• Gemalto is now part of the Thales Group, find out more.

EMV chip and technology basics (2019 update)


First of all, what does EMV stand for? 

EMV is short for Europay, MasterCard, and Visa, the 1994 founders. 

The EMV standard is a secure technology that is used worldwide for all payments done with credit, debit and prepaid EMV smart cards. It can be used in three forms: contact, contactless and mobile. 

EMV means powerful security for more than 8 billion payment cards in early 2019 and commonly refers to a credit card with a smart chip. 

Let's discover why EMV chip cards are conquering the world in 7 points and a video.
  • What is an EMV chip?
  • Chip-and-PIN and Chip-and-signature. What's the difference?
  • Why is it more secure?
  • A word on the EMV liability shift (a good motivation)
  • The latest deployment stats 
  • The EMV key features
  • The very tangible benefits
Let's jump right in.
 
 

What is an EM​V smart card?

Today, EMV® defines a suite of security standards for credit and debit card transactions. EMV can be used for NFC mobile payments as well. 

EMV chip cards use a smart chip instead of a mag stripe to store the data that is needed to process a transaction.

They are also referred to as "EMV cards", "EMV smartcards" or"EMV credit cards", "chip and PIN cards", "Chip and signature cards" or even "IC cards" (for integrated circuit).

What's the difference between chip and PIN and Chip and signature?

In both cases, the cards are EMV cards.

  • Most cards issued in the United States are chip and signature. The payment process requires card-holder to provide a signature to complete a transaction, just like credit cards traditionally have in the past.  
  • Outside the United States, chip-and-PIN is more common. The PIN function requires a confidential four-digit PIN code known only by the cardholder to validate the payment. It is more secure.

In 2019, most of the ATMs and payment terminals outside the United States have been updated and are able to detect that your card is EMV compliant, that a PIN wasn’t issued on your card, and validate the transaction. 

Anyway, it’s a good idea to travel with a chip card that offers both authentication methods and carry more than one credit card.

EMV smartcard

Why are EMV chip cards more secure?

EMV brings increased security and global interoperability to card and mobile payments, even in card-not-present payments, if coupled with a card reader or one-time password device. 

The chip* on an EMV card is capable of much more sophisticated authentication than magnetic-stripe cards. 

In other words, there is a fully operating computer system embedded in every EMV card. 

The chip is tamper-proof, making the card nearly impossible to clone.

*You can find more information on smart card technology here: smart card basics.

What is the EMV liability shift?

In the United States, the fraud liability (aka EMV liability shift) ran into effect on October 2015 for POS (Point Of Sale) devices and in October 2017 for Automatic Fuel Dispensers.

However, upgrading to EMV is not a law per se.

But the rules defined by Express, Discover, MasterCard and Visa (the EMV mandate) clearly state that the liability for card-present-fraud (typically when you handle your card to the merchant in a store) can now fall on the card-issuing bank or the merchant if the EMV technology is not in place.

That's why Banks are issuing EMV chip cards. 

Merchants are also motivated to upgrade their payment devices to accept the new EMV smart cards. If they do not accept the new cards, they could be charged by the Issuing Banks. 

That was not the case before.

Needless to say that the EMV migration is now full speed in the U.S.

In August 2015, the Reserve Bank of India (RBI) mandated banks to phase out the magstripe payment cards and migrate to EMV chip cards. RBI set December 31, 2018, as the deadline for the chip and PIN card migration. (Why Indian banks are upgrading your debit, credit cards)

The result?

EMV deployment statistics 

There are now over 8.2 billion EMV chip cards in circulation at the end of 2018, which is an increase of 14.5% in 2017.

In Q4 2018, according to information collected from American Express, Discover, JCB, Mastercard, UnionPay, and Visa, 73.6% of all chip card-present transactions in the world (both contact and contactless) - used EMV chip technology.

More precisely for 2018, it was:

  • 92,95% for Africa and Middle East with 270m cards in circulation
  • 68,15% for Asia with 5 billion cards
  • 93,75% for Latin America, Canada, and the Carribean 848m
  • 97,34% for Europe zone 1 with 966m 
  • 91,82% for Europe zone 2 with 301m
  • 53,52% for the United States with 842m

Globally in 2018, 58.7% of all issued payment cards were EMV chip-based.

EMV stats

EMV fraud stats

According to a Visa report published in May 2019, U.S. fraud (in value) has been slashed by 76% in December 2018 compared to September 2015.

That means EMV technology is working as planned.

See how EMV chip cards can reduce payment fraud in card-not-present fraud cases as well.


​​​​​​​​

​EMV technology key security features

The EMV chip

Why do the EMV specs explicitly request a smart chip inside each and every card? 

For one reason - security. 

A smart card chip is a small computer with a microprocessor and some memory and application software.

Unlike a magnetic stripe card, a smart card is extremely difficult to crack as it's been designed with security in mind.

It also contains a secure vault that holds unique keys specific to each card that protect your transactions.

A Unique Code for Each EMV Payment

EMV cards generate a unique code that is validated by your bank for each transaction, and the code cannot be re-used. 

A fraudster couldn't make a transaction using a fake card with stolen data at an EMV terminal because it wouldn't be able to generate the proper code.

In short with EMV technology: No rewind, no replay.

Advanced Cryptography

EMV security is based on strong cryptography which is used to generate the unique transaction codes that allow the terminal to authenticate the card. 

This cryptography is built on private key infrastructure, meaning that only a chip card that is personalized with the cardholder's private key during manufacturing can generate a valid transaction.

SDA vs. DDA

Card Authentication Methods (CAMs) were based on Static Data Authentication (SDA). 

However, the world has moved on, and the vast majority of payment cards shipped today feature the more sophisticated Dynamic Data Authentication (DDA) or Combined Data Authentication (CDA).

So what is DDA more precisely? 

It's a protocol for checking that the EMV chip card is legitimate. 

It's an offline authentication method (so without any network). It uses data from the card to allow the terminal to authenticate the card. 
The terminal (POS for example) which is preloaded with keys will check complementary keys on the card for each transaction. It's a good protection from certificate cloning and card skimming.

Visa and MasterCard have mandated migration to DDA on all EMV smartcards in Europe and Canada, and it is becoming standard in the U.S. too.


​​​​​​Card Personalization Services

What are EMV benefits​?

EMV chip slashed fraud by half in the U.S. in one year

EMV is almost 100% effective when it comes to preventing face-to-face (in-store aka card-present fraud) counterfeit card fraud. 

When France migrated to EMV in 2005, card fraud nearly disappeared. 

The case replicated in the United Kingdom in 2012 (chip and PIN). 

The U.S. began adoption in late 2015 and a study from the (U.S.) Federal Reserve issued in 2018 showed that the amount of card-present fraud in the country declined from $3.68 billion in 2015 to $2.91 billion in 2016. 

It's a 48% decrease in ONE year. 

Over three years, it's a decrease of 76% according to the May 2019 Visa report mentioned earlier.

Increased card spending

The tap-and-go convenience of a contactless EMV chip card is likely to make it your customers' new favorite, leading to increased loyalty and spending on that card. 

Adding contactless capacity has even generated a significant increase in contact transactions made with those cards.

Global interoperability of the EMV standard

EMV is the global standard for payments, the market penetration of the technology is growing around the world, in particular, the nearly 100% EMV compliance in portions of Europe and Canada.

Today, with magnetic-stripe cards, your customers may not be able to pay with their cards when they're traveling internationally. 

In other words: Wherever EMV chip cardholders make purchases, they get reliability and convenience.

​Strengthened customer relationships

Migrating to EMV is an opportunity to show your customers that you take their security seriously.


​​
​​​​​​​​​​​​Con​tact, contactless or mobile payments

​EMV chip for contact, contactless or mobile payments

Contact EMV offers the added security of the EMV chip, making it impossible to create counterfeit cards. Contact cards can be used in all EMV capable POS payment terminals.

The card is inserted into the terminal and stays there while the customer types a PIN or writes his/her signature.

​Contactless (dual-interface) EMV card

This is the level to go for if you want a technology that's not only convenient and secure but also future-proof.
The card is tapped against the POS terminal, or simply waved in front of it.

Mobile payment

With mobile EMV the customer's account credentials are loaded directly onto an NFC-enabled cell phone or wearable device. This is just as secure as contactless EMV chip, but with superior convenience and added opportunities.

The smartphone is tapped or waved at the POS terminal, just like a contactless card.

More about contactless payment​
Gemalto's EMV cards​