Retailers Prepare for EMV Deadline

Retailers can keep customer data safe and also protect themselves against fraud-related losses by complying with PCI Data Security Standards, including the October 2015 deadline for U.S. retailers to accept cards with Europay, MasterCard and Visa (EMV)-compliant chips, advised Bob Russo, general manager, PCI Security Standards Council.

After the deadline passes, retailers, rather than financial institutions and card issuers, will be wholly responsible for any fraud resulting from a transaction with an EMV-compliant payment card if they do not have the proper equipment to process it according to EMV standards.

“We believe businesses following our standards as the basis for their security programs are best positioned to keep their customers’ card data safe,” said Russo. “Our focus continues to be around taking the feedback we get from all of our constituents, including banks and retailers, and using it to continue to develop and update standards that organizations across industries and geographies can use as the baseline of security controls for protecting their card data.”

The latest forecast suggests that about half of retailers will meet the deadline. According to the Payments Security Task Force (PST), at least 47% of U.S. merchant terminals will be enabled for EMV chip technology by the end of 2015. Some big retailers already have the required chip-based hardware in place. Walmart’s entire network of U.S. stores will be ready to accept EMV cards by the end of this year.

According to Russo, data security standards continue

to evolve to better meet the needs of retailers.

“For example, based on this input, PCI Data Security Standard (PCI DSS) version 3.0 updates address key challenge areas, such as lack of education and awareness, passwords and third-party security, with changes aimed at providing the right balance of flexibility, rigor and consistency in the standard to help organizations make payment security part of their business-as-usual activity,” he added.