After #Money2020 gala payments event, it has left payment & loyalty industry with so many innovative solutions, initiative, & a peek in future of payments. We got opportunity to get in touch with Philippe Benitez, Vice president of Business Development for Gemalto Secure Transactions North America who provided us with great insight great detailed information about some of our questions.
Since magstrip is on its way to phase out, tell us about EMV migration & experience of Gemalto as a card provider ?
The US is one the last countries to migrate to EMV technology, and since Europe made its transition to EMV -the region has seen an 80% reduction in credit card fraud while the US has witnessed a 47% increase[1]. But the US will experience a liability shift in October 2015 that is helping push the transition to this highly secure form of payment.
While this is new to the US, Gemalto has over 30 years experience in EMV with hundreds of deployments worldwide since EMV is currently used in over 120 countries. But we offer more than just the card, we are a solutions and services provider as well as the enabler of security in card based payments and mobile payments. We also work with banks to provide quick and easy services to their card holders in the case of lost or stolen cards in addition to card design and security features. In terms of the EMV migration for many in the US, it can seem like a daunting task to meet deadlines, consider real-estate on the changing card body, and even education of what this migration means. Having such an expertise in all of these areas Gemalto is uniquely positioned to help and guide all those involved in the upcoming shift to EMV. One question we are hearing a lot as October 2013 marks the two year mark to EMV – what exactly is it?
In its most basic terms, EMV, which signifies Europay, MasterCard and Visa, is a global technology specification for payment adopted by MasterCard, Visa, JCB, Discover Financial Services, and American Express to name a few; that ensures that chip cards work with point-of-sale terminals and ATMs from country to country, to authenticate credit and debit card transactions. Through this joint venture, MasterCard, American Express, Discover JCB and Visa are working to ensure that chip payment cards can continue to be accepted everywhere.
EMV is also based on strong cryptography (both symmetric and asymmetric) and elaborate key management; a fundamental EMV principle is to digitally sign payment data to ensure transaction integrity. As opposed to magnetic stripe technology, a chip is extremely difficult to crack; card authentication and PIN verification are performed automatically and objectively by the chip. An important aspect of EMV is its use of dynamic data. Each transaction carries a unique ‘stamp’ which prevents the transaction data from being fraudulently reused, even if it is stolen from a merchant’s or processor’s database. EMV’s dynamic data feature basically says ‘if you can’t prevent data from being stolen, make the stolen data useless’ because dynamic data is only useful for the sole transaction it characterizes, nothing more.
What kind of cards are you in demand at the moment? Which one do you think would be more successful?
All EMV cards have a magstripe on the back. EMV only cards with no magstripe do not exist.
Issuers are deploying EMV contact cards, EMV contactless cards (also known as dual interface cards since they contain both an antenna and a contact chip) and mobile EMV or otherwise referred to as NFC.
Certain issuers segment their cardholder base and provide high-end dual interface contactless EMV cards to their high spend/traveling customers.
Other issuers decide to deploy contact only EMV cards (which have a magstripe on the back) for all of their cardholders. Banks make these decisions based on the use case scenarios they anticipate, and also, the marketing message they want to convey to consumers as a result of the shift from magnetic stripe to digital payments.
Are Contact cards more secure or contactless? & why?
EMV is infinitely more secure than magnetic stripe. However, all flavors of EMV, whether contact EMV, contactless EMV or mobile EMV, are all equally secure, because they implement the same underlying cryptographic security mechanisms defined in the EMV standards.
As a result, an EMV transaction is processed and authorized in the same way by the payment network regardless of how it was conducted (contact EMV, contactless EMV or mobile EMV).
What kind of challenges Gemalto is facing in terms of compatibility with different POS, countries?
EMV is globally standardized and designed to ensure global acceptance and interoperability. Gemalto is facing no issues in terms of compatibility between the US EMV deployment and other regions.
When do you think US Consumers would be migrated to EMV completely?
The US recently achieved the first major milestone on the road to EMV. Acquirers and acquirer processors upgraded their systems to process contact EMV, contactless EMV and mobile EMV transactions in time for the April 2013 mandate.
The next major milestone is October 2015 — the fraud liability shift — at which point fraud occurring at the point-of-sale will fall on the party with the weakest technology. This liability shift is not a mandate but an incentive for all the stakeholders to upgrade from magnetic stripe to EMV, in all its forms: card and mobile.
Because these milestones are fast approaching, issuers will need to get programs underway in 2014 if they are to meet the deadlines as well as consider important factors like educating users, card deployment timelines..etc.
What is your opinion on best practices way forward for US EMV implementation in terms of:
EMV is designed as a fraud prevention mechanism. Obviously, the chip and pin approach is more secure than a signature, since at the POS clerks cannot be expected to identify the correct signature. Traditionally in the US, debit transactions have required a pin, and credit transactions have used signatures. The decision to continue that trend or implement full chip and pin will fall on each individual issuer based on their use case scenarios, risk tolerance and other factors. Regardless of what each issuer decides, EMV transactions will be infinitely more secure than magnetic stripe ones because the card will generate a dynamic cryptogram for every single transaction (pin or signature) that will prove to the issuer that a authentic card was used.
Do you think mobile payments is solving any problem for the consumers or is it more retailers or innovation driven ?
I think it is two-fold, mobile payments are highly driven by innovation but also the realization that consumers want options and incentives, whether the payment method be cash, check, plastics, or a mobile phone.
I think it is the natural progression of people wanting to use their phone for more, so it might be the consumer that will inevitably or unconsciously be driving the move to mobile payments.
What I mean is, paying through card is no different than payment through your mobile phone ?
From the networks perspective, a mobile EMV transaction is the same as a contact EMV transaction. However, the payment experience will be different, since the card is inserted into the point-of-sale, while the phone is waved at the point-of-sale.
In the case of mobile EMV, the phone allows you to access all your “cards” in your digital wallet and tap your phone to pay.
But even swiping a magstrip card is a different experience than paying with your phone. It isn’t necessarily that one is easier than the other; instead this is an opportunity to give consumers different ways to pay that will ultimately create a payment synergy between the different form factors.
Will consumers adopt mobile payments ?
They already have. More than half of all phones in the United States are smart phones and there are dozens of high-profile mobile payments initiatives underway already. You have probably heard of the anticipated national rollouts of Isis mobile EMV, and MCX, which will offer cloud-based mobile payments. We are the technology enabler for both of these initiatives.
And if you take countries outside of the US, like Brazil- 2013 was a big year for EMV mobile payments or NFC. Three of the biggest banks in Brazil are testing EMV mobile payments, along with contactless options available for transport so consumer adoption for mobile payments in Brazil is well underway. Consumers will increasingly be adopting it as many other initiatives starting in other countries are taking off, like another recent announcement of the Octopus Mobile SIM in Hong Kong.
In Mobile payments what is your opinion about which technology has more precedence NFC based or QR/Barcode Code based
I don’t think either technology has precedence. NFC based payments or as I like to call it “mobile EMV” offers the advantage of global acceptance on any contactless EMV terminal with acceptance all over the world. While QR code based payments have been used in closed loop systems, such as Starbucks and others, so far. It all comes down to acceptance and ease-of-use. Ultimately, consumers will choose the payment method that provides the most convenience from a provider they trust the most so the technology is really a behind the scenes factor.
I recently discussed how EMV, NFC and cloud based payments are bringing new business opportunities to various market players. I think both technologies offer different advantages and it will most likely depend on the business and technology needs of the provider, but again the consumer experience will determine everything.
Since you are a global company where is US in terms of EMV & mobile payments adoption ?
In terms of Gemalto’s worldwide footprint, we have operation sites in some 43 countries and our workforce represents over 106 nationalities. On a global scale for EMV there presently there are almost 1.5 billion EMV cards in circulation, most of which our outside of the US. While the US is beginning its transition to EMV, the US is at a strategic moment that allows them to move to EMV and mobile EMV among other mobile payments in one tsunami of change. As I mentioned, the US recently achieved the first major milestone on the road to EMV. Acquirers and acquirer processors upgraded their systems to process contact EMV, contactless EMV and mobile EMV transactions in time for the April 2013 mandate.
The next major milestone is October 2015 — the fraud liability shift — at which point fraud occurring at the point-of-sale will fall on the party with the weakest technology.
I have discussed what EMV is and the US timeline, but more importantly, why does EMV matter to the U.S. and why now? As of 2012, approximately 1.62 billion EMV cards have been issued globally, and 23.8 million POS devices currently accept EMV cards. Those numbers account for 45 percent of the total payment cards in circulation and 76 percent of the POS devices that have been installed globally, excluding the United States [EMVCo 2012]. Despite those growing numbers, the U.S. is the only member of the G20 that had not committed to EMV [FINEXTRA].
Today, more than ever, the U.S. is in a prime position to commit to EMV due to several trends that have recently changed:
First, physical world fraud – or fraud that occurs in a physical location rather than cyberspace – in the U.S. is suspected to be higher than the global average and is still on the rise. Although there are no precise statistics, the industry relies on surveys and extrapolations to gauge levels and trends of payment fraud [TONY MERSCHEN 2011]. Because fraud tends to migrate toward regions that have not committed to EMV chip technology (i.e. Malaysia to Thailand), failing to integrate EMV technology into our financial transactions will surely make the U.S. a prime target for fraudsters.
The U.S. is also seeing a growing interest in mobile and contactless payment in the last several years, although adoption has been slow. This slow-going process could be sped up by the EMV migration. POS terminals that accept EMV chip cards are dual contact/contactless devices that can accept both forms of payment. By installing these terminals, merchants are readying themselves to accept mobile and contactless payments soon after.
So this adoption of the EMV security standard in both card and mobile payments and the infrastructure available is giving the US a unique opportunity to lead the way in innovative payment methods.
Tell us about Secure transaction & TSM
I have been discussing one of the highest levels of secure transactions, the EMV standard. At Gemalto, we have an entire business unit devoted to working with financial institutions and retailers to enable and secure their customers every day monetary transactions. In terms of mobile you mention the TSM. The TSM, or Trusted Service Manager is a step in the layered security of NFC and works as an intermediary between banks and mobile operators to secure NFC payment applications. TSM suppliers provide the necessary certified security measures for banks and mobile operators to work together. A TSM provider’s value is to securely perform the Life Cycle Management which includes service provisioning, application management and customer care.
Since Gemalto is business of EMV what is your opinion on mobile payments ? Will it pickup ? do you think it is the same as pulling a card ?
Gemalto is in the business of more than just EMV, we are leading the way in digital security in payment, transport, Machine-to-Machine, enterprise…etc. EMV is a subset of digital security that applies to payments. And EMV, as we’ve discussed in previous questions, comes in many flavors including contact EMV, contactless EMV and mobile EMV.
Mobile payments however also comes in many flavors including mobile EMV, mobile cloud wallets and mobile wallets using secure elements in the phone or elsewhere.
Gemalto is providing the fundamental security technology for both the client-side and the back-end infrastructure for many digital payment technologies including those that are card-based and mobile-based. And there is no doubt that payments are becoming increasingly more digitalized, and as a result, consumers will be faced with deciding which payment providers to trust. The payment mechanism that makes it to “top of mobile” or “top of wallet” will be the unique choice of each individual, since each individual will have different motivations and reasons for picking a payment mechanism. Some consumers prefer rewards based payment offers, others prefer prepaid offers, and still others prefer cash and plastic. So it really is impossible to say that any given mechanism will prevail. In our lifetime, cards will continue to coexist with the many flavors of alternative and emerging payments technologies.
EMV cards are more secured vs Mobile Payments ?
EMV is infinitely more secure than magnetic stripe. However, all flavors of EMV, whether contact EMV, contactless EMV or mobile EMV, are all equally secure, because they implement the same underlying cryptographic security mechanisms defined in the EMV standards.
As a result, an EMV transaction is processed and authorized in the same way by the payment network regardless of how it was conducted (contact EMV, contactless EMV or mobile EMV).
Will convergence ever happen for 1 EMV card which has Drivers License ID, Credit Cards, Debit Cards, Loyalty cards for consumers ?
Technologically speaking converging all of those aspects into one EMV secured card is possible but all the various stakeholders would have agree to support it because chip technology does offer many solutions and capabilities as a card based micro-processor. The best way to look at it would be if the US government, banks, retailers, acquirers, operators, networks and the list goes on came together and decided that each and every employee would use the same standard PC for work, a convergence that would require a unprecedented level of collaboration.
What is your feedback about Money 2020 & what would you like to see in #Money2020 2014?
#Money2020 was an impressive event that brought together leaders in fields that have previously been very segmented; banking, technology, MNOs, and startups. With the evolving payment trends it is an event that is creating a new kind of conference and new way of having discussions. I think it will be the type of even that will help bring synergy in the world of payments. With things changing so quickly in this space it is difficult to imagine for 2014, but I think it would be exciting for retailers to give their first hand opinions on the evolving payments industry.