Group 1: Syed Zain Ahmed, Hilary Leigh Beck, Scott Berry, Kevin Brian Chau

Group Introduction
Team Members:
 * Kevin Chau
 * Hilary Beck
 * Scott Berry
 * Zain Ahmed

Lecture: CPSC 203 L04 WI 09

Intructor: Donny Cheung

Group: 1, Tutorial 28

Project Statement
Technology: Security chip embedded in debit and credit cards

Issue: Preventing counterfeit/skimming of credit and debit cards

Who is EMV?
EMVCo is the company that manages, maintains and enhances the new EMV® Integrated Circuit Card Specifications for chip-based payment cards and acceptance devices, including point of sale (POS) terminals and ATMs. The name EMV comes from the letters of the three founding organizations; Europay, MasterCard and Visa. The primary goal of EMVCo and the EMV Specifications is to help facilitate global interoperability and compatibility of chip-based payment cards and acceptance devices.

What is an EMV Chip Card?
The new EMV chip cards are debit or credit cards which have a microchip which can store and process data embedded directly in the card. The data which is encrypted onto the chip is extremely difficult to copy or change.

Standards for chip cards and devices developed by Europay, MasterCard and Visa to ensure global interoperability. Defines how debit and credit payment applications work – Some mandatory requirements and a wide range of optional features and characteristics. (http://www.emvco.com )



CPU/MPU Microprocessor Multifunction Cards
These kinds of cards are contact cards, which means that they must be in direct electrical contact with the card reader. They have the cheapest and the most common type of chip used in debit/credit cards. Multifunction smart cards give out card memory to different sections to complete a specific function or run different applications. Within the card is a microprocessor or microcontroller chip that manages this memory allocation and file access. Due to this, many different types of applications can be on the same card. So a single card can act as a debit card, a credit card and also an ID card. This makes life simpler for the card holder because there are fewer cards to carry. Also, the cost of making all those cards is reduced.



Biometric Cards
These are cards that use physical features to verify that the individual using the card is the card owner. There are eight major categories of biometrics currently in use or development: face scan, finger scan, iris scan, hand scan, keystroke dynamics, retina scan, signature scan and voice scan. These cards greatly increase security and reduce fraud because only the card owner can use the card. According to international analysts, the biometrics industry seems to be the next technology wave, promising exponential growth over the next couple of years.

Contactless Cards
These cards use radio frequencies between card and card reader so there is no need for physical contact between the two. They are useful in retail stores because they speed up transactions.

Card Personalization

 * Card can be programmed with settings specific to an individual cardholder
 * Parameters include risk management settings, limits, etc.

Pin Verification

 * Debit and Credit payments will both use PIN
 * PIN may be verified “offline” using PIN information securely stored in the chip or “online” by the Issuer host as it happens today for debit



Application Selection

 * Card inserted by cardholder into chip-reading terminals rather than swiped
 * Card stays in reader until transaction is complete
 * Terminal checks to see which payment applications are supported
 * Terminal presents the cardholder the available payment options (e.g. American Express, Interac, MasterCard, VISA)

Authentication

 * Terminal and card can perform risk management checks (e.g., terminal can check to assure that a card is valid)
 * These checks are performed using Public Key Infrastructure (PKI) functionality

Card Production and Management
- Cards must be “personalized” with EMV application data at the time of issuance

- Increased production costs of personalized EMV cards

PIN Management
- Cardholder PINs are stored in the chip on the card,

- PIN is encrypted and synchronized with data stored on issuer host systems


 * - Cardholders are required to remember another pin



Required System Upgrades
- EMV introduces more data into authorization and clearing messages than with magstripe, and all processing systems will need to be modified to handle this data

- Existing ABMs and POS terminals and software will need to be upgraded or replaced with chip enabled equipment

- Costs for replacing 'ALL' existing ABMs and POS terminals can result in extra expenditure

Checkout Procedures Change
- Transaction process is different at checkout – the customer experience for debit and credit transactions become similar

- Changes may cause inconvience to consumer/merchant familiarity

Security

 * Improved security - data on the chip is difficult to copy or change


 * Improved security increases customer confidence for making purchases


 * Reduced techniques for counterfeiting and skimming


 * Reduced costs related to fraud management

Innovation

 * Technology platform for new product and service offerings from Issuers, Acquirers and merchants


 * Payment and non-payment opportunities


 * Keep pace with global movement in card payment technology

Efficiency

 * Increased POS checkout speed – PIN faster than signature for credit


 * With PIN, merchant will not need to verify signature


 * Consistent payment experience for credit and debit


 * Reduced disputes and chargebacks for unauthorized credit card transactions


 * A single chip card can offer multiple applications, such as debit, credit

When EMV will be used exclusively
Each organization which has chosen to implement this new chip card transaction, has developed their own individual strategy to adopt the new EMV cards.


 * American Express plans to change the systems as issuers and mechants require or chose to move to the new technology, however they have provided no specific date and will just adjust as the market adjusts.


 * Interac Association is extimating that complete card and ABM conversion will be required by the end of 2012; while complete POS conversion will be required by the end of 2015.


 * MasterCard International is supporting their customers’ EMV Chip migration programs with commitments from 12 issuers and 5 acquirers for development by 2010


 * Visa Canada is committed to a critical mass of EMV Chip cards and terminals in market by 2010. Visa has implemented a liability shift that occurs in October 2010

As you can see the majority of cardholders using Mastercards and Visa will have switched over to chip or EMV cards by 2010, with the majority of debit cards beign switched to chip cards by 2012 and that by 2015 magnetic stripe transactions will no longer occur. (http://www.visa.ca/chip/merchants/resources/downloads/chip_study_0207.pdf)

Statistics
The following graph depicts the increasing rate of fraud from 2003 to 2006. As you can see from the graph the instances of fraud have been increasing over this time period.



Based on reasearch reported by Visa Canada Canadian consumers are ready for Chip & PIN cards.

There websites states that in January 2007, Ipsos Reid published a report based on syndicated consumer research regarding chip cards in Canada, that concluded, among other things, 73% of Canadians feel chip cards would help reduce fraud*, and, most Canadians prefer PIN verification versus signature.

Conclusion
In conclusion, based on the research fraud with the new debit cards and credit chip cards has indicated that with the implementation of these new cards, the risk to consumers of fraudulent use of there card will decrease. Based on our research and review of these new cards we certainly agree that the transition to these new cards is beneficial.