Step-by-Step Guide to EMV Migration for Small Businesses
In case you haven’t heard, the EMV migration is coming. EMV is a security standard put forth by the world’s major credit-card brands, and it’s already appearing on your customers’ cards in the form of a “smart chip.” This article is intended to walk you through the steps of migrating to the new processing standard, but for more background on everything EMV, check out our EMV infographic.
As opposed to the old magnetic-stripe cards, EMV chips offer a higher degree of security throughout the transaction process, which aims to substantially reduce U.S. credit-card fraud.
In an effort to facilitate the migration, card issuers are adding incentives for small businesses that make the move. Beginning October 1, 2015, the big four credit-card brands (i.e. Visa, MasterCard, American Express and Discover) are making a “liability shift” from the credit card’s issuer (i.e. a bank or large firm) to your business in the event of certain types of credit-card fraud.
If your business doesn’t have the newer, EMV-enabled hardware installed and isn’t ready to accept EMV transactions, then your business will be responsible for fraudulent charges.
If that got your attention, and you’re looking for a one-stop shop on how to properly migrate your business to accepting EMV payments, look no further. Here are the steps to successfully migrate your business to accepting EMV payments.
1. Audit Your Hardware
Take a look at your existing payment-processing hardware. Do you have simple, stand-alone terminals? Do you have a “canned” or “drop-in” solution that works with your existing cash register or point-of-sale (POS) terminal?
Make a list of your current hardware, so you can compare apples to apples when buying new hardware.
- TIP: If you’re considering a hardware upgrade to accept mobile payments, then now might be the time to do so. Why upgrade twice in the next five years at twice the cost when you can do it once and be done?
2. Discuss Your EMV Hardware Options With Your Merchant Acquirer, Payment Processor and (If Required) Independent Software Vendor (ISV)
Your business’ merchant acquirer can help guide you to payment processors that they work with, who in turn can recommend solutions that fit your business.
If your business uses a heavily customized POS, then your ISV should be involved in any equipment purchase, as they will have an important role to play in EMV Certification.
For a complete guide on Merchant Acquirers, Payment Processors, Independent Software Vendors and the rest of EMV basics, see our EMV Essentials article.
3. Purchase Your New Hardware
This will likely be done through your payment processor or a recommended technology vendor. If you have any last-minute questions about your new hardware, these are also the parties to ask.
- TIP: Some vendors will offer “Chip-and-Signature” terminals alongside “Chip-and-PIN.” While it’s tempting to go with the signature terminal, opting for the PIN terminal helps you accept PIN purchases from international customers now and prepare for domestic PIN transactions in the future.
For a full guide on your options for EMV hardware, check out our article on what you need to know before the migration.
4. Get Your New Terminals Level 3 Certified (If Applicable)
If your payment processor is a single credit-card reader, or if it’s a “drop-in” solution meant to work minimally with your existing POS, then you may not need to perform any Level 3 certification; the payment processor and/or acquirer may have already taken care of it.
If your business has a large and heavily customized POS deployment, then your business might need to take an active role in Level 3 certification. Your merchant acquirer or payment processor should be able to tell you what you need to know. If an outside ISV programmed your POS’s retail application, then they will have a role to play in getting that application certified.
- Depending on the complexity of your payment processing system, Level 3 certification can take anywhere from two weeks to a few months.
- The cost of certification also depends on complexity, which can range from a few hundred dollars to thousands. Larger dollar amounts reflect the time and equipment needed to audit a customized or large-scale EMV deployment.
5. Train Your Employees
Once your equipment is certified, you will need to train your employees about how EMV works. Here are a few procedural things to keep in mind:
- EMV transaction amounts must be entered into the terminal before a credit card is inserted.
- For most terminals, EMV cards are inserted chip-first and chip-side up.
- EMV credit cards must remain in the terminal for the entire length of the transaction. If a card is pulled out before the transaction is completed, then the transaction is cancelled.
For more info, check out our guide to EMV transactions.
6. Know the Difference Between “Chip-and-PIN” and “Chip-and-Signature”
Most EMV markets use the Chip-and-PIN method of completing a transaction, similar to the way a debit transaction works. Most issuers in the United States, however, will be issuing Chip-and-Signature cards. With that in mind, be ready to explain the difference to your employees and customers.
- TIP: If you elect to purchase a Chip-and-PIN terminal, you will be able to process PIN transactions from international customers, as well as domestic ones when PIN cards start to hit the U.S. market. If you choose to only integrate Chip-and-Signature transactions, you may need to upgrade your equipment again when Chip-and-PIN transactions become more popular domestically.
7. Educate Your Customers on EMV
Some of your customers might have questions about how to use their cards. Since you’ve already trained your employees, your business will be in a great position to gain trust by answering your customers’ questions about EMV.
- TIP: During the Canadian EMV migration, merchants noticed that many customers accidently left their credit cards in the machine instead of removing it after completing a transaction. An informative placard near your POS terminals may help alleviate this and other issues.
In order to avoid liability for fraudulent charges, these steps must be completed by Oct. 1, 2015. Once you complete your migration, your business will be connected to the robust security network that EMV provides, which checks the validity of your customer transaction data throughout the course of the transaction.
Not only will your customers’ transactions be more secure, but EMV terminals also save your business money in the long run by being able to refuse fraudulent transactions at the source. So while the process of migrating to EMV transactions may seem tedious, it’s definitely worth your time. Check out our infographic for an easy-to-follow guide to EMV, or see our quiz to see how prepared you are for the move.
Fred Badlissi is an in-house writer and editor for Intuit. His previous experience includes years as a business journalist, covering topics like China’s ascent as a world power, the business of public and private water treatment, and the financial implications of the 2009 American Recovery and Reinvestment Act. He also edited and co-wrote The Freelancer’s Playbook.