Starting Oct. 1, retailers lacking EMV compliance can be liable for fraudulent in-store purchases.
If your customers routinely use credit cards to pay you, you are likely already familiar with a new type of credit card with a tiny microprocessing chip built inside. These cards — known as “EMV cards,” “chip cards” or “chip-and-PIN” — are designed to reduce fraudulent in-person credit card transactions, also called “card present” transactions.
While relatively new in the United States, EMV cards have been widely adopted over the past three years in Europe, Canada, Latin America and the Caribbean. Now, Visa, MasterCard, American Express and Discover are taking a major step to require their use in the United States as well.
EMV cards are effective at reducing in-person credit card fraud because they contain an individualized microprocessing chip embedded in each credit card. The chip makes the card essentially impossible to counterfeit or “clone,” unlike with traditional magnetic stripe credit cards. Similarly, unlike with a magnetic stripe card, it is not possible to use stolen credit card data to create a counterfeit EMV credit card. This means that the only way criminals can use an EMV card for a fraudulent in-person transaction is if they have stolen the physical credit card from its owner.
To ensure compliance with the move to EMV card acceptance, all four major credit card companies have issued payment card rules for retail businesses accepting credit card payments. These rules specify that starting Oct. 1, 2015, if a business accepts credit card payments for in-store retail purchases and is not EMV-compliant, it is liable for any “card present” fraudulent transaction that occurs at that store that would not have occurred if the store had the technology to accept EMV cards. In other words, stores must purchase point-of-sale (POS) devices that are EMV-enabled or they will be liable for any fraudulent in-person transactions happening at their locations (other than those based upon use of a lost or stolen card). Exceptions do exist for ATMs and for automated gasoline dispensers, however, which do not have to be EMV-compliant until October 2017.