EMV 101 FAQs

thumb

Last month, Shift4 was approached by Retail Realm, one of our long-time partners with a request to put together an EMV 101 webinar for their resellers. The event was a great success and we were able to share the expertise of Shift4’s VP of Business Development, Bob Lowe, who has been part of EMV migration projects in Australasia, Europe, Canada, and now the U.S.

Since the webinar, we have been contacted by dozens of payments industry professionals who are looking for answers and assistance as they work with merchants to prepare for the October 1, 2015 EMV liability shift date. Based on what we’ve heard so far, we’ve put together a Shift4 EMV Q&A of the most common questions from resellers, VARS, and other potential partners.

Which U.S. Processors work today with EMV?
All processors are adding support for EMV, and are in various stages of readiness. While the exact order is subject to change due to customer demand, processor responsiveness, and a number of other potential factors, Shift4’s current plan is to support U.S. processors in the following order:
  • 1-Global/AMEX
  • 2-TSYS
  • 3-First Data
  • 4-Chase
  • 5-Elavon
  • 6-Vantiv
  • 7-RBS WorldPay
  • 8-Heartland
  • 9-First Caribbean International Bank
  • 10-First Hawaiian Bank
How does EMV work for a customer using a virtual terminal?
EMV requires transactions to be entered through an approved payment device. If the virtual terminal solution can work with an EMV device, it can be used. Shift4 is working with device manufacturer ID TECH to ensure our VT4 mobile payments solution (which includes virtual terminal functionality – and much more) will be EMV capable before October. However, most other virtual terminal solutions have the card data entered through the virtual terminal application and would then be considered manual-entry or swiped transactions, which would not qualify as EMV transactions.
Does Shift4 handle settling or batching transactions or is it still done by Microsoft Dynamics RMS ?
Shift4 handles the batching and settling of transactions, relieving RMS from those responsibilities. RMS simply marks the transaction as ready to settle and Shift4 takes care of everything else.
With the U.S. not mandating PIN as part of EMV, will we see EMV devices without the keypad?
Yes, these are coming. The terminals that we will initially see from companies like Ingenico and Verifone are devices that have been used in Europe and Canada where PIN is a requirement. Based on the U.S. PIN-less flow, we are now starting to see plans for devices that have no keyboard. Some are calling them “three-in-one” devices because they accept chip, swipe, and contactless transactions. We expect these devices will be commonly used on mobile devices where the three-in-one device is plugged into the audio jack (or in the future, lightning/micro-USB port) of a phone or tablet.
Does Shift4 operate in the Caribbean?
Yes. Shift4 supports both First Data South and First Caribbean International Bank as processors in the region.
Is Shift4 a gateway and then the customer signs up for a processor separately?
Yes.
Is there any change in the end-user customer’s liability when they receive an EMV card?
The cardholder’s liability is unchanged with EMV. The EMV liability shift applies to merchants, card issuing banks, and processors, and basically states that whichever entity breaks the EMV chain (i.e., is not ready to accept the EMV transaction), becomes financially liable for any fraud committed in that transaction.
Which payment devices are approved by Microsoft RMS that support EMV and NFC?
Shift4’s proprietary Universal Transaction Gateway® (UTG®) controls the EMV devices. Therefore, it is Shift4’s certification – and not Microsoft’s – that determines whether or not a specific device will be supported. Currently, Shift4 is seeking certifications for the Ingenico iPP320 and iPP350, along with the iSC Touch 250, iSC Touch 350, and iSC Touch 480. Shift4 is also certifying the Verifone MX915 and MX925 devices. All of these devices support EMV, NFC, and P2PE. Additional devices may be considered and added as needs arise.
What is the cost of DOLLARS ON THE NET?
Shift4 charges on a pennies per transaction basis with discounts for significant volume.
Would any credit card transactions be stored on the POS?
With Shift4’s solutions in place, the POS would continue to store transactions, but the transaction would no longer contain sensitive cardholder data. In fact, when used with Shift4, RMS, Retail Realm Essentials, and AX for Retail never store, process, or transmit sensitive credit card data.
How do we protect our customers’ investment in these devices in terms of future-proofing? Will these devices be capable of receiving remote updates to keep up with new rules or new capabilities?
All of the devices we are currently certifying support remote updates. Shift4’s UTG can push these updates as necessary.
How does EMV affect card-not-present transactions?
The EMV changes only impact card-present transactions; card-not-present transactions will work exactly as they do now.
Is the signature collection process going to be different with EMV? There are rumors that EMVco is going to require signatures to be collected on paper.
We are not aware of any paper signature requirements for EMV. With EMV, the cardholder signature will be used exactly as it is now – for chargeback defense. While PIN has been required in most countries that have implemented EMV (hence the nickname “chip and PIN”) in the U.S. it appears that most issuing banks are opting to only support signature authentication. Logic within the card will prompt the terminal to display either a PIN entry or a signature capture. If a signature-capture-capable device is in use, Shift4 will trigger the device to display a signature line. If the cardholder declines to enter it electronically, or the terminal doesn’t support signature capture, the printed receipt will automatically include a signature line for the customer to sign on. The transaction will go through regardless of whether the signature is actually captured, but in the event that the cardholder contests the transaction and the merchant cannot show a signature (physical or digital) the chargeback will fail.
Does Shift4 support tokenization for recurring transactions?
Yes. Shift4’s TrueTokens® may be securely stored within the POS application for use in recurring transactions.

Shift4 Doesn’t Use SSL (And You Shouldn’t, Either!)

ssl image

You may remember that back in November, we released an alert about protecting yourself from the POODLE SSL vulnerability. For those of you who are less familiar with SSL, it refers to a type of encryption that was once used to secure communications between a user’s Web browser and a website in order to protect transmitted data from eavesdropping or tampering.

Shift4 Supports EMV to a T

emv image

We’re now 7 months away from the EMV liability shift. But, don’t worry. Shift4 is hard at work behind the scenes to make sure your EMV migration is a breeze.

There are three easy steps that you can do today to start preparing for EMV.

Heads Up: Extended Support for Windows Server 2003 Is Ending

win2k image

Last year, Microsoft announced that extended support for Windows Server 2003 would end on July 15, 2015. This means that after July 15, Microsoft will no longer deliver any security updates, pay-per-incident support, or support from Microsoft’s Knowledge Base for Windows Server 2003.

On Your Mark, Get Set, Update i4Go®

i4Go image

Do you already use Shift4 for e-commerce? Then you’re going to be excited to learn that we’ve updated our i4Go® security solution to make it even better. For this reason, we’re phasing out i4Go v.1 with an end-of-life on January 12, 2016. You’ve got plenty of time to update, and some of our merchant customers have already started to use the updated version of i4Go. Now you can join them!