Article

Chargeback liability set to return for low-ticket cashless transactions: Are you prepared?

Card issuers agreed this past summer to postpone EMV liability for transactions under $25, but when the liability starts to take effect again next year, merchants that have not deployed EMV-compliant systems will once again face chargebacks.

November 23, 2016 by Elliot Maras — Editor, Kiosk Marketplace & Vending Times

This past summer, merchants handling low-value payment card transactions caught a break when card issuers agreed to postpone the EMV liability for transactions under $25. When payment card liability shifted to the non-EMV-compliant party in Oct. 2015, non-compliant merchants got socked for chargebacks on purchases card issuers deemed fraudulent. Previously, card issuers covered card fraud losses.

The non-EMV-compliant chargebacks were especially troublesome for merchants selling low-ticket items since the fees card issuers charged for fraudulent purchases were oftentimes excessive in relation to the actual purchases.

Card issuers agreed this past summer to postpone EMV liability for transactions under $25, but when the liability starts to take effect again next year, merchants that have not deployed EMV-compliant systems will once again face chargebacks.

"We expect that grace period will be lifted in the middle of next year," said Greg Burch, vice president of strategic development at Ingenico Group, a payment equipment manufacturer. "There will be a lot of experiments with kiosks with fraudulent cards."

The problem is especially severe for unattended transactions since persons using fraudulent payment cards are more likely to target unattended sites.

"Unattended is likely going to be hit first as a test environment," Burch said. "Unattended, there’s nobody there to monitor fraud. Kiosk is arguably an opportunity for somebody who has a fraudulent card to test it. They can test it at a kiosk to see that it works before going to a merchant where there might be an attendant. Since it’s unattended, once they know a fraudulent card works, they tend to use it a few times."

Fraudulent card payments are a problem for all cashless payment merchants, not just those handling small-ticket transactions. EMV technology was developed to prevent fraudulent payments. EMV-enabled cards contain a computer chip that is activated and read when inserted in the card reader or tapped for contactless acceptance.

But the switch to EMV-compliant readers has taken longer than expected due to the cost and complexity of integrating the equipment with the software, Kiosk Marketplace reported recently. The unattended retail sector has been especially slow to invest in EMV-compliant readers.

Card issuers postponed EMV liability for low-value transactions last summer after realizing a large number of chargebacks were occurring on low-value transactions. American Express reported that 40 percent of its EMV-related chargebacks were for purchases under $25.

Statistics are hard to come by, but industry observers believe a large amount of unattended cashless sales fall under $25.

Hazelton Capital Partners, citing information from USA Technologies Inc., a payment technology service provider of integrated cashless and mobile transactions in the self-service retail market, reported in the third quarter that the average cashless transaction from its point-of-sale units was $1.90.

One merchant’s experience

Company Kitchen, a Merriam, Kansas-based operator of micro market kiosks and vending machines, began noticing chargebacks last fall on both kiosk and vending machine card purchases in their billing statements, according to Jim Mitchell, chief information officer at Company Kitchen.

Whenever a consumer called the bank that issued the credit card to question a charge from one of Company Kitchen’s machines, the bank credited the consumer the charge, then charged Company Kitchen $25 – regardless of the purchase amount – for every charge made to that card for the month.

Company Kitchen was able to get its credit processor, Heartland Payment Systems, to withhold its portion of the chargeback, which cut the chargeback from $25 to $7, Mitchell said.

Company Kitchen removed the card readers from machines where chargebacks occurred.

The company has not yet installed EMV-compliant readers, Mitchell recently told Kioskmarketplace. The chargeback problem has not been significant since the processor removed their portion of the chargebacks. "In terms of the amount of dollars we’re processing in credit cards now, it’s not even a tenth or a hundredth of a percent," he said.

But as already noted, the problem was severe enough to convince the card issuers to place a moratorium on small ticket liability charges. Effective July 22, 2016, Visa announced it would block all U.S. fraud chargebacks under $25. American Express made the same policy effective in August.

"This was a really big problem," said Burch at Ingenico Group. The merchants suffered chargebacks for fraudulent low-ticket purchases from October 2015 to July and August 2016 when most card issuers lifted the liability requirement.

"If the chargeback occurred, the vending operator not only lost a dollar (for the purchase amount), but they were fined $30," Burch said.

"That made this situation really urgent for vending operators and kiosk operators, for low-dollar purchases in particular," Burch said. "We did see it for high-dollar items as well, but the newsworthy item was really the low-dollar area." This is because low-ticket purchases were incurring hefty fines.

Burch said snack machines were among the most frequent targets. "Some vending operators didn’t understand what was happening," he said. "There was some research that had to happen with their card processor."

Stored-value cards cause chargebacks

Kiosks that dispensed closed-loop, stored-value cards experienced a spike in non-EMV chargebacks, said Rob Chilcoat, president of operations at UCP Inc., an EMV compliance consultant that assists companies with EMV migration.

Unscrupulous customers would top up their stored value card, use the machines, then report their card stolen or deny they had used it. The card issuer would then charge the merchant for the purchase for not having an EMV-compliant machine.

Unattended machines will face serious chargebacks when the small-ticket EMV compliance requirement takes effect beginning next year, Chilcoat agreed.

"Card theft and skimming is a rampant problem in the United States," he said.

Kiosk operators are at risk

"You’re welcome to operate without EMV compliance, but it’s purely your risk," said Paul Burden, director of software at Meridian Kiosk. "Before the liability shift, the credit card companies covered the fraud. A non-EMV transaction is now your responsibility as the merchant."

Burden remembers when the liability shift occurred in Canada several years ago. The government automobile license agency had to stop using self-serve license renewal kiosks because the machines were not EMV-compliant and card skimming became rampant.

"Skimmers" would skim a card’s magnetic data and make a duplicate card that non-EMV-compliant readers would accept. When a card is run through a skimming device, the device captures the data stored in the card's magnetic strip. The stolen data can then be used to make fraudulent charges either online or with a counterfeit payment card.

Without the EMV technology, criminals were able to use cards with skimmed data to renew licenses at government kiosks.

The government eventually shut down all 72 kiosks in Ontario after financial institutions alerted police of potential debit and credit card skimming.

The government chose not to retrofit the machines with EMV technology because of the cost and decided to end the kiosk program, according to The Brampton Guardian in Brampton, Canada. It estimated closing the kiosks would save taxpayers about $6.3 million in one-time upgrading costs and $2.2 million in annual maintenance costs.

"For the past three years, we’ve all had to stand in line again or mail it in because that (kiosk) program’s gone," Burden said.

Canadian skimmers did not restrict their fraudulent charges to Canadian license renewal machines.

Burden, who lives in Canada, said skimmers would frequently skim cards in Canada, then use the cards in the U.S. where the machines didn’t (and mostly still don’t) have EMV readers. He said he’s already had his credit card skimmed three times.

Skimmers focus on unattended card readers, said Burden, echoing Ingenico’s Burch. "I’ll be looking for merchants who are non-compliant to use that fraud card," he said, mimicking the mindset of a fraudster.

About Elliot Maras

---

Elliot Maras is the editor of Kiosk Marketplace and Vending Times. He brings three decades covering unattended retail and commercial foodservice.