A new service from Visa helps issuing banks get a security boost from chip-cards without the costly and time-consuming technology investments that would normally be required.
Visa cards that use the EMV chip standard have a special code called an iCVV, which is submitted with each transaction to prove the card’s legitimacy. This code serves the same purpose as the card verification value written to a magnetic-stripe card, but it has a different value — so the bank systems designed to handle regular CVVs cannot normally handle iCVVs in their place.
Visa’s iCVV Convert service, announced Monday, is designed to save U.S. banks time and money as they shift to the EMV chip-card standard that is common in other countries. Visa’s service converts the iCVV to a CVV before sending it to the issuer.
Issuing banks “don’t have to worry about the added complexity of supporting keys to generate and validate another CVV value. They can just use the same CVV system that they’re using today,” says Stephanie Ericksen, Visa’s head of authentication product integration.
“It’s faster, there’s less development time … and it’s much less expensive for them to do,” she says.
Visa is also updating its Chip Authenticate service, which validates a separate cryptogram used by EMV cards. Visa has offered a version of this service for about 10 years, and most EMV-card issuers that enroll in the service stay with it, Ericksen says.
State Employees’ Credit Union, one of the few issuers of EMV cards in the U.S., uses the Chip Authenticate service. Visa would not say which other issuers use the service. Visa requires the use of an iCVV code with EMV cards issued in the U.S.
In the past 18 months, a million Visa EMV cards have been issued in the U.S. Most EMV cards issued to U.S. citizens are offered to travelers to use in countries where the standard is widespread.
Merchant acceptance of EMV cards in the U.S. remains low. Visa has set deadlines for merchant acceptance, though merchants have expressed some concern over whether the cards will use the same level of security in the U.S. as they do overseas.
EMV cards are called chip-and-PIN cards because they are commonly used with a PIN. However, Visa and MasterCard have said that a PIN is not necessary in the U.S., and even though U.S.-issued EMV cards are meant to be used in chip-and-PIN territories, some issuers have already forgone PIN codes with their cards.
MasterCard last week issued new EMV rules that might resolve this concern. Although MasterCard does not explicitly require a PIN, it plans to enforce a “liability hierarchy” that states that the party using the least effective card-security method will pay for any fraud. This policy might push more issuers and merchants to support the chip-and-PIN approach, which is at the top of the hierarchy.
Visa’s EMV-issuance services address one of the key remaining obstacles to widespread use of the EMV standard in the U.S., says Avivah Litan, a vice president and distinguished analyst at the Stamford, Conn., market research company Gartner Inc.
“The card issuers have been very reluctant to upgrade anything with the card authorization systems and even the fraud detection,” she says, so Visa’s new services are “a big deal for the banks because they don’t want to rip anything out and modify it.”
The services also benefit Visa, and not just because they help the card network in its push for a more secure card format, she says. With Visa’s services, “it’s easier for the banks now” to issue chip cards, “but it makes them more dependent on Visa’s systems,” Litan says.