EMV Chip in the US – the Case for Offline PIN
A year ago in this column I argued that it would be unwise for the US to adopt an EMV migration strategy of deploying only “chip and signature” rather than also allowing the option of “chip and PIN”. My impression one year later is that most in the industry now accept this argument. However, the debate appears to have moved on to whether PIN verification, if used, should be “online” or “offline”. The EMV standard supports both methods. “Online PIN” involves encrypting the PIN and sending it back to the issuer for checking. “Offline PIN” involves checking the PIN against a copy stored securely on the card itself. Visa, in particular, appear to be recommending that if US issuers choose to adopt chip and PIN they should do so exclusively in terms of online PIN. This approach might have the merit of simplifying EMV migration in the US. However, on balance, I believe it to be unnecessarily restrictive; a more sensible approach would be to support both online and offline PIN.
The online-only PIN argument starts from the observation that in the US 100% of transactions are already authorised online. This is true. It is also true that in most countries which have migrated to EMV chip, the majority of transactions are now routinely authorised online by issuers, since the costs of doing so have dropped dramatically over the last decade or so. But that does not mean that these issuers rely entirely on online authentication. Instead, the majority use a rich combination of offline and online processing in order to leverage the full power of EMV chip. In particular, offline PIN verification in which the results are included in an online authorisation request is commonly deployed in chip and PIN markets.
Online PIN will remain the preferred approach in some circumstances, for example ATM transactions, for which online PIN is mandated. However, the option of offline PIN also brings many benefits. It enables secure card payments at predominantly offline POS terminals such as ticket dispensers, vending machines, parking meters or on planes, boats and trains. It means payments can be completed with strong cardholder verification when online communication with the issuer is disrupted for whatever reason. And it requires no infrastructure for encrypting and transporting PINs across the network. All these factors may become even more important as new acceptance devices are deployed in future. For example the increasing use of mobile phones adapted to act as chip and PIN POS terminals by vendors such as PayLeven and Intuit (see December’s Opinion article) means that offline PIN may be required in areas where mobile coverage is patchy or non-existent. Finally, offline PIN is already quite widely established in Europe, so US travellers risk being seriously inconvenienced if their cards support only online PIN.
Another argument in favour of offline PIN is that it enables Remote Chip Authentication (RCA) solutions such as MasterCard’s CAP or Visa’s DPA. RCA delivers strong, two-factor authentication of banking and payment transactions over the internet or telephone, using a PIN to generate a dynamic one-time-password. Migration to EMV chip is inevitably accompanied by a migration of fraud to the next weakest link, which in most countries means a big rise in card-not-present (CNP) fraud. As I’ve argued before in this column, RCA is the only really effective solution to this problem that I know of, and is now easier than ever to deploy in the form of Authentication Display Cards. There is a tremendous opportunity for the US card payments industry to embed RCA within its EMV migration roadmap from the outset, and this too, implies the need for offline PIN.
This is a complex issue which will not be resolved overnight. There are undoubtedly complications associated with offline PIN, such as the need for a PIN change/unblock facility at ATMs. On balance, however, I believe US issuers would be unwise to reject the option of offline PIN out of hand without carefully considering all the possible implications.
Nick Collin, Banking Automation Bulletin, February 2013