[BreachExchange] Visa Clarifies Merchants Have EMV Debit Routing Options

[Audrey McNeil]

http://www.databreachtoday.com/blogs/visa-clarifies-
merchants-have-emv-debit-routing-options-p-2326

After complaints from merchants and an update from the Federal Reserve,
Visa on Nov. 22 clarified and modified debit routing rules, noting that
merchants can route U.S. EMV debit transactions through any of more than a
dozen available networks, and not just Visa's.

Visa's action could help support merchants' push for more widespread use of
chip-and-PIN, even if only for EMV debit.

"Visa's announcement comes just days after retail groups criticized the
card brand for taking steps to "circumvent merchants' legal right" to
choose the network over which a debit transaction can be routed."

In its statement, Visa notes that it "modified and clarified existing debit
network routing rules to help merchants and acquirers better understand
implementation options related to the adoption of EMV."

With Visa chip cards, debit routing and processing are enabled by two
payment application identifiers (AIDs) on the chip - the U.S. Common Debit
AID or the Visa Debit AID, Visa notes. "The Common Debit AID can support
any of the more than one dozen domestic debit networks that issuers can
choose to offer in addition to Visa Debit. This provides merchants with the
ability to select the network over which a debit transaction is processed
or routed. ... Merchants can continue to automatically ask, or prompt, a
Visa cardholder to enter a PIN on in-person transactions, provided the
cardholder can still use their card without a PIN if they prefer."

The announcement comes just days after retail groups sent a letter to Visa,
criticizing the card brand for taking steps to "circumvent merchants' legal
right" to choose the network over which a debit transaction can be routed.

The Merchant Advisory Group and other retailer associations claimed that
Visa's policies before Nov. 22 violated the Federal Reserve's rule on how
debit transactions can and should be routed. In essence, MAG contended Visa
was breaking the law (see Why Merchants Object to Visa's EMV Debit Routing
Rules).

On Nov. 2, the Fed clarified that no card network can inhibit merchant
routing choices, even by requiring technical specifications - such as those
needed for EMV deployment - that could inhibit merchant routing options.

The PIN Debate

Since the onset of EMV in the U.S., merchants have argued that requiring
PIN entry for all EMV chip payments, whether credit or debit - as has long
been the practice in established EMV markets such as the U.K. - is the best
way to prevent fraud.

Issuers and the card brands, in an effort to deploy EMV more quickly,
pushed back on that idea, claiming requiring PINs for credit payments would
only confuse customers and complicate EMV rollouts.

On the debit side, the argument for signature over PIN has been more
challenging to make, because U.S. cardholders are accustomed to entering
PINs for debit purchases, especially when using the cash-back option.

But the EMV debit rollout in the U.S. has been much more complicated than
the credit rollout because of the sheer number of debit routing options
available in the U.S. - a complication that doesn't exist in other EMV
markets.

To route an EMV transaction through a domestic debit network, that network
has to be certified by the card brands and equipped to process EMV
transactions. And because the U.S. has more than a dozen debit card
networks, getting all of those networks prepped and certified has been a
long, drawn-out process.

To speed EMV adoption, merchants claim Visa limited merchants' options to
run debit transactions through the Common Debit AID and was challenging
merchants' right to requirePIN entry on debit purchases.

Visa declined to comment beyond what was included in its statement about
its debit routing modifications.

In light of Visa's modifications and the Fed's recent guidance, it's clear
that merchants canrequire PIN entry for EMV debit purchases, contends Liz
Garner, vice president of the Merchant Advisory Group, which represents 108
of the largest U.S. merchants, says. "But I think that's going to be
contentious," she adds.

That's because, while Visa points out in its modifications statement that
merchants can discourage the use of signature verification for debit
purchases, they cannot completely eliminate signature as an option. "Where
merchants automatically prompt for PIN on card-present transactions, they
must minimally ensure that a cardholder presenting a Visa Debit card for
payment can originate a transaction using a signature," Visa says.

The language is still "loose," Garner points out. But in the coming days,
we may receive clarification from Visa or the Fed.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20161128/a28fcc4f/attachment.html>