You’ve undoubtedly seen them every time you stop at your local convenience store, or a version of them when you’ve checked out at the grocery store. You may have even seen a version at a local restaurant, alleviating the need for you to hand your card over to your server who disappears with it for several minutes. Most merchants, large and small, now utilize some version of the EMV-enabled Point-of-Sale (POS) card reader. But what is EMV? And why does it matter?
You might assume that the sole purpose of these readers is to simplify the process of collecting payment by credit or debit card, benefitting the merchant, but these readers are also designed to create a much more secure process of collecting payments, which benefits individual consumers as well.
What is EMV?
EMV stands for “Europay, MasterCard, Visa.” It is the “chip” or “contactless card” technology that has recently been added to most Visa and MasterCard credit and debit cards. The purpose of the chips is to give the consumer more control of their card – keeping it out of the hands of would-be fraudulent users.
When you insert or “touch” your card at one of these EMV-enabled POS readers, you retain control of your credit or debit card information. You aren’t handing your card over to another person or company. Previously, your credit or debit card information was stored by the collector of your payment – and therefore, subject to potentially fraudulent activity on an individual basis. Now, through the use of these readers, your personal information stays in your own control.
EMV reader technology adds additional layers of protection for your personal financial information. In recent years, major retailers have experienced high-profile data breaches, exposing the credit and debit card numbers of millions of consumers to potential theft and fraud. In the well-known cases of Home Depot and Target, the transactions containing consumer credit and debit card numbers were stored in their databases. When those databases were hacked, the hackers had access to literally millions of card numbers. EMV readers eliminate this risk through encryption and something called “tokenization.”
Point-to-Point Encryption (P2PE) is used to protect the cardholder data at the start of a transaction. All tracked data, including account number and expiration date, is obscured so that the data cannot be decrypted without the corresponding decryption keys. Using P2PE, card data is encrypted at the time of reading (swipe, insert or manual entry) and stays encrypted until received and decrypted by the payment processor.
When card information needs to be retained for future transactions, tokens are used instead of cardholder data. Since each transaction is unique, encrypted card data stored from a previous transaction is unusable. So, when a transaction is performed, the bank or payment processor may return a token, which can be stored and used at a later date for subsequent transactions. Most importantly, the token cannot be reversed to retrieve any cardholder data.
While EMV-enabled card readers haven’t removed all risk of credit and debit card fraud, they are much safer than the traditional magnetic strip method. No longer is sensitive buyer information left in the seller’s database for any employee or hacker to obtain.