PayPass – EMV Paving its Way into RFID

By Andreas Lübeck, ACG Identification Technologies GmbH

Much is being written these days about the Europay MasterCard Visa (EMV) migration from magnetic stripe credit cards to contact based smart cards with a PIN. An increasing volume in transaction fraud was the initial motivation to introduce a more secure technology. MasterCard and VISA had defined deadlines when liability for fraudulent card transactions would pass to the party that is not EMV compliant. Thus card issuers, acquirers and merchants need to adopt the new technology quickly to avoid bearing the cost for fraud.

Advantages of the EMV migration

Transaction security might be the most obvious, but certainly not the only advantage offered by smart cards: The card issuer can store a profile on the chip containing a predefined set of risk parameters. This profile may be tailored to the specific card scheme issued or to the individual cardholder and can be maintained even after card issuance. Additional applications can be run with the card such as loyalty, customized offers at point-of-sales or even e-commerce and Public Key Infrastructure (PKI). Value-added applications on a smart card deployed with co-issuers reduce the total cost of ownership and allow a faster return on investment.

Disadvantages

But as everything in life, the EMV migration not only entails advantages; there are some obstacles to it, as well.

The most important obstacle is the PIN card holders are required to enter while making a payment. Given the number of PINs one needs to keep in mind nowadays, the card holders may be unsure of their credit card PIN and prefer to pay by a non-EMV debit card or by cash. This effect may cause a downturn in credit card transactions. Banksys of Belgium, for example, reported only 706,300 transactions in 2004 for 2.2 million EMV credit cards issued.

PayPass

At the same time, contactless payment schemes such as MasterCard PayPass allow a fast and convenient transaction. There is no need to swipe or insert a card into a reader, no need to enter a PIN or to sign a credit card slip. A user would simply “tap & go” as MasterCard branded the procedure. A trial in Orlando, FL, started in 2003 with 16,000 cards and 61 retail locations, proved that PayPass transactions were significantly shorter than other payment solutions. Besides, the participating sites experienced an increase in spending and a higher frequency of use.

How about the implementation?

PayPass has been deployed in volume since 2005. According to estimates of silicon suppliers and card manufacturers, PayPass will score a number of 50 to 70 million cards by next year. But the new technology poses an important challenge for card and reader manufacturers. The need to exchange existing or to install completely new reader infrastructures sets a high entry barrier for merchants. Consequently, readers are developed which just piggyback on the existing mag stripe devices. All components and products require respective approvals from MasterCard for security, functionality and quality. Manufacturers are to obtain certifications on their IT and site security. New tasks include antenna design and contactless card production. The initialization and personalization of the embedded microcontroller chip require new skills from suppliers of conventional mag stripe cards—particularly as all communication with the chip uses an RFID interface. Last but not least, open payment schemes such as PayPass require a perfect interoperability between different chip types, operating systems, the on-chip payment application and readers—requirements that are similar to those of state-of-the-art government ID applications as for example electronic passports.

PayPass and similar schemes are becoming more and more popular; there obviously is a market for non-ISO format cards such as the trendy MasterCard MC2, key fobs and other form factors.

An art director of a US-based card manufacturer said with a wink: “I hate ISO. It limits my creativity.” This might be taken as an indicator for the bright future of contactless objects in the payment market.

After all, and given the limited acceptance of e-purses in Europe—only 0.1% of cash in circulation or 0.92 ($1.19) per inhabitant are represented by electronic money—we can expect that the success of contactless credit card payment will soon be continued even there.

MasterCard and PayPass are registered trademarks of MasterCard International Inc. MC2 is a trademark of MasterCard International Inc.

VISA is a registered trademark of Visa International in the United States and other countries.