make financial transactions. And there are a variety of ways to mitigate that risk. On the Next slide, slide 17, we are just kind of giving examples of how these corporate account takeovers take place. And when I was talking about fraud liability at the very beginning, Anne mentioned that one of the complexities with fraud liability is that in cases where liability is assessed through a court case or through through case law, what we've seen with corporate account takeovers, and again, this is where a criminal has found access to account information and started pushing transactions through that were not authorized. Judges have actually ruled in kind of opposite directions in these cases. So you can imagine, let's say company A has account information that is breached through some kind of social engineering and sends a million dollars of unauthorized transactions through once that is discovered. And we could hope that it would be discovered immediately. But one of the things about payment fraud is that it often does take some time to discover then who is liable for that fraud. What we've seen Is that judges have ruled in some cases that the corporation was liable because it did not have effective methods in place to reduce the risk of that information being compromised. And in other cases that look very similar, the financial institution was found to be liable for not stopping the transactions from going through. So that's just something to keep in mind. The next slide really kind of speaks to that. This is slide 18. And as we have, you know, as our payments are becoming more and more efficient, we have more technology available to us, we can make payments on our phones. You know, businesses can use innovations such as square in order to accept card payments. We have a variety of ways that payments can be compromised. They can be compromised from an individual. An actual device, you know, could be compromised. Whether it's the phone or the ATM or the point of sale device. We still have the very kind of low tech and old school ways of experiencing payment fraud that include things like mail being stolen, you know, checks being stolen out of, you know, out of someone's mailbox and that information being compromised that way. So as we have more ways of, of accepting and making payments, that opens it up to additional points of compromise as well. But we don't want to make businesses think that things are all doom and gloom here. So on slide 19, we just give some overall advice about what we think small businesses should be doing. And the main piece of advice I think that we give to all companies when we talk about these issues is just to really make sure that your organization sees the prevention and detection of payment fraud as one of its objectives. That you know, if, you know, as part of your business, you need to be able to make and accept payments. This is just a fact of life these days. And there are a variety of things that you can, that you can do both internally as well as through your financial institution partners to help you set policies and procedures that can help you monitor this issue going forward. You can always talk to your bank about cost effective tools that are available to you through that relationship that can help you mitigate or prevent some fraud from happening. And some very kind of low cost things such as just educating and training employees about how to recognize fraud when it's happening and what to do if it does happen. I know at our company just to use our computers, not for financial issues, but we go through regular security training that helps us figure out how to recognize a fraudulent email account or a URL that is trying to take us somewhere that we shouldn't be able to go. Companies can do things such as designate one computer as the computer that accepts payments. There are a variety of things that can be done so that you can stay on top of this fraud issue. The other thing that we recommend is just that on slide 20, we give some examples of specific things that, again, if they become a part of the daily practice, can really help to mitigate fraud in the future. And just staying on top of what's going on with your accounts so that you can see if something seems off, something seems not right, and catch that problem as quickly as possible, using strong passwords, monitoring and measuring your fraud attempts, and just, again, generally keeping on top of things. One of the great things about having the type of payment system that we have is that it's very innovative and things are constantly changing and there are new opportunities and ways to make payments. But that also means that fraud prevention tools need to be constantly updated. And before I pass it over to Mary to talk about emv, we just want to note that through the Federal Reserve, we have published something through a coalition of industry partners that we help to staff at the Federal Reserve bank of Minneapolis called the Remittance Coalition. That is a free resource that's available to anyone to use. It can be white labeled by any company. There's no copyright information. It can be used any way that you would like to use it. That is called the Small Business Payments Toolkit, and it's available online here at this link that you see. And there's actually a nice section in that toolkit about payment fraud that you might find very useful. So in the interest of time, I would like to pass it over to Mary Hughes to talk about EMV migration.

Thank you very much, Katie. I'm going to move to EMV now, and we're going to discuss aspects of the US Migration to EMV cards. You should know that the United States is the last developed country in the world to migrate to EMV technology for credit cards, debit cards, cards, and prepaid cards. The EMV stands for Europay, mastercard, and Visa. And the US Migration is being driven by the four major card brands, which are Visa, mastercard, Discover, and American Express. They've been making rule changes and offering incentives so that US Financial institutions issue chip cards and so that US Merchants start accepting chip cards at the point of sale in stores, hotels, restaurants, and so forth. You may already have a chip card or two in your wallet. These cards have a small metallic square embedded on the front of the card. And this square is actually a microprocessor that stores information securely and performs cryptographic processing during the payment transaction. In this section of the webinar will explain why these cards were invented, describe their main benefits, explain how chip cards work, and who is affected by this new technology. We'll outline the roadmap that the card brands are implementing to migrate the US to chip cards. And we'll highlight the upcoming October 1, 2015 fraud liability shift that is occurring and talk about what it means to small businesses. We'll look at the status of the US Migration to chip cards in terms of cards issued to U.S. cardholders and in terms of merchant acceptance at the point of sale. And we'll offer some insights on why some people feel that chip cards may mean opportunity for small businesses. I'm going to pause a second to discuss two definitions that are important in the card market. First of all, in the card market they distinguish between card present transactions versus card not present transactions. As the name suggests, card present transactions are those in which the merchant can see and inspect the card. In contrast, card not present transactions occur when people use their cards to buy things online in e commerce environments, or they buy things over the telephone or through the mail. And we're going to discuss how chip cards influence fraud rates in each of these areas. So what is emv? The magnetic stripe on our old credit cards relies on technology that's been around for a really long time. Remember cassette tapes? Well, Makestripe uses that same technology. An interesting historical fact is that chip card or EMV technology was developed because of problems with the reliability of telephone lines in Europe. Traditional mag stripe cards required that the merchant had to have access to a telephone line to call the card issuer in order to authenticate each transaction. That's called an online transaction. And initial deployment of EMV cards focused on improving card security in countries that relied mainly on offline transactions due to the lack of good telephone service. So they invented this card with a chip in it, in which the chip, as I described previously, is a microprocessor, a little computer, if you will, that can communicate with the chip reading terminal at the point of sale in order to verify that the cardholder's personal identification number is currently and that the card has not been tampered with. Have you ever traveled to another country and found out the hard way that your US issued mag stripe card doesn't work overseas? Well, a major benefit of chip cards is that since the technology is based on the global proprietary standards developed by EMV Co. Chip cards are interoperable throughout most of the the world. So this means that travelers should be able to spend on their chip cards anywhere they go the security credentials in the chip are extremely difficult to counterfeit and countries that have introduced chip cards have seen reduced losses due to counterfeit fraud. At the point of sale, chip cards create what's called dynamic data which is unique to each purchase transaction. This dynamic data authentication protects against what is called replay fraud since dynamic data can be used for purchases only once. Now this feature is in sharp contrast to how traditional may stripe cards work carry what's called static data that does not change from one transaction to the next. So criminals can steal the data from the makes drop stripe and they can use it to create fraudulent transactions. For example, criminals may install devices to skim card data at automated fuel pumps or at ATMs and then they can use that card data to make fraudulent purchases. A cautionary note, chip cards are not a cure all for retail data breaches. Clear text card numbers may be sent from the sales terminal. So there is still a vulnerability for information to be stolen. And that's why savvy merchants and issuers in the card brand are using methods such as tokenization and other tools which we'll discuss in a minute, to mask and protect data so that it cannot be stolen. This slide tells us a little bit about how EMV works and the takeaway like you to receive from this slide is that understanding that moving to chip cards affects the entire card processing system of the U.S. it's not just the cards themselves that are changing. It also requires terminals that can read the chip, there's new messaging data, new application logic involved, and it affects all the stakeholders in the US which are listed in here on the slide, everyone from the cardholder to the issuer. And there's a group called the EMV Migration Forum which has been around for a couple of years, which is a group of all of these stakeholders who are working together to try to smooth the transition to chip cards in the US and we have a link for their public website in the Resources section and you'll find a lot of good information there from the EMV Migration Forum on items pertaining to chip cards. The four card brands have issued varying roadmaps to implement EMV in the US and you're seeing this whole migration from magnetic stripe cards to chip cards in the news a lot lately. Because of the October 1, 2015 fraud liability shift which is occurring on this date, the party, whether it's the card issuer or the merchant, the party that has invested in chip technology is protected from financial liability for card present, counterfeit or lost stolen fraud. The four major card brands have announced rule changes that employ a carrot and stick approach that's designed to accelerate adoption and through things such as merchant incentives such as audit release, upgrading of payments processing infrastructure to support EMV transactions, and then the STIC the fraud liability shifts which affect merchants, acquirers, ATM operators and issuers. Effective October 1, 2015, the card issuer or merchant that does not support chip card technology will assume liability for counterfeit point of sale card transactions for Visa, MasterCard, Discover and American Express cards and will assume liability for lost or stolen fraud for MasterCard, Discover and American Express cards. If neither or both parties are chip card compliant, then fraud liability will remain the same as it does today. So what if a customer presents a chip card to make a purchase and the merchant does not possess chip capable terminals and thus is not able to process the chip transaction and instead reverts to processing the payment via makestripe technology? Well, if the card turns out to be lost, stolen or counterfeit, then the merchant rather than the card issuer is going to be liable for that fraudulent transaction. Recall that I said that the card brands are attempting to move the US to chip cards via a carrot and stick approach. Well, this slide shows you the sticks which relate to liability shifts. The additional liability shifts are going to be occurring beyond the one that I described for October 1st over the next two years. Organizations that operate automated fuel dispensers have been granted extra time until October 2017 to equip for chip card transactions, and that's because converting card readers at the pump is very complex and costly. For similar reasons, ATMs are also being given extra time to adapt ATM machines for chip card acceptance. For MasterCard this means that 2016 and for Visa it's 2017. So how far along is the United States in terms of putting chip cards in the hands of U.S. cardholders? As you might expect, it is more expensive for financial institutions to issue a chip card than a simple make stripe card. However, following the various retail data breaches in which millions of cards were compromised, many card issuers decided to bite the bullet and issue chip cards when they had to replace the compromised cards. So this has accelerated the migration to chip cards in the US and it also has had the consequence of of building awareness among U.S. card holders about the benefits of chip cards. And the way it stands now is it's estimated that about half of the 1.2 billion cards that are outstanding in the United States will be chip enabled by the end of this year. Estimates vary, of course, but about half appears to be a pretty commonly accepted estimate and how many US Merchants are ready to accept chip on chip transactions. A chip on chip transaction refers to a transaction in which a chip card in the hands of the US Cardholder is accepted at a chip capable terminal at the merchant. The Merchant Advisory Group is a group that represents 85 of the biggest US merchants and they say that they think about one fifth of US Merchants will be able to accept chip transactions at the point of sale by the end of the year. Another source puts that at 25 to 30%. A presentation by Visa at a recent EMV Migration forum estimated that almost half of US Terminals are activated to accept chip cards, but that frankly is the largest percentage that I've ever seen. It is true that it is the larger retailers who tend to be the ones who are readying to accept chip transactions at the point of sale. I'm told that the Small Business Administration is working very hard to make sure that small employers are aware of the EMV migration and the fraud liability shift. And the SBA is focused on on providing tools and resources to help small businesses understand what this all means for them. Small business owners are advised that they should contact their payment processors or merchant acquirers or independent reps if that's who you're using to help process car transactions, that they should contact their service providers now if they haven't already, in order to learn learn about what their options are and what the various price points might be. This slide shows the results of a recent survey of small businesses that indicates that awareness of the chip card migration among small businesses is lacking. Only half of the surveyed businesses said they were aware of the October 1, 2015 liability shift and notably 3 in 10 said that they are ready to accept chip cards and 4 in 10 said at this time they don't have plans to accept chip cards. Why should small businesses invest in terminals and point of sale equipment that can process chip card transactions? Well, first of all, accepting chip cards can help small small business owners benefit from latest advancements in payment technology while also meeting the needs of customers. Many US Consumers believe, rightly, that chip card transactions are more secure than the old fashioned makestripe transactions and thus they may prefer to do business with merchants who accept chip cards. Another important opportunity is to reduce counterfeit fraud in card present transactions, avoiding assuming the liability shift and also reducing PCI reporting cost for audits at the point of sale. And then another. Finally, global operability is a huge benefit from chip cards in that the technology supports card payment methods across the whole world and by enabling your point of sale Equipment to accept chip transactions means that you can get business from international travelers who wish to use their chip cards in America when they're traveling. This may be a good time to mention costs. First of all, the cost of converting to a chip reading terminal is going to vary tremendously depending on on the type of small business you have and what system you have in place. But there are many affordable hardware solutions that won't break the bank of a small business, and you can check with your card payments processor or merchant acquirer to find out what your options are. You may be happy to learn that if you have purchased new sales terminals in the past couple years that they may already be equipped to accept chip cards. You would just have to purchase and install the necessary software and have the terminal certified and tested according to the card brand requirements. Testing and certification which your payment processor or merchant acquirer will take care of for you can take time, so it's important to plan ahead. As we discussed at the beginning of this section on EMV cards, Card not present transactions occur when people use their cards to purchase items online in e commerce environments or they buy things over the telephone or through the mail. It's important to know that chip technology, excuse me, does nothing to card non present transactions. So other solutions must be. Other countries throughout the world that have seen fraud perpetrated in the car not present environment want become popular. This is in card present situations that provide superior security so fraudsters care. Remember that kids game whack a mole Simply move to easier more vulnerable areas so when present environment is better protected. Fraudsters tangible criminal efforts on card not present transactions which they perceive more vulnerable. Remember it is the merchants who exhaust a card not present fraud. So other solutions applied by issuers, merchants, card brands, cardholders and others fraudulent card not present transactions and there's a variety of things available that can be considered to help mitigate present fraud. This slide shows authentication methods and tools that have been devised to reduce card not present fraud and I'm going to call out just a handful of them. A one time password would be where a card holder is a password that's only used for one specific transaction or for a specific online session. There's a randomized PIN pad which is the keypad so that if a fraudster is listening on the line they can't what the PIN is. There's biometrics which use iris, retina, hand, voice or fingerprint methods. We have a variety of tokenization solutions which is a method of replacing the personal account number with surrogate that will make no sense to a fraudster. And then you also see larger merchants proprietary approaches being employed. Good to know that this area is continually evolving and new tools are continually developed. So there are a lot of out there for merchants that want to take cards on, want to protect themselves from suffering the liability of cards at present. So this is our last slide here and I wanted to encourage small businesses who are thinking about accept cards to talk to their card provider and or payment processor. As a small business, you want to think about whether it makes you to invest in new point of sale terminals or upgrade your current equipment so that you can accept chip cards. This may be worthwhile. Accept card payments today in card present situations. You plan to do so in the near future. It can make more sense if a portion of your sales is to strangers versus people you know, making your business more vulnerable to counterfeit and lost and stolen cards. And it also can make a lot of sense if card payments are a significant of your total sales. Another consideration is that certain categories will have higher counterparts fraud rates than others. Rates are 5 to 10 times the average in stores that sell electronic computers, hobbies and games, music, drugs, pharmacy and wire transfer and money orders. But in contrast, counterfeit rates are orders of magnitude lower than average among doctors, religious organizations, dry cleaners, auto body shops and so does the industry you are in make you more vulnerable Card Fraud A business should assess its experience with fraud both in the past and projected in the future, as Katie put earlier, and also evaluate the costs and benefits with accepting chip cards. You can research low cost to you and rely on your service providers for advice. Also a good time to explore new payment technologies that are on the horizon. The US payment space is continually evolving. We're seeing a lot of new technologies come to play like Apple Pay, mobile logs and so forth, and you may want to consider accepting payments. We encourage you to learn more by checking out SBA.gov EMT and also our payments information and outreach website. So in addition, it's important to realize that all chip cards, whether in the US or elsewhere, will continue to carry MEG stripe for the foreseeable future, and that the US Payments infrastructure will continue to support megstripe technology for many, many years to come. Thus, merchants will still be able to accept card payments and process them with make stripe check technology, even if their sales terminal are not equipped to accept chip card transactions at this time. And Katie has included some additional resources on the next few slides for those of you that want to learn more about payments fraud and chip cards. So at this time, Katie And I will be happy to take your questions.

And guys, we'll go with the first question. Meredith, I do believe you're still on the phone with us here. We did read a couple of questions. Questions just asking if the presentation will be made available and where the recording for this event will be made available.

Yes.

Hi, folks.

So SBA will post it up on its landing page for EMV migration. That's SBA.gov EMV so hopefully we'll have that up in the next couple of days. We'll have the both presentation itself as well as the archived version of this webinar. So again, that's sva.

All right, perfect. And guys, the next question I see coming through are our notes. Questions here is asking if we could please define ahc. And Katie, I believe this is going to be directed towards your presentation.

Oh, I'm sorry. Yes. Automated Clearinghouse transactions is what ACH State stands for. And probably the people are most familiar with for ACH transactions are this is usually how you receive your paycheck. This is something that is directly tied to a bank account and that is how the payment is flowing.

All right, perfect.

Thank you, Katie.

And the next question I see coming in is asking, can a signature print prove a fraud?

Okay, prove that fraud has occurred. And that's a great question. I think one of the reasons that, you know, Fisher, as an authentication method, you know, we can think of it that way. If you are thinking about how to try to make sure that that transaction is real and belongs to the person who's trying to do it, you can use a variety of methods. It can be a pin, which is something that you know that hopefully you don't share with others. A signature, it could be biometric. As Mary was mentioning, there are a variety of different things and you know, the signature of all these different types of methods is probably the most valuable. And it's probably more difficult to prove, you know, one way or the other. Some of us might not even, you know, have for ourselves, you know, the same signature from day to day. So, you know, I'm not answering that from a legal perspective, but I think that that's one of the issues is that it does. It's a little bit more valuable from an authentication perspective.

All right, perfect. Thank you very much, Katie. And the next question I see coming through, guys. And Mary, I think this is going to touch back into your presentation is asking about a cutoff date when non card chips will be valid.

Well, the, the fact of the matter is that you can expect see mag stripes coexist with chips on our credit and prepaid cards for many, many years to come. I'm talking like 10 or 20 years at least. The fact is that no one expects that there will be 100% conversion to chip cards at the point of sale. And it's very important for the card brands and essential institutions who issue cards that card holders able to use their particular cards to purchase things. And so we'll want to accommodate magnetic stripe transactions as long as possible. And they'll also, of course, want to motivate merchants to accept chip transactions at the point of sale for the reasons that we specified. But there is no cutoff date.

All right, perfect. And this is on the same lines, Mary, for that question asking if EMV cards will also have a mag stripe and if so, is there a target date for the universal EMV only cards?

Yeah, that's a good question. And the answer is no, there is not a target date for universal EMV only cards. And frankly, to my understanding, throughout the world, all cards have magnetic stripes and chip cards for the most part. And in the United States, you can expect to find both of them on our cards for a long time to come.

So, guys, the next question is coming through. And a lot of these questions have to do with shift of liabilities. So the next one I'm seeing coming through is asking, with EMV migration and the shift of liability, do the major credit card companies plan on reducing their fees since their losses will be less?

This is Mary.

I'm afraid I cannot answer that because I don't know what the plans of the major card branches are.

Yeah, this is heide. I would say that's actually, that's a great question. And I think one of the things that is often debated about EMV is, you know, who, again, who benefits? And, and that question is directly related to that. But as Mary said, I'm not sure what the plans are for each of the card brands.

All right, perfect. Guys, the next question I see coming through is asking if iPhones will be able to accept the new card chip.

This is Katie. I mean, I think that's an interesting question, the way that, that payments flow through an iPhone. I don't think you're not necessarily talking about an iPhone having a chip capable reader. The ability to make a card payment using a variety of different mobile platforms will still remain the extent to which the chip will be involved. I think that, that, that's kind of a different question. But one of the reasons that we talk about the innovation in payment space and how to Think about fraud and liability is that we have so many new ways of making payments that we might see kind of take off in the future that will probably require additional or different types of, you know, fraud mitigation tools where, you know, the chip might not be the right answer. And Mary talked about some of those at the end of her presentation. You know, tokenization and other things like that.

And this is Meredith with the SBA back on that. You know, I know we've gotten this question a lot. And I think to the extent the question is asking about the devices that may attack phones, you know, there are various vendors out there that make those kinds of devices. I know many of those are often suitable for some smaller businesses, maybe not for others.

But those products as well in the.

Market are increasingly chip enabled. So as Mary and Katie said, it's really important to check with your current card processors to see what the options are and whether there may be low cost, affordable options for your business, depending on your needs.

Perfect, guys. So I have received a couple of questions, guys, asking if your credit card server or service provider has not gotten you the proper equipment by the October 1st date, what is going to happen?

Well, what will happen is if you are unable to accept a chip transaction, when a chip card is given to you and you have to revert to using mag stripe technology to process the payment, and that payment turns out to be counterfeit fraud or lost and stolen fraud, then the merchant will be liable for the loss.

All right, perfect. And so the next question I see coming through, and we have a couple of them relating to the same topic, is the vast majority of credit card transitions or transactions, I'm sorry, are non present card transactions. Can you guys just reiterate where we can find resources for this?

That's correct. And in fact, the United States has the biggest card not present, greatest number of card not present transactions in the world because of the popularity of shopping online and using your card to make purchases over the phone or through the mail and so forth.

But.

You can rely. You can go to the card brand's website. The major Card brands, Visa, MasterCard, Discover and American Express, have excellent educational resources on their public websites. You can also refer to the resources section that Katie and I have placed at the end of the slide deck. And I encourage you to look at the EMV migration EMV connection site that has a lot of great public information, as does a new site that they've recently put up called gochipcard.com and that would be any of those places would be a Great starting point to learn more about options and various authentication tools, tools and methods that you can employ or that you can work with your card issuer or others to employ to protect yourself from card not present fraud.

Hi, this is Kayte. I think in general for card not present transactions, again, as far as the EMV migration that's not directly related to these types of transactions. So it's a matter of assessing your risk and thinking about what kind of card or what kind of payment you're taking over the phone. I mean, obviously it's not necessarily just a card payment that could be taken over the phone. You could be taking account information and routing number in order to process an ACH transaction over the phone. And so it's again, understanding what the liabilities are for the type of payment that that is being made. And I think one overall thing to reiterate about card present, card not present and what's happening with EMV is that while EMV doesn't necessarily address any of the card not present transactions that are being made, the situation that we have right now, if you think back to the very beginning of our presentation, where we were going through the fraud landscape, is that we do have a general card fraud issue in the United States right now that is different than what we see in other countries, in part because we do not have this innovation of emv. So that there's obviously different ways of looking at whether fraud is an issue for card present or card not present. But we know that in the marketplace that we have right now, we need something that's better than the magnetic stripe, which is not been the most robust way to prevent fraud in the card market.

Hi. I would add too that if merchants want to look at the small business payments toolkit that is referenced on slide 34, the second item under Resources, we do have a very informative educational section in there on how to avoid accepting fraudulent cards in your small business and you may find some tips and advice that you can evaluate and decide whether would be useful to help you avoid accepting fraudulent cards in the first place. We just want to thank everyone for their time and attention and we hope that this has been a useful and informative session and we invite you to learn more by pursuing some of the the resources and links that we've shared at the end of the slide deck.

And I just want to thank Meredith and the SBA for inviting us to provide this information to you.

Thank you all today.

And again, Meredith here with sba just wanted to reiterate what we said. I think throughout the presentation, but particularly with emv, that this really is an opportunity for small business owners, as we look at the landscape of new payments and more secure payments technology, to really meet your customers where they are and being able to accept whatever form of payment, whether it's the chip card or contactless payment. So really appreciate the expertise we had on the phone today from the Federal Reserve and thank you again to AT&T for hosting us.