In January 2005, retailers which accept face-to-face credit and debit card payment will be liable for any fraudulent use of a card in their shop. In other words, they will lose their charge back rights.
To give some idea of the scale of this, there are 100 million cards out there and UK issuing banks incurred £411m of card fraud in 2001, up 30% on the previous year. About half of this occurs when a UK-issued card is used fraudulently abroad. This leaves UK retailers exposed to £200m of liability.
To ensure the cost of this fraud does not fall on them retailers need to install chip and PIN technology at their tills. This reads the new chip-based cards which will be issued to all cardholders by the banks. About 40 million of Europe's 180 million cards have so far been converted to EMV (Europay Mastercard Visa), the standard chip and PIN system that is set to be adopted worldwide.
The British Retail Consortium estimates the cost of moving to chip and PIN to be £350m and the worry is that as the big players invest in such technology, smaller retailers will find fraud migrating to them.
As Nick Mourant, Tesco divisional director, Treasury, says: "We've got the situation where the weakest retailers could end up with this £200m liability. Think about that cost coming to you."
But grocery retailers are not prepared. David Figg, IBM retail consultant, retail store solutions, reckons 80% of grocers have not reached the stage they should be at, some burying their heads in the sand, hoping the banks will change their minds.
Waqar Qureshi, vice-president of Visa International EU, says: "It's been one and a half years of struggle, but people now realise there is no saying no'. D-day is only 25 months away."
This may seem a long way off, but chip and PIN implementation involves an investment that could run into millions of pounds. And, if you consider the typical IT roll out programme takes nine months as time is needed to choose a solutions provider and undergo tests before roll out, the timeframe rapidly shrinks when Christmas 2002 and 2003 and Easter 2003 and 2004 are taken out of the equation. Peter Forbes, Marks and Spencer manager, store financial operations, warns: "If you do not have an implementation plan in place now, it is getting very late."
In the UK, 4.5 million point of sale terminals are rented from banks, mostly those in stores run by small independent retailers. In this case the banks will be upgrading the equipment themselves. But 1.5 million till systems are owned by larger retailers and these account for a disproportionate amount of transactions 65% of all sales volume. Here the responsibility for implementing a chip and PIN solution falls on the retailer.
How the technology works
So what is chip and PIN all about? It is a computerised chip on all credit and debit cards with an encoded dedicated personal identification number (PIN). Replacing the magnetic stripe, this chip eliminates what is known as skimming, producing a counterfeit card. Skimming is responsible for 80% of card fraud.
To take payment from a chip card, retailers add a bit of kit to their EPoS system into which the card is dipped and chip read. To combat the remaining 20% of fraud from lost and stolen cards, a PIN pad is required whereby customers at the till enter a PIN known only to them. The timetable for banks releasing these PINs has not yet been confirmed.
Of the retailers contacted by The Grocer, only Safeway, Tesco, Marks and Spencer and Spar seem to be anywhere near ready for the 2005 date.
Safeway was first, with reports putting its investment at £15m. It has opted for an integrated terminal and PIN pad solution from IBM using Ingenico hardware and STS software. The cashier looks at every card and those that are chip enabled are put in the device and stay there until their chip is read. At the moment customers still need to sign but when the banks have issued PINs they will tap their number into the reader.
Others are choosing to go for swipe and park' devices where the card is swiped in the same way as a magnetic stripe card and then parked in the base where the smartcard reader is found. The PIN pad is a separate device, often added at a later stage. Some retailers choose this route because, although it requires two technology roll-outs, they believe it will be easier for staff training.
But Safeway business systems manager Jeremy Wyman says: "We wanted a combined unit from day one and decided our cashiers are capable of working out whether a card has a chip."
According to Wyman more than 30% of cards going through the tills so far have chips, "a lot higher than we expected".
He says there has been very little difference in time spent at the cashdesk and that, as the system is so easy to work, it took little training for staff to be able to use it. Eventually customers will put their own card in the reader.
However, Tesco's Mourant believes transaction times will increase when it rolls out its swipe and park system from next April. He estimates that authentication will take three seconds longer with the chip-only system, taking total transaction time from 25 to 28 seconds. "Every second we hold our customers up at the checkout is a £1m to £2m overhead," he says. When PIN is added later the time will be reduced back to 25 seconds.
Tesco, which takes about 10% of total UK transactions through its 18,000 tills, loses £6m a year through card fraud and has one million card customers a day spending £10bn a year. It has chosen a system from Wincorp Nixdorf following its use in test stores. Mourant says implementation will cost about £350 per checkout lane for hardware and "millions" for software.
Spar IT controller Roy Ford says he is close to making a decision on a solutions provider for its 600 independents with Streamline standalone machines and is about to sign a contract for its 1,400 stores which run their own EPoS system with integrated electronic funds transfer.
"I can assure all our retailers that we will be EMV compliant by 2004," he says, echoing concerns of a bottleneck towards the end of 2004 when everyone seeks approval testing.
With only Safeway having completed a roll out the clock is ticking away. Visa's Qureshi says: "Nobody has done this before. It is not written on a recipe card." And Tesco's Mourant warns his trials have thrown up a number of issues. "Don't underestimate how long it takes. There are significant problems with things like bugs.
"In an 18-24 month period, to move from kicking off to roll out is going some."
>> How will the shake-up affect you and your business? Let us know your views by emailing your letters to grocer.letters@william-reed.co.uk
{{ANALYSIS }}
To give some idea of the scale of this, there are 100 million cards out there and UK issuing banks incurred £411m of card fraud in 2001, up 30% on the previous year. About half of this occurs when a UK-issued card is used fraudulently abroad. This leaves UK retailers exposed to £200m of liability.
To ensure the cost of this fraud does not fall on them retailers need to install chip and PIN technology at their tills. This reads the new chip-based cards which will be issued to all cardholders by the banks. About 40 million of Europe's 180 million cards have so far been converted to EMV (Europay Mastercard Visa), the standard chip and PIN system that is set to be adopted worldwide.
The British Retail Consortium estimates the cost of moving to chip and PIN to be £350m and the worry is that as the big players invest in such technology, smaller retailers will find fraud migrating to them.
As Nick Mourant, Tesco divisional director, Treasury, says: "We've got the situation where the weakest retailers could end up with this £200m liability. Think about that cost coming to you."
But grocery retailers are not prepared. David Figg, IBM retail consultant, retail store solutions, reckons 80% of grocers have not reached the stage they should be at, some burying their heads in the sand, hoping the banks will change their minds.
Waqar Qureshi, vice-president of Visa International EU, says: "It's been one and a half years of struggle, but people now realise there is no saying no'. D-day is only 25 months away."
This may seem a long way off, but chip and PIN implementation involves an investment that could run into millions of pounds. And, if you consider the typical IT roll out programme takes nine months as time is needed to choose a solutions provider and undergo tests before roll out, the timeframe rapidly shrinks when Christmas 2002 and 2003 and Easter 2003 and 2004 are taken out of the equation. Peter Forbes, Marks and Spencer manager, store financial operations, warns: "If you do not have an implementation plan in place now, it is getting very late."
In the UK, 4.5 million point of sale terminals are rented from banks, mostly those in stores run by small independent retailers. In this case the banks will be upgrading the equipment themselves. But 1.5 million till systems are owned by larger retailers and these account for a disproportionate amount of transactions 65% of all sales volume. Here the responsibility for implementing a chip and PIN solution falls on the retailer.
How the technology works
So what is chip and PIN all about? It is a computerised chip on all credit and debit cards with an encoded dedicated personal identification number (PIN). Replacing the magnetic stripe, this chip eliminates what is known as skimming, producing a counterfeit card. Skimming is responsible for 80% of card fraud.
To take payment from a chip card, retailers add a bit of kit to their EPoS system into which the card is dipped and chip read. To combat the remaining 20% of fraud from lost and stolen cards, a PIN pad is required whereby customers at the till enter a PIN known only to them. The timetable for banks releasing these PINs has not yet been confirmed.
Of the retailers contacted by The Grocer, only Safeway, Tesco, Marks and Spencer and Spar seem to be anywhere near ready for the 2005 date.
Safeway was first, with reports putting its investment at £15m. It has opted for an integrated terminal and PIN pad solution from IBM using Ingenico hardware and STS software. The cashier looks at every card and those that are chip enabled are put in the device and stay there until their chip is read. At the moment customers still need to sign but when the banks have issued PINs they will tap their number into the reader.
Others are choosing to go for swipe and park' devices where the card is swiped in the same way as a magnetic stripe card and then parked in the base where the smartcard reader is found. The PIN pad is a separate device, often added at a later stage. Some retailers choose this route because, although it requires two technology roll-outs, they believe it will be easier for staff training.
But Safeway business systems manager Jeremy Wyman says: "We wanted a combined unit from day one and decided our cashiers are capable of working out whether a card has a chip."
According to Wyman more than 30% of cards going through the tills so far have chips, "a lot higher than we expected".
He says there has been very little difference in time spent at the cashdesk and that, as the system is so easy to work, it took little training for staff to be able to use it. Eventually customers will put their own card in the reader.
However, Tesco's Mourant believes transaction times will increase when it rolls out its swipe and park system from next April. He estimates that authentication will take three seconds longer with the chip-only system, taking total transaction time from 25 to 28 seconds. "Every second we hold our customers up at the checkout is a £1m to £2m overhead," he says. When PIN is added later the time will be reduced back to 25 seconds.
Tesco, which takes about 10% of total UK transactions through its 18,000 tills, loses £6m a year through card fraud and has one million card customers a day spending £10bn a year. It has chosen a system from Wincorp Nixdorf following its use in test stores. Mourant says implementation will cost about £350 per checkout lane for hardware and "millions" for software.
Spar IT controller Roy Ford says he is close to making a decision on a solutions provider for its 600 independents with Streamline standalone machines and is about to sign a contract for its 1,400 stores which run their own EPoS system with integrated electronic funds transfer.
"I can assure all our retailers that we will be EMV compliant by 2004," he says, echoing concerns of a bottleneck towards the end of 2004 when everyone seeks approval testing.
With only Safeway having completed a roll out the clock is ticking away. Visa's Qureshi says: "Nobody has done this before. It is not written on a recipe card." And Tesco's Mourant warns his trials have thrown up a number of issues. "Don't underestimate how long it takes. There are significant problems with things like bugs.
"In an 18-24 month period, to move from kicking off to roll out is going some."
>> How will the shake-up affect you and your business? Let us know your views by emailing your letters to grocer.letters@william-reed.co.uk
{{ANALYSIS }}
No comments yet