Skip to main content

EMV During a Pandemic

Contactless payment being made

 

In response to the COVID-19 pandemic, merchants are exploring options to provide a safer shopping experience for their customers. The in-store payment experience presents a unique challenge due to physical interactions with terminals and PIN pads during transactions. While the “new normal” may include increased cleaning and disinfecting protocols for high touch surfaces, it also presents an opportunity for rethinking the ways in which we make payments, including the greater adoption of contactless and mobile payment options.

With businesses already facing a host of challenges, any merchants who are not considering the utility of contactless payments in this new environment, and instead rely solely on  legacy contact payment methods such as magnetic stripe and contact EMV, should assess the impact customer preferences for a ‘touchless’ experience has on their business. Customers may be hesitant to pay by entering a PIN or signing with a stylus at the PIN pad when buying essential items from a grocery store or when purchasing gas at a fuel pump station.

There is the opportunity, then, for merchants and their partners to consider how to best facilitiate customer requirements through a move to contactless and mobile payment options.  However,any such change in equipment or payment processing practices would still need to be certified to relevant requirements, such as those that govern the acceptance of contactless payments. Such a certification process with acquirers and card brands might take months to complete, and need to utilize resources before the contactless payment options can be rolled out to the merchant stores.

How to best manage this conundrum?

Our contactless payment experts have recommendations to employ during the COVID-19 pandemic for retailers who must use a mode of payment that requires the customer to insert or swipe their card.  The guidelines presented in this post are designed for the US market, but with UL’s global payment expertise and footprint you can be sure that we can assist with any geographic specific implementations that may be of interest beyond these.

These features can be enabled and disabled without the need to recertify against the acquirer and card brands as well disabling Debit Application Identifiers (AIDs) and can be deployed by simply performing a regression against selected test cases.  The list below is not exhaustive, and several of the options are designed to work together in tandem to achieve the overall goal of reduced physical contact during in-store payments.

Automatic debit selection

Issue:

The ‘auto debit’ feature can allow for merchants to prioritize a debit preferring application over other underlying products of the same brand. When a merchant supports auto debit, the customer often ends up entering a PIN or bypassing the PIN, which requires contact with the PIN pad surface.

Mitigation:

Merchants have a configurable option to disable auto debit and cardholder selection option, which allows the Point of Sale (POS) application to select the application with the highest priority indicator in the chip without any cardholder interference at the PIN pad, reducing physical contact during payment.

Candidate list filtering

Issue:

Payment cards may have multiple applications resident within them, such as a ‘domestic debit’ application, and an ‘international credit’ application.  As noted above, debit schemes often require the use of a PIN, so when those applications are chosen by default for payment it can lead to increased contact with the terminal.

Mitigation:

Merchants may have a configurable option to prioritize global credit applications, which usually support signature and no cardholder verification method (no CVM) over a U.S. common debit or global debit application (which usually takes a PIN preferred route). This, along with disabling cardholder selection, allows the POS application to select the application which has the highest priority indicator in the payment card without any cardholder interference at the PIN pad.

U.S. common debit applications are:

  • Visa U.S. common debit
  • Mastercard U.S. common debit
  • Discover U.S. common debit

Cardholder Selection

Issue:

Cardholder selection allows cardholders to choose their preferred application on a multi-account card. While this feature allows customer to control the credit/debit application that’s used for payment, it also brings them in contact with the physical PIN pad.

Mitigation:

Merchants have a configurable option to disable the cardholder selection option that allows the POS application to select the application with the highest priority indicator in the payment card without any cardholder interference at the PIN pad.

In the event that a U.S. common debit application has been selected by the POS as the highest preferred application in the ICC, merchants supporting POS PINless processing capabilities can process the transaction as a NOCVM.

In the event that a global debit has been selected by the POS as the highest preferred application in the ICC, merchants and acquirers processing global debits (e.g., Interlink and Maestro) as a single message can continue processing as business as usual since a PIN is required for these transactions.

POS PINless   

POS PINless is the new term for PINless transactions for any amount below $50 in which the merchant can process a U.S. common debit transaction without a PIN over a supported PINless debit network. Merchants can qualify for PINless POS processing via the acquirer if the merchant acquirers can route transactions to debit networks supporting PINless processing (STAR, Accel etc.). 

Many countries have increased their PINless limits to much higher than $50 (in countries like Australia it is currently $200AUD, or approximately $132USD).  As people look for safer ways to pay, acquirers and payment brands should consider the increase of the POS PINless limits to higher limits, such as $100, to reduce contact during a larger percentage of the transactions performed.

Other things to consider:

Of course, just because you can do some of these things above it does not mean that these are the right thing to do for your company.  Along with advice that UL can provide, anyone looking to implement these changes should also consider the following:

  1. These recommendations should be implemented only after discussions with acquirers, gateways and payment processors, and after assessing the impact it has on merchant interchange fees.
  2. Disabling auto-debit transactions has an impact on customer choice, and that choice can be an important value to some customers.  Implementations should consider how to best signal to customers how transactions will be processed, or provide customers with options for some payment lanes to use ‘traditional’ methods.
  3. Global debits (e.g., Interlink and Maestro) must still be processed as a single message as supported today by the processors with a PIN.
  4. These recommendations has been made after determining there is a minimal need for testing and certification to implement the features.