Chip and PIN and Chip and Signature
The EMV standard is the global standard for cards with integrated “computer” chips and the associated chip card authentication technology. While EMV technology is widely used and offers security benefits over magnetic stripe cards, consumers and businesses still need clarification about key components, such as the difference between ‘chip and PIN’ and ‘chip and signature.’
Chip and PIN vs. chip and signature are the ways the cardholder authorizes a purchase. Chip and PIN card transactions, as the name implies, require the cardholder’s personal identification number (PIN) for authorization.
The PIN adds an extra layer of security, verifying that the cardholder is the card owner. The PIN must match the one associated with the card for the transaction to be approved. Chip and PIN cards are used in Europe and other parts of the world where PIN use is widespread.
In the U.S., chip and signature is common for credit cards. The cardholder signs at the time of sale, and the signature is compared with the signature on the back of the card or stored in the card issuer’s system. When the signature matches, the transaction is usually approved. In recent years, the adoption of signature cards has been declining in favor of PIN cards and other authentication methods.
EMV Technology
EMV technology was designed to reduce counterfeit credit card fraud by making it more difficult for criminals to 1) create counterfeit cards and 2) use stolen cards or card data. The EMV chip generates a unique code for each transaction only readable by an EMV-enabled device, making it difficult for fraudsters to use the card’s information for fraudulent transactions.
The level of security EMV provides varies depending on whether the card is used with a PIN or a signature. PIN transactions are considered more secure due to the secret PIN code known only to the cardholder. That’s why PIN protection is critical in the age of shimmer devices, keystroke malware, and the prevalence of video recording. Merchants need to take extra steps to ensure PIN protection, such as:
- Adding a password to your POS terminal
- Keeping an eye on your credit card readers and terminals
- Including a hood or screen over a terminal keypad
- Using a security tag to remote terminal access points
- Adding PIN protection notices to terminal screens
On the other hand, signatures can be forged or bypassed on touchscreens with a simple scribble.
Today, credit cards typically have a chip and signature in the United States, and most debit cards have a chip and PIN.
In the face of growing fraud challenges, credit card companies are evaluating other secure forms of authentication, such as chip and biometric cards.
What are the Costs of Accepting EMV Chip Cards?
As of June 2024, there is no difference in cost to accept chip cards over magnetic stripe (magstripe) cards. For example, the transaction cost is the same if your customer uses an EMV rewards card versus a Magstripe rewards card. Factors like the card type and where it is used are critical factors in the transaction cost. For example, a platinum business EMV card used for online purchases will have a higher transaction cost since business cards and online transactions have higher fraud risks.
However, for you as the merchant, there can be differences in the transaction costs you pay. If your customer uses a chip and PIN debit card, the interchange fees may be lower than if they used a chip and signature card. It is worth noting that debit cards processed on a card brand network can be more expensive than if the same card was processed on a PIN debit network.
Can I Run an EMV Debit Card “as credit”?
While there’s no difference in processing cost between chip cards and magstripe cards, there can still be some differences in costs. This is true when accepting debit cards.
Debit chip cards often have the option to skip PIN and run the card “as credit” instead. The cardholder can then sign for the transaction.
When debit cards are run “as credit,” the transaction will be routed through the card brand’s network and charged the debit interchange rates, not the often lower fees charged by PIN debit networks ( Star, NYCE, etc.).
When deciding how to accept cards and what equipment to purchase, we recommend that your equipment include a PIN pad for debit transactions.
What’s the Difference Between EMV and NFC Technologies?
EMV Chip with NFC Symbol
NFC enables contactless, tap-to-pay functionality by wirelessly transmitting payment data between devices in very close proximity.
EMV generates a unique code for each transaction that is only readable by an EMV-enabled device during the transaction to protect data during transmission over card networks.
NFC payments leverage both technologies – NFC for the contactless interface and EMV for data security.
So, while not all EMV transactions use NFC, all NFC-based payments rely on the underlying EMV standard for secure data transmission and processing.
Do I Need a Special Equipment for EMV Chips?
Yes. You will need a new terminal if you have older card readers that only accept magstripe cards. Most credit card machines or terminals available today can swipe, dip (insert chip cards), or tap (contactless) payment cards. Finding a card terminal that doesn’t support EMV chip cards is almost impossible, so it would be difficult to make a mistake.
How Does EMV Affect Card-Not-Present (CNP) Transactions?
EMV technology was designed to secure card-present transactions, where the card is available at the point of sale.
Here are some ways EMV technology has impacted CNP transactions:
- Liability shift: With EMV, liability for fraudulent card-present transactions shifted from the issuer to the merchant if they don’t support chip technology. However, this liability shift does not apply to CNP transactions.
- Rise of tokenization: To mitigate CNP fraud risk, tokenization (replacing card numbers with tokens) has become more prevalent for CNP transactions. Merchants and processors exchange meaningless tokens instead of real card data, reducing breach risks.
- Dynamic authentication: Some issuers offer dynamic authentication like one-time passwords or biometrics for CNP transactions, adding an extra layer of security by requiring unique credentials for each transaction.
- Fraud migration: As EMV made card-present fraud more difficult, fraudsters shifted focus to the more vulnerable CNP channel, increasing CNP fraud rates in countries that adopted EMV early.
Are There Any Known Problems Accepting EMV Chip Cards?
At one time, EMV transactions were slower to process, but not anymore. However, some merchants still encounter occasional hiccups. Common issues reported include:
- Terminals Not Requiring PINs
- In certain instances, terminals fail to prompt for a PIN entry when an EMV debit card is inserted, despite this being a key security feature of the technology.
- Lack of Cashback for Debit
- Some terminals do not allow customers to get cash back when making a debit card purchase, limiting a convenient feature many consumers are accustomed to.
- Unable to Skip PIN Entry
- The reverse problem also occurs – terminals get stuck requiring PIN entry even for credit card transactions where a signature should be allowed instead.
EMV Chip Cards and Card Cloning
Card cloning occurs when fraudsters extract the data stored on the chip and transfer it onto a counterfeit card with a magnetic stripe. The cloned card allows them to make fraudulent transactions at merchants that have not fully implemented EMV technology but still accept magnetic stripe cards.
The process typically involves:
Using a “shimmer” device installed on a card reader to illegally capture the EMV chip data when a legitimate card is inserted.
Transferring the stolen EMV data, including the iCVV (integrated circuit card verification value), onto the magnetic stripe of a counterfeit card.
Using the cloned magnetic stripe card at merchants that do not verify if the iCVV on the chip matches the CVV (card verification value) on the magnetic stripe.
While EMV chips cannot be cloned, this bypass technique exploits the fact that many cards still have magnetic stripes as a fallback, and some issuers fail to validate the chip data properly. Stronger verification standards that check for mismatched chip and magnetic stripe data can help mitigate this fraud.
IntelliPay Can Help
At IntelliPay, our robust payment security goes above and beyond security standards. We make omnichannel payment acceptance easy to use and manage. To learn more about our payment processing solution and fee-based options that reduce overall processing costs, contact sales at 855-872-6632, option 3, or click here to connect with a consultant.
