POS systems offer different options when it comes to processing PIN-based debit and credit card transactions thanks to EMV. Merchants can enable and disable the PIN entry for PIN-based EMV cards allowing cardholders to make the decision whether to enter or bypass the entry of their PIN. Disabling or bypassing the security around PIN has various implications, which resellers, ISVs, and merchants should be aware of.
With US issuers (albeit, a small number of them) and most non-US issuers distributing PIN-based chip cards, any merchant that processes EMV transactions may receive a PIN-based EMV card. Majority of the time, the cardholder enters their PIN and the transaction just processes normally. However, there are a lot of merchants who are unsure on how to process PIN-based transactions in situations where inline tip (tip prompting) is not the most pragmatic choice. An example of this are restaurants that offer table service where the merchant does not have a pay-at-the-table terminal. In those particular situations, the POS application could be prompting for a PIN with the cardholder sitting at the table, leaving the merchant unsure on how to proceed. Beyond that, PIN-based transactions cannot be tip adjusted because that defeats the security advantages of a PIN. Merchants have been asking about the options that are out there to disable or bypass PIN entry in those certain cases.
Implications of Disabling PIN and PIN Bypass
Merchants have been told that they will be responsible for the chargebacks that are related to lost, stolen, and counterfeit PIN cards if they have not put an EMV solution into place. If a merchant has implemented an EMV payment solution but disabled PIN entry, then the merchant accepts all liability for lost or stolen frauds that involve a PIN-based EMV card. Although PIN-based cards represent only a small percentage of the overall EMV cards being used in the United States, advising ISVs, dealers, and merchants is crucial.
If a merchant has implemented a solution that asks the user for PIN entry on PIN-based EMV cards, then the liability falls on the issuer if the PIN is bypassed and the issuer approvers of that transaction. Bypass can be used to allow cardholders to opt out of PIN entry, informing the issuer that the PIN was bypassed on a PIN-preferring card. The intent behind this is for the cardholders that have forgotten or are not aware of their PIN. Merchants should be forewarned that this is not meant to be used as commonplace by the merchant nor their staff. For example, a traditional table service restaurant where the server is bypassing the PIN is not meant for PIN Bypass. When the PIN entry is bypassed, the issuer may decline that entire transaction. PIN Bypass is monitored through MasterCard for any and all misuses and abuses. The merchant could be subject to fines with prolonged usage.
Where to get more information?
The EMV Migration Forum has a whitepaper on liability shift scenarios and touches on PIN Bypass. It is important to understand the various scenarios that could occur. The white paper covers everything from liability shift scenarios to EMV chargebacks.
Sterling Payment Technologies
Sterling provides merchants with a complete range of electronic payment processing services, including credit, debit, PIN debit, fleet, gift card, and electronic benefits transfer (EBT).
Latest posts by Sterling Payment Technologies (see all)
- Experts Say Hurdles for Gas Pump EMV Conversion Are Worth It - July 4, 2022
- Mobile Payments Continue To Pick Up Steam - March 17, 2017
- Retailers Can Learn Lessons From Consumers’ Card Safety Concerns - March 7, 2017