October 1 is right around the corner. Hotels and restaurants: are you ready for what’s in your customers’ wallets?
As payment card transactions have supplanted cash and check-made purchases, point-of-sale (POS) devices have become a necessity for many businesses, particularly those in the hospitality industry: from the biggest hotels to smallest cafés and bistros. But starting next month, the payment card industry’s transition to chip-and-PIN payment cards will take effect. Chip-and-PIN (also known as EMV) technology enhances the security of POS transactions by using microprocessor chips embedded in payment cards, which encrypt sensitive data and authenticate payment cards during each transaction.
As part of this transition, merchants, retailers, and all other businesses that accept payment cards for in-store transactions are expected to be EMV-compliant – including replacing their old magnetic stripe-only POS devices with EMV-enabled terminals that are capable of authenticating the payment card with its integrated chip – by October 1. Businesses that are not certified as EMV-compliant by the October 1 deadline face a shift in liability and may be required to bear the costs for all card-present counterfeit fraud losses – that is, fraudulent in-store purchases associated with counterfeit payment cards with a another cardholder’s data – in their stores.
Though the payment card industry has been preparing for the shift since 2011, two recent reports indicate a significant percentage of affected businesses may miss the October 1 deadline. If your business accepts payment cards, now is the time to confirm whether your payment system will be EMV-compliant by October 1.
But according to a July report from Randstad Technologies, 42% of businesses surveyed had either not taken any measures to transition to EMV, or were unaware of any steps that they may have taken. Survey respondents indicated that a lack of time and technological expertise represented the greatest obstacles towards meeting the EMV transition deadline. Similarly, a March report from the Congressional Research Service that was updated in September listed the high cost of replacing old POS devices – between $100 to $600 per machine – was another significant factor hampering the transition.
Fortunately for businesses, the liability shift applies only to card-present counterfeit fraud and not to payments made online or to lost or stolen payment card information. Additionally, ATMs and automated fuel dispensers (i.e. pay-at-the-pump devices) are exempted from the current liability shift, as the major payment card providers have scheduled EMV liability shifts for those devices to take place over the next one-to-two years. Yet the October 1 liability shift represents a potentially significant financial burden for those businesses that depend on in-store payment transactions but who have not upgraded to EMV-compliant POS systems.
Businesses that are unsure whether they will meet the October 1 EMV transition deadline should talk with counsel knowledgeable in payment card industry compliance about how to comply with the new EMV standards and mitigate the potential liabilities associated with this shift.