Chip and PIN Nigel Dudley Consultant, Group IT LTSB Chip Development

Chip and PIN
Nigel Dudley
Consultant, Group IT
LTSB Chip Development
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 1
Topics to be covered
• Why Chip and PIN ?
• UK Chip and PIN Project
• EMV Smart Card Basics
• Project Considerations
• Main Issues
• Initial UK Trial Findings
• Where Next For Chip ?
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 2
Why Chip and PIN
• Fraud had hit £400m (570m€) + per year in early 90’s
• Card copying (skimming)
• Lost & Stolen
• Mail Order/Telephone Order
• APACS Committee (PFPF) looked at ways to reduce
Fraud
• Reduced Floor Limits in some Merchant sectors
• Established a project to look at above areas
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 3
Why Chip and PIN
•
EMV Specifications being developed at the same time
•
A set of Chip specifications devised by the major Card
Schemes Europay, MasterCard and Visa (hence EMV)
• Defines how Terminals and Cards interact with each
other for Payments, including Security
• Initial workable version EMV 3 (EMV96) issued in 1996
• EMVCo established in late 90’s as an admin body to
maintain the specifications and monitor Terminal
Certifications (Type Approvals) via Labs
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 4
Why Chip and PIN
• Card Authentication (CAM)
• UKIS Implementation Guide developed for EMV Specs to
define Data on Chip
• Use Cryptograms to :
• Validate Card was issued by Issuer
• Validate that card has talked to correct Issuer
•
Combats Card copying (skimming)
• Chip not so easy to duplicate
•
Implemented in May 1997
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 5
Why Chip and PIN
• Main problems
• Lack of Merchant Acceptance devices
• Specs not developed until late
• EMV2000 more fully defined this
• Limited Card & Terminal Interoperability checks
• EMVCo established in late 90’s to maintain the
specifications and monitor Terminal Certifications
(Type Approvals) via Labs
• Needed widespread deployment of Terminals
• Large Merchants would not pay for development
until Cardholder could be verified
• Chip and PIN project established in the UK
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 6
UK Chip and PIN project
• Established to enable Verification of the Cardholder (CVM)
• PIN Chosen over biometrics
• More familiar and acceptable to customers
• Cheaper to implement
• More widespread use in Europe, particularly France
• Biometrics technology not considered mature
• Offline PIN chosen so eventually Communication costs
could be reduced - Overall Authorisation Strategy
•
All UK Issuers and Acquirers involved in Project
•
Scheme Liability Shift to non-Chip party from January
2005 was an incentive to get project moving
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 7
UK Chip and PIN project
• Foundations set at all Bank meetings at APACS
• Merchant organisation involvement essential to
success of project, particularly BRC
• Independent Project structure established to include
APACS and BRC
•
Project Management Organisation (PMO) administered by
third party Management Consultancy company
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 8
UK Chip and PIN project
• Trial/Pilot would be established
• Northampton, a town in Central England, chosen
• Aim would be to :
• Learn Customer experiences
• Learn Retailer experiences
• Test out Marketing and Communication
• Prove the Technology
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 9
UK Chip and PIN project
MIGRATION COMPLEXITY
•
•
•
•
‘Bigger than decimalisation’
Change the day-to-day behaviour of 40 million cardholders
Train 1.5 million POS Staff
Upgrade
– 120 million cards
– 850,000 POS terminals
– 40,000 ATMs
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 10
UK Chip and PIN project
• Many impacted areas
Card Issuing and associated systems
POS devices
ATM devices
Marketing and communications
Operational support
Customer & Merchant support areas
Retail staff support areas
Training
Suppliers and supplier Interfaces
Scheme Interfaces/Requirements
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 11
EMV Overview
Terminal
Data
Card / Terminal
Interface
Card
Personalisation
PIN Pad
Card
Application
Terminal
Application
Any
Brand
Payment
Scheme
Networks
PIN
Management
Term
inal / Host
Protocol
Transaction Data
Issuer
Host
Transition
Activation
Acquirer
Host
Card Data
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 12
Lloyds TSB Project
•
9.5 Million Visa Debit cards
•
6 Million Visa and MasterCard Credit Cards
•
Approx. 4400 ATM’s
•
43,000 Merchants
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 13
EMV / Smart Card Basics
Ultraviolet
Marking
Holograms
Name & Acct No
CVV
Name & Acct No
CVV
Exp Date
PIN Info
Service Code
Proprietary
Track 1
Track 2
Track 3
VISA
FIRST DATA BANK
4987
4987
Valid
03/ 00
From
4089 0086 2385
Expires
End
CVV2
(indent)
Authorised Signature
VISA VISA VISA VISA
5689VISA
568 VISA VISA VISA VIS
VISA VISA VISA VISA VISA VISA VISA VISA VISA
ISA
VISA VISA VISA VISA VISA VISA VISA VISA
Your First Data Card can be
used to pay for goods or
services wherever the VISA
symbol is displayed.
Telephone 0800 123 123
24hrs
12/ 02 V
A N OTHER
Chip
21st September 2004
Signature
£50
Photocards
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 14
EMV / Smart Card Basics
VISA
What is a Smart Card ?
FIRST DATA BANK
4987
4987
Valid
03/ 00
From
4089 0086 2385
Expires
End
12/ 02 V
A N OTHER
A plastic card with a chip on its shoulder!
Has processing intelligence to make decisions.
Contains digital keys, making it uneconomical to counterfeit.
Supports multiple applications.
Has a long life expectancy.
Contact or contactless
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 15
EMV / Smart Card Basics
Chip Card with gold plated contacts removed
Contact Points
Recess milled
into the plastic
Conductive Micromodule
(removed from card in photo)
Epoxy
21st September 2004
Integrated
Circuit, or ‘chip’
Wire
Bond
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Contact
Pad
Page 16
EMV / Smart Card Basics
VISA
VISA
FIRST DATA BANK
FIRST DATA BANK
4987 4089 0086 2385
4987
Valid
From 03/ 00
Expires
End
4987 4089 0086 2385
4987
Valid
03/ 00
From
12/ 02 V
A N OTHER
Expires
End
12/ 02 V
A N OTHER
Contact Only
Contact &
Contactless
VISA
FIRST DATA BANK
4987 4089 0086 2385
4987
Valid
From 03/00
Expires
End
12/02 V
A N OTHER
Contactless Only
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 17
EMV / Smart Card Basics
Multi-App O/S, O/E
Proprietary Fixed O/S
Proprietary Fixed O/S
App Selection
App Selection
EMV
EMV
ID
App Selection
Multi-App Security
EMV
ID
?
Chip
Chip
Chip
Single Function
(Fixed)
Multi Function
(Fixed)
Multi Application
(Dynamic)
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 18
?
Project Requirements
• Card Personalisation
• Customer PIN Management
• Key Management
• ATM software/Host Systems
• POS Terminal Software/Third Party Suppliers
• Card Management Systems
• Credit Card Issuing
• Communications
• Training (Branches, Staff and Merchants)
• Operational Reports
• Script Processing (Dynamic Card Updates)
• Management Information (Critical Success Factors ?)
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 19
Project Requirements
Card Personalisation
•
•
•
•
21st September 2004
Determine Base Application requirements
(VSDC, M-Chip, Globalplatform/Multos etc;)
• Scheme Requirements
• Ensure scheme certified mask
Agree Chip Parameters
• Scheme Requirements/Recommendations
• Local market conditions
Agree stock requirements with Supplier
Migration to new Application (eg : from UKIS)
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 20
Project Requirements
Card Personalisation
• Used two suppliers
– SchlumbergerSema
– Gemplus
• Suppliers OS’s are different so
– Each needs to be tested
– Need Personalisation specifications agreed
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 21
Project Requirements
Card Personalisation
• Chips supplied by Manufacturer such as
Hitachi or STS Thompson
• Cards produced and O/S loaded by Supplier
such as Gemplus or SchlumbergerSema
Personalised by Bureau with settings specific
to Issuer (i.e. Bank)
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 22
Project Requirements
Card Personalisation - Parameters
• Issuer Parameters on card to make Auth decisions
– Issuer Action Codes
– How the card should react to various conditions
•
•
•
•
If PIN is incorrect
over floor limit
Key check Failures (Data Authentication)
Over 20 parameters
– Allow authorisation offline or go online
– CVM List
• Allow offline PIN, online PIN, signature and in what order
• Others possible in future (eg : Various Biometrics)
– Application version to use
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 23
Project Requirements
Card Personalisation - Parameters
• Issuer Parameters on card to make Auth decisions
– Counters
•
•
•
•
LCOL – Number of transactions before going online
UCOL – Number of transactions before have to go online
ATC – Incremental Counter to protect against copied cards
PIN Try Counter & Limit – Number of incorrect attempts allowed
before card is blocked
• Cumulative Transaction Amounts – Amounts allowed before going
online – Can operate in an additional currency
– Keys
• Data Authentication
• Cryptogram generation and verification
• Mac keys for Card Updates (scripts)
– Cryptogram data
• Fields to be used
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 24
Project Requirements
Script Processing (Dynamic Card Updates)
•
Fraud Prevention
• Block Card/Application
• Unblock ?
• ATC Checks
•
Credit Control
• LCOL/UCOL
• Cumulative Limits
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 25
Project Requirements
Customer PIN Management
•
21st September 2004
Education/Communication for customers important
• Customers will forget PIN
• PIN reminders/reissue - timing
• PIN Bypass
• PIN Change (Required in UK)
• Customers will lock PIN
• Card reissue - Expensive ?
• Provide Unlock facility
• PIN Management Services (On-Us, Reciprocal)
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 26
Project Requirements
Key Management
•
RSA Keys
• SDA or DDA
• Scheme Public Keys
• Card Private Keys
•
DES Keys
• Cryptogram Calculations
•
•
Interface to Card Personalisation and Authorisation systems
Area where a small mistake can be costly (financial and
reputational)
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 27
Project Requirements
• System Set Up : ATM
Visa
ATM
ATM
Acq
Txn
Switch
Other
Mcrd
Issuers
ATM
LINK
Own
Debit
21st September 2004
Own
Credit
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 28
Project Requirements
• System Set Up : POS
Own
Cards
Visa
Retailer
System
POS
Acquirer
Mcrd
Others
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 29
Project Requirements
• System Set Up : Debit Card Issuing
Any Bank
POS
Acquirer
VISA
FIRST DATA BANK
4987 4089 0086 2385
4987
Valid
From 03/ 00
Expires
End
12/ 02 V
Visa
Txn
Switch
A N OTHER
VISA
FIRST DATA BANK
4987 4089 0086 2385
4987
Valid
From 03/ 00
Expires
End
12/ 02 V
A N OTHER
Foreign
ATM
VISA
FIRST DATA BANK
4987 4089 0086 2385
4987
Valid
From 03/ 00
Expires
End
12/ 02 V
A N OTHER
21st September 2004
UK
ATM
Debit
Card System
Any Foreign
ATM
Acquirer
Any UK Bank
ATM
Acquirer
LINK
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 30
Project Requirements
• System Set Up : Credit Card Issuing
Any Bank
POS
Acquirer
VISA
FIRST DATA BANK
4987 4089 0086 2385
4987
Valid
From 03/ 00
Expires
End
12/ 02 V
Visa
Txn
Switch
A N OTHER
Own
Credit
Card System
VISA
FIRST DATA BANK
4987
4089 0086 2385
4987
Valid
From
03/ 00
Expires
End
12/ 02 V
A N OTHER
21st September 2004
ATM
ATM
Acquirer
Mcrd
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 31
Project Requirements
ATM Software/Host systems
•
•
•
Vendor ATM Software needs to be EMV Hardware (L1)
Software Level (L2) Approved
Schemes have additional requirement for end to end
Approval
• Samples of different card conditions issued globally
Host Software
• Requires Certification by Visa and MasterCard for Chip
• UK also had national scheme certification (LINK)
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 32
Project Requirements
Point of Sale (POS) Terminal/Third Party suppliers systems
•
•
•
Requirements similar to ATM
Terminal needs to be Level 1 & 2 Approved by vendor
Additional scheme Testing required for every different
end-to-end combination
• Can make IPOS/EPOS merchant implementations
costly on internal resources.
• However, essential for global interoperability
•
Host Software
• As ATM, requires Certification by Visa and
MasterCard for Chip (Auth & Clearing)
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 33
Project Requirements
Card Management systems
•
Decide which Chip parameters are fixed
•
Provide flexibility of those that are not
•
Provide interface to Card Personalisation
•
‘Hard code’ scripts or interface to separate Script Manager
•
If Multi Application, introduce Application Manager or
configure Card Management ?
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 34
Project Requirements
Credit Card Issuing
•
Third Party processor (FDI) used for this in our case
•
Processor has to provide Requirements for many customers
•
Need to Ensure flexibility to cover all Requirements
•
From Bank perspective, has to be managed as separate
project
• From a Card perspective, Credit and Debit parameters
initially similar
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 35
Project Requirements
Communications
•
•
•
•
•
21st September 2004
Some handled centrally by PMO
To selected customers chosen by each Issuer for
Northampton pilot
Separate communications for these customers to
general mailing
PIN Mailers - Changed to A4 to provide more info
Merchant Communications
• Verbal initially and then by letter
• Handhold Trial merchants - lessons for
Merchants and Acquirers
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 36
Project Requirements
Training
•
Staff
• Call Centres
• Branch Training - initially in Trial area
• Operational - Extra information on reports
•
Merchant
• Need good operating Guide for Stand alone terminals
• Generally Merchant responsibility but key to project
success
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 37
Project Requirements
Operational Reporting
•
•
•
•
21st September 2004
Additional Transactional information available
• Allows better understanding of what happened
Ongoing monitoring
Education required in this area as well
Key challenge is to translate Technology into
easily understood language
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 38
Project Requirements
Management Information
•
Centrally agreed reports for monitoring Trial
• Measure Critical Success Factors
•
Internally defined MI
• Analysis of Trial
• Ongoing information required to
• Monitor growth of usage
• Effectiveness of Fraud reduction
• Effectiveness of Credit Control
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 39
Main Issues
•
•
Customers without PINs
PIN Unlock/Change - Customer Education
•
PIN Bypass
•
SSP barring during renewal
•
Position of activity stickers
•
ATM Fallback
• Scheme Approvals
•
21st September 2004
Static Data Authentication (SDA) Failures
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 40
Position – end July
•
•
Card Issue – 40.3m cards
Retailer rollout – 6 major fully rolled out
• 17 in Pilot or rollout
•
67.5% of all cards by end Dec 04
•
PIN Management widely available in UK
• 75.2% transactions by end 2004
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 41
Initial UK Trial findings
• Most customers positive about it
• No concern from retailers on transaction timings
• Some confusion over who puts card in reader
• Some POS devices have no shield
• PIN Bypass high
• Some retailers asking customer to sign after inputting PIN
• Any other views ?
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 42
What next for Chip ?
•
Mail Order/Telephone Order/Internet
•
Authenticator
•
•
Loyalty/CRM (Customer Relationship Management
Authorisation Strategy
•
•
•
Infrastructure for next steps
•
•
•
21st September 2004
Look at effect of Chip on transaction profiles
Reduce online Transactions
Script Processing / Dynamic updating
Multi Application
Application Management
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 43
Thank you for listening
ANY QUESTIONS ??
email : [email protected]
21st September 2004
Nigel Dudley, Consultant, Group IT
LTSB Chip Development
Page 44