America: EMV Payment Card Industry Standardization

Author: R.B.

America: EMV Payment Card Industry Standardization

Unfortunately for the American Payment Card Industry (PCI) infrastructure, the mandated adoption of the Europay, MasterCard, Visa (EMV) standard is futile of addressing the critical deficiencies of the de facto requirements, by the Payment Card Industry Security Standards Council (PCI SSC), protecting sensitive data in memory, transit or at rest. Therefore, PCI key players: such as cardholders, merchants, acquirers, and issuers alike must continue to stay vigilant of the risk by threat agents attempting to exploit vulnerabilities in the payment processing system in order to extract unauthorized sensitive data or information.
First, EMV is a two decade old technology standard that originated in Europe in the early 1980’s. Its primary objective is to address fraud that results from extracting card issuer and cardholder data that is encoded on a magnetic stripe (Track1 and Track 2) on the backside of debit and credit payment cards.
Second, while it can be argued that the EMV technology standard has its pros, such as providing a single payment card a mechanism to sustain multiple applications. The implementation of the EMV standard does not address many of the critical issues or methods used to extract Track 1 and Track 2 data in the card payment transaction stages. Such as, vulnerabilities in payment applications and devices or encryption methods of data in memory, transit, or at rest.
Lastly, the implementation of the EMV standard comes at a cost to all the key players mentioned above. For example, debit cardholders will no longer be required to enter a Personal Identification Number (PIN) at Point of Interaction (POI) devices, thus, eliminating a form of security by a multi-factor authentication method. Merchants are susceptible to a