The Long Road to EMV

Brought to you by:

Welcome!

Thank you for joining us.

Mark Smith is Vice President of Kahuna Financial Solutions, a division of Kahuna ATM Solutions. Mark has over 17 years in the ATM industry and currently serves on the ATMIA Cash Council and Security Committee.

David Tente is the U.S. Executive Director of the ATM Industry Association (ATMIA). David has over 30 years of experience in IT sales and business development and 13 years in the payments industry.

Our Presenters:

Why is the U.S. Moving to EMV?

• The ATM Security Arms Race

• EMV was developed by three of the major card networks – Europay, MasterCard and Visa

• The same size and thickness as a standard magnetic-stripe card…only with an embedded microprocessor

• So far, criminals have not been able to clone of create fake EMV cards

• Most of the world has already or is in the process of switching to EMV

Why is the U.S. Moving to EMV?

• Card fraud shifting to markets that still rely on mag stripes cards

• Visa and MasterCard announced their liability shift timetables in 2011o Full MasterCard Shift = October 1, 2016o Full Visa Shift = October 1, 2017

Can the U.S. Meet the Deadlines?

Steps to EMV Migration

1. Agreement on Debit Solution

2. Network Testing & Certification

3. Processor Testing & Certification

4. ATM Testing & Certification

5. Upgrade/Replacement of all ATM fleets

Can the U.S. Meet the Deadlines?

1) Agreement on a Debit Solution – or AID

AID – the numerical code that points to an application on the chip embedded on the card.

• An EMV card and EMV terminal MUST have at least one AID in common

• MasterCard, Visa and Discover each have their own solutiono The Secure Remote Payments Council has adopted

Discover’s solution

• No AID agreement = EMV upgrades at a standstill

• Impact of Federal Court ruling on debit solution development is unclear

Can the U.S. Meet the Deadlines?

2) & 3) Network and Processor Testing and Certification

• U.S. EMV certification will take at least 6 months

• Canada, a much less complex market with only one debit network took as long as two years

4) & 5) ATM Testing and Certification + Software & EMV Installation

• Despite certification in other countries, each ATM manufacturer will have to have their terminals certified on U.S. networks

• Each ATM takes about a month to certify

Comparing the Costs: Fraud vs. EMV

• ATM upgrades are estimated to start at $300/ATM +

• Overall upgrade costs could reach $2,000 to $4,000/ATM

• EMV does not protect against card-not-present transactions

• Recent major breaches have occurred at the processor level…not at the ATM.

Comparing the Costs: Fraud vs. EMV

• EAST and Europal estimate that 80% of fraud on European cards is occurring in the U.S.

• Costs of fraud:o Casho Card re-issueo ATM damageo Loss of confidence in the ATM location

• ATM skimming losses per incident average $50,000o $2.4 billion annually in card losses

• Card skimming represents 80 percent of all attacks against the ATM

Comparing the Costs: Fraud vs. EMV

Other Ways to Mitigate Fraud:

• Moving to PIN-based transactions over signature

• Investing in low-cost anti-skimming devices

• Eliminate the Card – Move to mobileo Secure QR code tokenso Near Field Communications (NFC)

…EMV compliance could set the state for future technologies, including mobile.

Where We Stand Today

• All major vendors offer EMV-capable ATMs and many existing ATMs are capable of being upgraded

• Approved PIN pads are already available due to the mandated Triple DES upgrades.

• Some financial institutions and larger ATM deployers are already ordering new ATMs with EMV card readers.o Some manufacturers are encouraging their customers

to choose the EMV option when buying new machines

Preparing for EMV

• EMV is a short-term projecto Service companies may be reluctant to add staff to

handle the extra field worko Manufacturers will be unlikely to significantly increase

production

• Plan for supply shortages and service delays…plan ahead.

• Anyone that certifies today will have to recertify

• Develop a customer education plan

• Keep Updated on the Answers to these Questions –o When is your processor going to be ready to conduct EMV

transactions?o What is the card scheme going to be?o Will EMV affect network routing choices and, if so, how?o Is an upgrade to Windows 7 necessary?o How can you upgrade machines in a timely manner?o How are you going to educate your customers?

What is ATMIA Doing?

• ATMIA and other industry groups have asked the networks to delay their liability shift deadlines.

• The MasterCard Maestro liability shift has already passedo MasterCard announced a new set of acquirer-based

fraud detection tools that are meant to help with industry fraud by blocking Maestro transactions at approximately 80 percent or more of the nation’s ATMs and monitoring the remaining machines.

• Participation on the EMV Forum – ATM committee

*ATMIA is able to contribute thanks to the donations from IADs to the U.S. Defense Fund. Thank You!

Questions. Comments. Concerns.

We will now take a few moments to address your questions.

Should we run out of time, please email further questions or comments to:

info@kahunaatm.com

Thank you!

About Kahuna ATM Solutions

• Client Base of ISOs & IADs• Focused on the Success of ISOs & IADs• A Community of ISOs and IADs

• Over 20,000 ATMs• Over 60 Million ATM Transactions

Annually

• Dedicated to the Future Success of the ATM Industry