Lessons Learned from the UK Chip & Pin Implementation and the Rolling Stones
June 5th, 2013
Ah … London … home of Big Ben, Hyde Park, the Rolling Stones, and Chip and Pin. My global career fortunately took me to the UK during the decade of driving the case for Chip and Pin, implementing it, and then dealing with all of the various post-implementation issues that inevitably arose.
In hindsight, the UK market conducted a very impressive cross-industry implementation of Chip and Pin that included merchants, issuers, acquirers, associations, and certainly customers. This group did as much as they could to make sure consumers were educated and understood what was changing at the point of sale.
Given all of this, other global markets, including the US, can benefit from some of the Lessons Learned from the UK.
1) Issue DDA (Dynamic Data Authentication) Chips, not SDA (Static Data Authentication) as SDA Chips are vulnerable to offline counterfeit.
2) Send as many transactions as possible through the online channel and do not allow offline processing.
3) Incentivize merchants to do Chip and Pin; make sure all terminals are certified properly.
4) Monitor fallback rates and work with merchants and acquirers to minimize it.
5) Focus on your own terminals first, and get your own house in order. Make sure that any ATMs you own and any terminals you issue are fully chip-capable and chip-certified before you hassle anyone else about theirs!
6) iCVV (CVV on the CHIP) is critical; make sure the CVV on the mag strip is different to that on the Chip. Fraudsters have been performing good old mag stripe fraud by using a copy of the mag stripe on the Chip.
7) Ensure your fraud strategy and models are ready for the change. While domestic counterfeit is greatly helped by Chip & Pin, the fraud shifts to other fraud types like CNP, Account Takeover, Social Engineering, and Cross Channel (online, mobile, call center).
8) Have a clear and consistent customer communications plan; educating the marketplace is of critical importance.
9) And last, but not least, bring your umbrella to Hyde Park to see the Rolling Stones; it just might rain a bit.
