Chip technology greatly reduces a criminal’s ability to use stolen payment card data by introducing dynamic authentication values for each transaction.  Even if payment card data is compromised, a counterfeit card would be unusable at the point of sale without the presence of the card’s dynamic data elements. 

By reducing static authentication, stolen cardholder data becomes much less valuable to criminals.  This should come as welcome news for the hospitality industry, an industry commonly targeted by hackers in recent years.  By adopting chip technology, hotel operators can help prevent counterfeit fraud and begin to reduce the static payment card data passing through hotel systems. 

The news gets even better.  Effective Oct. 1, 2012, merchants with at least 75 percent of their Visa transactions originating from terminals that support both contact and contactless chip acceptance will no longer be required to validate their compliance with the PCI Data Security Standards, as part of the U.S. expansion of Visa’s Technology Innovation Program (TIP).

Not only will dual-interface chip technology support dynamic authentication and global interoperability, it will help future-proof a hotel operation’s investment and prepare it for the arrival of NFC-based (near-field communication) mobile payments.  This is because mobile NFC uses the same EMV chip technology and acceptance infrastructure as chip cards. This can open up new opportunities for hotels to provide expanded mobile services for their customers.

As part of the U.S. chip roadmap, Visa will continue to support a range of cardholder verification methods with the EMV chip, including signature, online PIN and no signature for low-value, low-risk transactions.

To assist in the adoption of chip payment technologies in the United States including contactless and mobile payments, Visa has developed implementation recommendations for merchants (as well as for financial institutions, processors and payment industry vendors). Here is guidance to help operators make informed decisions as they evaluate competitive vendor options:

1 Deploy chip-enabled, dual-interface terminals that support contact chip, Visa payWave and magnetic stripe interfaces.
Hospitality industry operators that deploy dual-interface terminals are preparing their point-of-sale (POS) environments for mobile payments and other emerging payment technologies.  To qualify for participation in the TIP, at least 75 percent of the merchant’s Visa transactions must originate from chip-enabled, dual-interface terminals.  Additionally, using these terminals provides protection under the counterfeit fraud liability shift, which will become effective in the United States in October 2015.

2 Deploy the latest version of the Visa Contactless Payment Specification (VCPS); enable quick VSDC (qVSDC) and magnetic stripe data (MSD) features.
To minimize problems related to interoperability and prolong the longevity of the terminal and the contactless reader base, merchants should ensure that their contactless readers support the most current version of the specification and are approved by both EMVCo and Visa.  To qualify for participation in the TIP, merchants must deploy VCPS, Version 2.1.1 (the latest version as of this writing), or a subsequent version. VCPS Version 2.1.1 supports functionality specific to mobile proximity payments.

3 Prioritize deployment of chip-enabled, dual-interface terminals by using a targeted approach.
Prioritizing the deployment of chip-enabled devices helps minimize potential declines and protects against counterfeit fraud.  For example, larger hotel operations with multiple locations might first deploy in locations with high international acceptance, high overall volume or high counterfeit fraud concentrations. Prioritized deployment may expedite a merchant’s eligibility for the TIP and may help provide protection under the 2015 counterfeit fraud liability shift.

4 Configure EMV chip terminals to support online options only.
EMV chip terminals can support a variety of offline functionality (e.g., offline data authentication, offline cardholder verification and offline transaction authorization). However, because the United States has a zero floor limit, there is no practical need to support these offline functionalities, which can introduce unnecessary complexity into configuring and maintaining a terminal.  Also, supporting only online authorization can simplify ongoing EMV compliance. If an online connection fails or is unavailable, the merchant can create a batch file for transactions that took place while the connection was offline and submit them later for online authorization.

5 Implement a POS environment that supports online PIN verification. (This recommendation applies to merchants that choose to support PIN in addition to other cardholder verification methods.)
Merchants that support PIN in addition to other cardholder verification methods (such as signature, for example) should support online PIN only.  There is no need to support offline PIN verification in the United States.  Acquirers and merchants deploying new terminals that support online PIN should ensure that the PIN entry devices are Payment Card Industry PIN Transaction Security (PCI-PTS) compliant.  Note: EMV chip cards from outside the United States that support offline PIN can also support signature at the POS and online PIN at the ATM.

Tia D. Ilori is a compliance program manager for Visa Inc. More information on implementation is available at www.Visa.com/cisp.  

©2012 Hospitality Upgrade
This work may not be reprinted, redistributed or repurposed without written consent.
For permission requests, call 678.802.5302 or email info@hospitalityupgrade.com.