A waiter who brings a card swiping machine to the table so diners can punch in their personal identification numbers (pins) themselves has long been a familiar sight for travellers from the UAE to Europe. With the UAE Central Bank’s deadline for debit card and merchant migration to chip-enabled cards looming at the end of the year, this scenario is increasingly becoming the norm here as well.
EMV (named for developers Europay, MasterCard and Visa) chip-based payment cards, also called smart cards or chip-and-pin-enabled cards, contain an embedded microprocessor, which contains the information needed to use the card for payment. For the user it means being asked to punch in their personal identification number on every transaction.
Widely perceived as more secure, chip and pin — or EMV-enabled — credit, debit and prepaid cards are poised to immigrate onto the UAE’s payments’ landscape.
“The Central Bank of UAE mandate is progressively improving the performance at a faster pace,” Yasser Kunhi, Risk Manager for Visa Middle East and Pakistan, says in an interview with GN Focus.
Official figures until the last quarter of 2011, released by EMVCo — owner of the EMV trademark, show that 45 percent of all payment cards and 76 percent of all payment terminals in circulation globally are based on EMV technology.
EMV cards ensure that the chip encrypts transaction data differently for each purchase. Because the transaction information is encoded uniquely every time, criminals find it difficult to pick up payment data pieces and use them again for another purchase.
In case of magnetic strips, the payment information is static and never changes. All it requires for a fraudster to do is to lift that information.
“The customer experience with EMV cards across the globe has been overwhelmingly positive as they reduce fraud, improve the security and enhance the usage experience,” says Faraaz Ali, Cards Division Head, Middle East and North Africa, Citibank.
Research supports this premise. A 2011 survey by the UK Cards Association, along with Financial Fraud Action UK, found that counterfeit fraud losses in the UK dropped by more than 63 per cent since 2004. The report attributes this steep decline to increased use and acceptance of chip-and-pin cards.
Backed by consumer demand, banks are aggressively ensuring that their customers migrate to chip-and-pin cards. “You put the chip to prevent losses and give confidence to the consumer,” says R. Sivaram, Senior VP and Head of Cards, Retail Cards Business, from Emirates NBD.
Data shows an increase in card use among UAE residents. People in the UAE made 19.9 million point-of-sale (POS) transactions in 2010, making payments totalling Dh7.5 billion, according to data from the Central Bank. In Q4 of 2011 the number of POS transactions was 12.5 per cent higher than Q3 2011, and was almost 57 per cent higher than Q4 2010. The value of POS transactions rose to reach Dh3.1 billion in Q4. For 2011 as a whole, the number and value of transactions was 11.1 higher than in 2010.
Many UAE banks have been proactive in issuing chip-and-pin cards to their customers. Emirates NBD, HSBC and American Express have been some of the early adopters. In December 2011, Abu Dhabi Islamic Bank (ADIB) announced that it was on track to migrate all of its Visa covered and debit cards to chip-and-pin cards. From mid-2010, all new ADIB cardholders were issued with an EMV chip-and-pin debit and/or covered card. At the same time, ADIB started to migrate existing cardholders from their magnetic strip cards to EMV cards.
According to Sivaram, 70 per cent of debit cards from Emirates NBD are chip-and-pin-enabled and the remaining 30 per cent are on track for the December deadline. “In any case, when we merged we had to change the brand name and reissue cards. So we decided to implement chip-and-pin ahead of the market,” he says.
Banks have been phasing out old cards and phasing in the new ones because of the challenge on re-carding. “There are only a few players in the market. Another challenge is reaching it to the customer. We phased it so if a customer’s card was already expiring we aimed to send the chip-based one,” Sivaram says.
While the cost of the chip has been higher — a card with only a magnetic strip would cost a bank Dh1 to Dh1.50, whereas a chip-enabled card would fall about Dh2.50 to Dh5, depending on the volume — bank officials say that the cost is offset by reduced fraudulent transactions and increased consumer confidence, which encourages consumers to use the card more. Technology has become more cost-effective and the stage is set for global migration to chip-enabled cards.
“In Europe, it became an industry issue because of so many frauds. When people starting losing confidence in cards, the industry became conscious. When it happened in Malaysia, it started losing credibility as a destination. The regulations were tightened and today it is one of the safest countries,” says Sivaram.
Chips also have other benefits besides security, most notably that they hold more information than magnetic strips.
Tareque Choudhury, Head of Security at BT Global Services, a provider of networked IT services, says that chip-enabled cards can be and are being used to pack more data and provide ease-of-use. “In the UK, for instance, debit and authentication cards are all-in-one. Barclays has packed NFC technology onto the chip, which enables you to swipe it for anything under £10 (about Dh58). As it becomes simpler to use, people will carry less cash and there will be less risk of losing money. The back end will become more complex.”
The next step is to take steps to prevent fraud in cases that don’t require a physical card, such as for online transactions, where the chip-based card is no more effective than the traditional magnetic strip card.
Banks in the UAE are examining and testing more uses of the chip. “We are evaluating loyalty and additional online security applications to be included on the chip cards,” says Ali on Citibank’s plans to make more use of the chip.
For consumers equipped with EMV-enabled cards the journey has been simple. But for those transitioning from magnetic strip-based cards, things can be difficult when they travel. In the UAE and elsewhere most machines are set to bypass the chip if they are not equipped to handle it, so the transactions take place regardless.
Travellers to certain regions may not be able to use their credit card at self-service payment kiosks that don’t recognise cards that don’t have a chip. Since EMV has been prevalent in Europe for very long, many younger or untrained staff are not used to dealing with magnetic strip cards often — EMV terminals are common in almost 94 per cent of regions in some zones of Europe. Merchants are known to have business decisions in place for refusing non-EMV cards as payment.
“Penetration differs by region with APAC and Europe leading the charge. However, the UAE is at an advanced stage with many banks issuing EMV cards and virtually all merchants accepting such cards,” Ali says.
Statistics: EMV ‘chip-and-pin’ payment cards
EMVCo, the EMV-standards body collectively owned by American Express, JCB, MasterCard and Visa, is a global standard for credit and debit payment cards based on chip card technology. According to statistics released by EMVCo earlier this month, as of Q4 2011 there were more than 1.5-billion EMV payment cards in circulation and 21.9-million EMV terminals active worldwide.
The adoption rate for EMV cards in Africa and the Middle East is 20.6 per cent (global average 44.7 per cent), with a total of 31,573,578 cards, even as 462,000 terminals are equipped to read EMV cards, with an adoption rate of 75.9 per cent (global average 76.4 per cent). The figures represent statistics from American Express, JCB, MasterCard and Visa, as represented by their member financial institutions.
A UAE Central Bank notice issued mid-2011 says, “In the interests of improving security of payments, the Central Bank mandates the national migration to EMV ‘chip-and-pin’. This mandate affects all general purpose payment cards, i.e., those bearing the brand of a domestic or international card scheme.”
The timetable for compliance specifies that by March 31, 2012, all terminals should have been compliant. December 31, 2012 is the deadline for compliance on all ATMs, prepaid and debit cards, while credit cards have until December 31, 2014.
Providing the EMV rate (both issuing and acquiring) which is based on the settlement volume, Yasser Kunhi, Risk Manager for Visa Middle East and Pakistan, says, “47 per cent of transactions by value logged in April 2012 in the UAE on UAE-issued cards were EMV, whereas globally 40 per cent of transactions by value logged in April 2012 on UAE-issued cards were EMV.” In the UAE, on UAE-issued cards, “42 per cent of the total number of transactions logged in April 2012 were EMV, where globally 41 per cent of the total number of transactions logged in April 2012 globally on UAE-issued cards were EMV.”
— S.S.
