New EPC Resolution – “Preventing Card Fraud in a Mature EMV Environment”

February 3, 2011 – Card fraud prevention represents an opportunity to save or reduce the more than 1.5 billion euro annual costs faced by the European card payment industry. This figure does not include all the direct and indirect costs resulting from managing fraud-related issues nor does it reflect the negative impact on the image of the banks.

In light of these facts, the EPC plenary is requested to approve a new Resolution „Preventing Card Fraud in a Mature environment” which has been extensively discussed with various market participants.

Resolution # 1: Limiting the potential impact of an incomplete migration to EMV outside SEPA on SEPA issuing

For markets that have started their plans for a mature EMV environment, the implementation of the liability shift should be effective at the latest by end-2015. For other markets, the implementation of this Resolution rests on the persuasion power of European regulators (ECB, EC) and the action of EU Banks with global presence.

Resolution # 2: For Card-Not-Present environments (“e-Commerce”, “Mail Order”, “Telephone Order”) EPC recommends that cards schemes and their members implement within SEPA the following measures: (to progress on security, pending further dialogue and indications from Authorities)

E-Commerce on the issuing side:

Resolution # 2.1: Issuers and card schemes shall evidence at the latest by end 2013 that appropriate authentication solutionsat equivalent level of security are in place,

Such authentication solutions could be:

• Risk-based authentication

• Challenge-response mechanism

• Dual channel authentication such as SMS

• Hardware based authentication such as a token or chip reader

• Virtual cards

• Or any innovative solutions considered effective by payment schemes

The above should be combined with appropriate risk management tools.

E-Commerce on the acquiring side:

Resolution # 2.2: Stakeholders shall evidence at the latest by end 2013 that they are able to support such authentication solutions on the acquiring side.

Download the full document here