What Small Businesses Need to Know about Liability for Counterfeit Fraud on Chip Card Accounts

Hello everybody and thank you for joining us today.

My name is Tony and I will.

Be moderating today's webinar and I would like to begin today's webinar and turn the conference over to Bridget from SCORE for opening remarks.

Thank you so much Tony. I am thrilled to be here and happy National Small Business Week everyone. Thanks for joining. You are in for a great treat. Today's webinar with VISA presenting. I just wanted to take a moment one to thank you for all that you do for our economy as small business owners really are the engine that keeps us running and we want to help you achieve your success. So let me take a minute to just tell you about score. We are here for the life of your business and we provide free mentoring, training and resources for entrepreneurs and small business owners. So what is score? What does this for the Life of youf Business mean? We see ourselves as America's small Business Resource. We have volunteers who have the been there, done that expertise to provide you with advice, guidance and resources to help you achieve your goals. And you heard me correctly, it's all free. You can meet with a score volunteer mentor one time or 1,000 times and it's always free whether it's in person or online. We also provide workshops, seminars and events in your community as well as events online like the one you're at now. If you go to business to search for business tools and templates@www.score.org you can see thousands of resources that will help meet your needs. SCORE has been around for over 50 years and in that time our volunteers have helped more than 10 million small business owners and entrepreneurs. We've seen people like Jelly Belly and Vera Bradley and helped them achieve their goals and this year alone We've helped over 350 staff small business owners. We are a nonprofit resource partner of the United States Small Business Administration and like the SBDCs and Women Business Centers, we are here to help small business. Score, as I said, is made up of volunteers across the country who provide the free mentoring and advising to meet your needs. We have over 300 chapters and more than 1000 locations across the country. So to find the one nearest you go to www.score.org and search your city and state or zip code so that you can meet with a mentor today. So how do we help? What is this experience advice that we provide? It's everything from the person that has an idea but isn't sure how to get started. So we can help with sound business planning. We can help review your funding opportunities and alternatives. We can look at marketing and promotional recommendations and much much more for vendor relations to hr, customer care and loyalty programs. So this is what we do. We want to help you. We provide that face to face mentoring in each of our chapter locations, educational sessions on a myriad of topics. You can also get together and network with peer to peer roundtable discussions about the critical business topics that you're facing today and supplement that with online resources to help guide the decision making process. Use them along with your mentor to help answer questions and figure out what the best path forward for you is. So get started today. Go to score.org to start or grow your business or even become a SCORE volunteer. We are sure many of you have great advice that other entrepreneurs could benefit from as well and stay connected with us. You can go to score.org connect to receive our newsletters or even text SCORE mentors to 22828 to start getting those free business tools and connect with a mentor today. With that. I know again that you are in for a great treat with today's webinar and I thank you for your time. Tony.

All right Bridget, thank you very much for those intro remarks. And with that guys, we are actually going to turn it over to our friends from Visa and Janet and Brian, please go ahead.

Hello, this is Janice Sablack from Visa and on behalf of Visa, I'd like to thank you for joining us today. We're proud to be part of National Small Business Week and to have this opportunity to talk with you today. First, let me thank you all for your hard work on a daily basis in driving the US Economy and supporting your local communities. You are the true heroes of every day. I liken you to the Olympic athletes that we sponsor here at Visa. No matter what obstacles come into your way, you get up and do it again every day and you persevere. So you are the true Olympic athlete in my mind. At Visa, we believe our success depends on the strength of our relationships with all parties in the payment system, especially with businesses. And we've all become too familiar with the headlines that we've seen where another merchant has suffered a data breach. Merchants have become a target of global cyber hackers and any Internet connected system, such as a point of sale system that you may have at your business can come under attack from anywhere in the world. And this has become a sad reality. But there are solutions to help take you out of harm's way by making the payment data that flows through your systems of no use to the criminal who want to commit fraud. One of these solutions is chip technology, which, when fully adopted, will help prevent counterfeit fraud. In addition to chip, we're also working to promote new technologies such as tokenization, which replaces the traditional 16 digit account number with a unique series of numbers that authorize payment without exposing sensitive card account information. It's Visa's token technology that helps protect Apple Pay, which you've probably heard of. And by the way, mobile payments such as Apple Pay also use the same chip technology that we're bringing to cards. So in order to help you protect your business and deliver seamlessly to your customers today, we're really going to provide you some insights and information about preparing your business for the upcoming changes in technology specific to chip. And with that, I'm going to turn it over to Brian Hamilton and he's going to take you through some information and insights about some upcoming changes around chip technology. Brian?

Thank you, Janet. And thank you business owners who have taken the time out of your day to learn about this important enhancement to the payment system. There's been an increased awareness about payment security over the past few years, not just by the media, but by all stakeholders. This includes merchants, card issuers, cardholders, and the payment networks. And security is fundamental to payments. Visa utilizes a layered approach to address security. And one of these layers, as Janet said, is EMV chip card technology, which helps to make stolen information useless to criminals. So what is a chip card and why does it matter to your business? EMV chip cards have been used in other parts of the world for almost 20 years. The US is the last of the G20 countries to move to chip technology. And this is due in part to the fact that the US is the largest and most complex payment environment in the world. So what is a chip card? You may have already received one from one of your card issuers, and they can be identified by the small metallic square on the left side of the card. This square is actually a microchip that's been embedded into the card, be it a credit card, a debit card, or a prepaid card. This microchip can be used to generate a dynamic code called a cryptogram that can be validated by the issuer when they receive it. The fact that this cryptogram is dynamic and changes with each transaction prevents the data from being reused in counterfeit cards. The example here we have is a contact card. And as Janet said, the same chip technology can also be used on cards that support near field communication known as NFC transactions like Visa, PayWave. In fact, this contactless chip technology also can be supported by mobile payments such as as Apple Pay. In all cases, it's this generation of this unique cryptogram which prevents counterfeit transactions. So what is a cryptogram and how does it work? The illustrations here are meant to show to represent the card information that's contained in a typical credit card authorization. You can see in the top one, done at a retailer with a magnetic stripe, is the transaction will contain the account number, the cardholder's name, the expiration date, the service code and some other static values. This static data, if it's compromised by a criminal, can be replicated on cards over and over again. And transactions, counterfeit transactions could be made until the issuer or the cardholder realizes that there has been a fraud breach on their card. The second transaction, the middle one, shows the data that's typically included in a chip transaction. Much of this information is the same. The account number, the name, the expiration date. But you'll notice on the right side in orange, there's the cryptogram. This value is created when the card is used, sent to the issuer who validates that cryptogram to make sure it's the one that they expect. And if it's not the one that they expect, the transaction would be declined. So in this middle transaction we see somebody buying something at a clothing retailer and we have the cryptogram that starts with 583. When the card is used again in the bottom transaction at the movie theater, notice everything has stayed the same except the cryptogram that now begins with 732. Every time that the card is used, a new cryptogram is generated that is then validated by the issuer. And it's this dynamic aspect of the data which prevents the card from being counterfeited. So a bit about the roadmap to US EMV chip. In the US Visa was the first payment network to announce its roadmap back in August of 2011. Our first milestone was in April of 13 when we mandated that our acquirer processors have their platforms be tested and certified as to their ability to support EMV chip transactions. In other words, to prepare the infrastructure. We also announced back in 2011 the dates of our liability shift of October of 2015 for most point of sale transactions and October of 2017 for what we call AFD or automated fuel dispensers. But known to most people that pay at the pump. Because of the complexity of that environment, we gave an extra two years for those merchants. And also ATMs have the liability shift date out in 2017. So we have found that liability shift is a tool that we've used globally. It allows merchants and acquirers to determine when they will invest in chip based on their business needs, not on a mandate. So what is liability shift? Simply put, liability shift recognizes the party who has or has not made the investment to improve payment security. So let me walk through this chart. The top line shows today where we have cards that have a mag stripe only have a mag stripe on them and terminals that can only process a magstripe transaction. It's this way today and it's been this way for the past few decades. If there is a counterfeit, if there's a fraudulent transaction today, the liability for that transaction remains with the issuer. So if the customer says they did not do it and the merchant has electronically authorized the card, the card is present, followed all the rules. If it's a fraudulent transaction, the liability for that transaction stays with the issuer. Now with liability shift beginning October 1st, that changes. And this applies to counterfeit fraud. And again, we talked about it recognizes who made the investment in improving the security. In the first blue example we see where nobody has made the investment. The issuer is just still sending out magstripe only cards and the merchant has just a magstripe only terminal. The liability for counterfeit in that case will remain with the issuer. Now let's say that the merchant has made the investment and has put a chip reading terminal has activated it, but the issuer continues just to send out mag stripe only cards. In that case, the merchant has made the investment, the issuer has not. So the liability stays with the issuer. And the example in orange shows what happens when the issuer has made the investment and the merchant or acquirer has not. So in this case we have cards have been issued and presented that have a chip on them, but the terminal cannot take a chip transaction, so it needs to fall back to magstripe. In that case, for counterfeit transactions, the liability would shift from the issuer to to the acquirer for those transactions. The bottom case recognizes when both sides have made the investment in improving the infrastructure. It's an EMV chip card that's been issued. It's a POS terminal that is activated and can take a chip card and does take a chip card. If there is any counterfeit liability, it would be the responsibility of the issuer. But since this is a chip on chip transaction, a chip card used at a chip terminal, that cryptogram really prevents counterfeit transactions from happening. So a couple of points to point out. One, Visa's liability shift is only for counterfeit fraud. The lost and stolen fraudulent transactions with chip will continue to be the responsibility of the issuer. And secondly, that this only applies to contact chip transactions. Contactless chip transactions, if there's fraud on them would also be the responsibility of the issuer. So where will issuers and merchants be on making this investment come October? This chart shows a series. It shows forecasts from a variety of different consultant studies and other studies showing where we will be over the next few months in EMV chip implementation. As you can see credit cards by the end of the year, the estimates are currently about 70% of the credit cards and about 41% of the debit cards will be chip capable. That is they will have a chip on the card on the acceptance side, activated terminals, terminals that not only just have the slot in them to be able to take the chip card, but the software is actually in place to enable a chip transaction. Current estimates are a little bit under 50%. This has been kind of a moving needle and there's a variety of estimates but most are in the 40 to 50%. This will lead to chip on chip transactions. Our current modeling shows somewhere around 29% of all transactions will be chip on chip. That is a chip card used at a chip active terminal. Now a lot of there's a perception out there that come liability shift date we should be at 100% and in our implementations around the world we've never been at 100%. Some examples are Canada on their liability shift date were about 45%. Chip on chip Brazil was about 30%, Australia was about 60%. So this will continue to grow as time goes on. But I just want to make it clear that one, it's not a mandate, it's liability shift is what goes into effect on October 1 of 20. So we have chip resources to be able to support you as small businesses. I recommend that you go to www.visachip.com. it's a micro site that we have established that really serves as the hub of all of our information available to to various stakeholders. So we have things such as videos explaining what a chip card is, how it works. One that I would suggest to you as small businesses is there's a video called EMV Chip Technology Business Case in which Julie Conroy from Itay Group, a consulting firm, explains why implementing chip card technology protects payments from and prevents counterfeit fraud from the business perspective. There are also infographics in which we try to use illustrations to explain what are sometimes complex topics, things like liability shift. There are an extensive list of frequently asked questions across all of the stakeholders, be it the issuers, the merchants, the acquirers or even the card holders. To drill down one click more I would like to point out our business toolkit and it's available at visachip.combusinesstoolkit and it contains several things that should be of interest to you as a small business. It has our 10 step implementation guide to help you implement chip acceptance at your business. It has downloadable materials, whether it's the infographics or the frequently asked questions. They can be downloaded to print out to share with employees. And new to the Business toolkit is our simple training module. For employees that operate the point of sale, training is paramount to chip acceptance. The goal is to prevent any sort of disruption at the point of sale. So when a customer has received his new chip card and he comes into a merchant that accepts chip cards, the first time or two is what we call the moment of truth. It's going to be different, right? The transaction works slightly different. For a chip card, for example, the card must be inserted rather than swiped. If the sales associate notes that there's a chip on the card, they see that little square on the left hand side, they can just insert it. If the sales associate doesn't notice it and they swipe it, there's a code on the mag stripe that will say you need to insert this card. It has a chip on it. So that's one difference you're going to be inserting rather than swiping. The second difference is that the card must stay in in the terminal until the authorization is complete. So today you may swipe the card and it may be handed back to the customer. While the terminal is authorizing the transaction with a chip card, it just needs to stay in until that transaction is authorized and then once complete, handed back to the cardholder. Once a card holder or sales associate does this one, two or three times, they start to recognize the differences and the differences become the new standard when it's a chip accepting merchant. So what are the next steps? First off is if you're interested in enabling chip acceptance at your businesses. First off, I would suggest visit visachip.com businesstoolkit to learn more about chip acceptance. Secondly, meet or call with your acquirer or card processor to discuss what needs to be done to enable chip acceptance at your business. And thirdly, train your employees that are manning the point of sale terminals. Again with the objective to minimize disruption at the point of sale. So with that, that's the end of the formal presentation and I think that we are ready to take any of the questions that have come in or continue to come in.

So we had a question that came in and said, is EMV chip the same as in Europe? They had heard the questioner said they heard it wasn't the same technology.

So the basic technology is the same. EMV actually stands for Europay, MasterCard and Visa and was a set of standards that were created a little bit over 20 years ago globally. And it's the way that technologies, that chip technology works globally. The differences, and there are differences between the way countries have implemented chip. So the cards will work. If you had a chip card issued in the US and you went to Europe or Mexico or Malaysia, the transaction would definitely work and vice versa as European cardholders or other non U.S. cardholders come to the U.S. the difference is that the issuers and the merchants in those countries have sometimes gone with what we call a cvm, a cardholder verification method. And it's what here in the US generally tends to be signature as the cardholder verification method. Just like it is today on magstripe or it is in some cases, no cvm. This is when small low balance transactions don't require a signature. You can just basically insert your card and go in Europe, in Canada, they've also opted as a CVM as pin. Right? So transactions made on a card issued in the United Kingdom, made in the United Kingdom would prompt for pin. And a lot of times we hear the term chip and pin. There's a perception that that's how the rest of the world does it. And it's not. When we look at countries like Mexico, we look at countries like Malaysia, many countries in Asia Pacific, they've gone with chip and signature. They basically mimicked the existing environment. We see other countries, as I said, like Visa, like Europe and Canada have gone with chip and pin. And we have other countries like Australia that started with chip and signature but then evolved to chip and pin. So our liability shift, we did it just for counterfeit, to minimize the impact on merchants in implementing chip acceptance because the vast majority of merchants don't have PIN pads. So we did our liability shift to make it simple to do chip and signature, which mimics the existing infrastructure. That may change over time, but you're protected as a merchant with chip and signature.

Thanks, Brian. A couple of common questions that are coming in is Will Square, PayPal here and the likes of those kinds of solutions be able to support chip technology or how do they go about ensuring their devices are chip enabled?

So first off, I would check with your provider to see what they support. I can say or do know from a public announcement that Square made, I believe it was last November that they began presale on readers that accepted chip cards. So we've been engaging with all of the technology providers in this space, the terminal providers, and in fact most terminals that are most, if not all terminals that are deployed today, the hardware is capable of doing chip. It just the software has not activated. So I would check. I think the first step would be check with your providers to find out what their capabilities are.

And then another common question that's coming through is how does this impact online purchases? Or are there any additional protections for online purchases?

That's a very good question. In Janet's opening remarks, she talked about the tools that are available for online transactions. So chip is to address card present transactions, where the card is present at the merchant, and to specifically address counterfeit at card present merchants. Currently at card present merchants counterfeit volume represents about 66% of our fraud and is growing at about 15% year over year. When we look at lost stolen fraud, it's about 15% and growing at a minus 5% per year for card not present transactions. To protect those, we have services such as tokenization, encryption and verified by Visa as ways to protect card not present transactions.

And Brian, can you talk about what the difference is between a stolen and a counterfeit card?

Sure. I would hazard a guess if I could see you and I would ask how many of you have had your card replaced in the last two or three years because of a data breach at a retailer, I'm guessing at least 2/3 of you would raise your hand. That's what a counterfeit transaction is, where data that has been gleaned from a magnetic stripe is used to create other cards lost and stolen. Fraud is basically what happens when your wallet or purse is stolen and used by a crook. It's very difficult to scale and I bet if I ask you to raise your hands, maybe 5% of you at most in the last three years have had a card actually stolen. So issuers, when they talk to cardholders that have had fraud on their account, one of the questions that they ask is, is the card still in your possession? So if you still have the card in your possession and that card is being used somewhere else in the United States or around the world, your card has been counterfeited, the card's not in your possession, and generally Speaking is used in your general locale, chances are that your card has been lost or stolen. And we have issuers categorize their fraud. It helps our detection systems and has other implications. So we have an accurate categorization of fraud.

Thank you. I think that's pretty much covers the questions that have been submitted. So I guess I'll ask if there's any additional questions. Please submit.

Again while we're waiting. Again while we were waiting. That visachip.com website is a very good place to start to get smarter about it. I will also say that this is something that the industry is doing together. There are groups called the EMV Migration form and the Payment Security Task Force that are cross industry groups, including not just payment networks, but merchants, issuers and acquirers. And we're all working together to raise the state of security in the payment system in the United States and globally.

And the other thing I'll mention is we're trying to go out locally in partnership with the Chamber of Commerce and going out in person with folks and bringing terminal providers with us so that we can be on the ground to talk to some of the small businesses that are out there and we'll post those as well. The website again is www.visachip.com and there is a section dedicated to business where you can also get stickers for your business once you have a terminal and things like that.

Any last questions?

Please clarify. The Card not Present transactions so a.

Card not present transaction is a transaction that's made usually over the telephone or via E Commerce where you as the business are just taking the account number and maybe some other data like the cardholder's address, maybe you're supporting verified by Visa, but the card is not. You as the merchant are not seeing the card. Card present transactions are the ones that are made at your location either with a swipe or for a magstripe card or an insert for a chip card. It's, it's where the card is actually present at the point of sale that the transaction is made.

And today there's no changes imminent for card not present transactions.

That's correct. Emvchip is about card present transactions.

And there is a question about are there additional costs that the small business will be impacted by? And I'll be happy to answer that. The pricing is actually between you and your acquirer processor. So that's another reason to go and make sure that you're having a discussion with them and talking about that specifically. And I think there's a question about the Chambers So what we'll do is we will post on visachip.com the locations of where we're going to be and there was a question for a specific location. So we'll figure out how to get to you after the call. And one last question was we mentioned that we knew Square was publicly already announced that they are capable of EMV. We are not sure if PayPal on their timing, but you should definitely reach out to them. I have not seen a public announcement yet, so you should probably contact them directly. But many technology providers are preparing and I would just check in with them on their timetable for implementation. There's one last question which is very common so I'm going to why are we so far behind with this technology?

I wouldn't say that we're behind. We're definitely trailing the rest of the world, but it's for very valid reasons. Chip in the Rest of the World was basically designed to address a telecom telecommunications infrastructure that was not as good as the US So it was designed to be able to have credit card trans or card transactions that didn't require authorization every time because authorization in other parts of the world was very expensive. In the US we've had what we call a zero floor limit, meaning 100% of the cards are authorized. So when you swipe or insert that card, 100% of the time it goes to the issuer. So the issuer sees the transaction and can approve it. So that was the initial driver and Chip in other parts of the world was to address the fact that the telecommunications infrastructure was not at the same level as the US as the ability to generate a cryptogram started to be in place, the fraud moved and it came to the point of least resistance, which in this case was the US as the location, the region that had was not accepting chip cards for the cryptogram. You didn't need a cryptogram, you could just do it with the magstripe. That overall rate. Our fraud has remained flat, but we're seeing this increase in counterfeit, we're seeing increases in data breaches at merchants. And back in 2011, after much discussion and analysis was when we decided that we needed to implement chip in the U.S. i'll also say that the U.S. is by far and away the most complex payment environment there is. We have I think somewhere around 13 to 15,000 card issuers. We have millions and millions of merchants and a wide variety of point of sale infrastructures. That's just much more complex than the rest of the world. So for all of those reasons. Our announcement was made in 2011 and we gave over four years of Runway until we got to liability shift.

Thank you, Brian. I think that's all the questions we have other than one logistical question, and I'm actually not sure of the answer is will this webcast be posted? And I'm under the assumption that the SBA will post them.

Yeah, I think the presentation should be posted somewhere for you all after the webinar wraps up. So I think that wraps it up for the VISA presentation. Tony, do you want to take it away?

Yeah.

Thank you, Brian and Janet. And we are getting a lot of thank yous and that this was some great information. So we do really appreciate all of the information you were able to give. We also wanted to thank Bridget from SCORE for her opening remarks and for SCORE helping us set everything up. And we did want to thank all of our folks for joining us today. This does conclude our webinar at this point, and you may now disconnect.