Maestro Europe only anti fraud measure by 23 banks in Belgium Bart Guns Global Head of Payments KBC Group COGEPS | 2-3 April 2012 Titel hoofdstuk Agenda 1.Problem 2.Anti skimming not feasible nor opportune 3.European statements 4.Chip only pragmatic issues 5.Europe only approach 6.Impact & Follow-up COGEPS | 2-3 April 2012 2 Fraud problem for debit cards abroad • Domestic debit card scheme BC/MC = zero counterfeit fraud thanks to chip & PIN • Skimming incidents on ATM’s in Belgium > Maestro fraud outside of Europe and primarily in USA • Fraudulent transactions = Magnetic stripe + PIN/signature > no liability shift allowed for USA • PSD: counterfeit fraud = Issuer’s responsibility > reimburse cardholder COGEPS | 2-3 April 2012 3 Anti-skimming not feasible nor opportune • Cost is high per ATM / Terminal and reinvestment every 3 to 5 years as solutions are being overruled • Only waterproof if majority of ATM are equipped • Time to market • Skimming migration to unattended POS (petrol stations, parkings…) and lack of anti-skimming solutions on the market >> Which optimal card approach? COGEPS | 2-3 April 2012 4 European statements (I) ECB 7th SEPA Progress Report: Cards highlights (10.2010) •From 2012 new SEPA cards by default “chip-only”, no mag-stripe payment data •Mag-stripe on request for non SEPA, not EMV regions or bank legacy functions •Liability shift should apply as incentive for EMV migration EPC EMV Fraud prevention Resolutions (2011) # 1 (Issuing) : •Restrict the use of magnetic stripe fall back to exceptional cases •Schemes to ensure through cross-regional liability shifts •Card Schemes to grant issuers option to adopt a chip only and refuse mag- stripe trx COGEPS | 2-3 April 2012 5 European statements (II) ECB at COGEPS (10.2011): Way forward (II) “Card issuers are still called on to issue chip-only cards, but as long as cards are not chip-only, they should: •not allow a fallback to magstripe within SEPA •block (by default) magstripe transactions outside SEPA* •communicate clearly on where/when/how the card can be used -------------------- * Chip-transactions outside SEPA should be possible” SEPA Council Statement of 6 February 2012 meeting …. “The SEPA Council understands that, as long as global migration to EMV-chip technology remains incomplete, card issuers may issue cards with magnetic stripe. It urges, however, card issuers and card schemes, in co-operation with payment service providers and merchants, to develop solutions to minimise the fraud related to the use of magnetic stripe as well as adequate communication strategies.” COGEPS | 2-3 April 2012 6 Chip-only approach: pragmatic issues • Requires issuance of new debit cards without or with reduced magnetic stripe > huge costs • If cardholder travels outside of EU then he has to request a second card with magnetic stripe: •Costs; • Cumbersome and not consumer friendly • Delay for delivery… • Begin 2011 some ATM/POS terminals within EU were are not yet migrated to chip-EMV > transaction in EU not always possible for cardholder • Cardholder does not know which ATM/POS terminals are not yet migrated to chip-EMV > confrontation with unexpected refusal of transaction > bad customer experience > complaints… COGEPS | 2-3 April 2012 7 Europe only approach in Belgium • Maestro function for POS/ATM per default only available in Europe region (EMV + magstripe transactions) • Cardholder can request to unblock (temporarily) for use outside of Europe region • 23 banks decided to participate with individual arrangements • As from 17 January 2011 • Compliant with Maestro Global Rules of MasterCard • Communication: • Clear communication by participating banks to cardholders compliant with PSD (2 months before introduction) • Common press release to public • No deterrence of fraud if blocking does not apply for a critical mass of cards Note 1: Maestro is the debit scheme installed on Belgian debit cards, and developed by Mastercard, which is mainly used for transactions other than domestic Note 2: no blocking for internet transactions thanks to 3D-Secure position COGEPS | 2-3 April 2012 8 Europe region defined by Mastercard: 56 countries COGEPS | 2-3 April 2012 9 Europe only approach in Belgium: Impact and follow-up 2008 2009 2010 2011 skimming cases 244 442 1.720 75 Fraud amount ? +200% +300% -94% • Drastic reduction of fraud > Remaining fraud due to: • non participating banks • period 1-16 January 2011 • non-chip/EMV terminals in Europe region (liability shift > charge back) • On average +/- 40.000 cards unblocked (temporarily) by cardholders • Concept copied by other banks abroad • No opposition by BE national competition authority > recognised that joint action was indispensable to result in deterrence of faudulent activity COGEPS | 2-3 April 2012 10.