American Express, which says it will start issuing secure chip cards here in the United States later this year, has released a timeline for merchants to follow in accepting the new cards. Like every other network's roadmap, Amex sticks closely to the plan Visa announced last August.
With Amex's announcement, all four major card brands will require that most U.S. merchants, by October 2015, use terminals that can handle cards built with EMV chips.
EMV stands for Europay, MasterCard and Visa, which set the global standard for security chips embedded in payment cards. The technology, adopted already outside the United States, has caught on less quickly here because of the expense associated with the new payment terminals needed to accept EMV chip-and-PIN cards. But many, including regulators and card firms, want to push issuers toward chip-and-PIN technology to stem the rampant fraud in mag-stripe cards.
For merchants plugged into the payment system here in the United States, the penalty for missing the deadline for using the new terminals is a shift in the liability for fraud, though the card networks differ slightly in how they plan to enforce that.
Amex, like MasterCard, will assign liability to the party with the least secure technology-if an issuer supports EMV chip-and-PIN but the merchant supports a less secure form of EMV (or none at all), the merchant ultimately takes responsibility for fraud losses.
Visa's liability shift provisions require that merchants use "at minimum, contact chip terminals," putting less of an emphasis on which type of EMV security feature-PIN or signature-is used.
Fuel merchants generally will get an extra two years to comply with the new requirements.
Processors, meanwhile, will have to support the EMV standard by April 2013, Amex said. That October, Amex will allow merchants "relief" from certain parts of the Payment Card Industry data security standard if by that time they handle 75 percent of their Amex transactions through terminals that can handle EMV payments.
Visa originally stated that relief from PCI validation would come for merchants who accept 75 percent of Visa transactions through chip-enabled terminals by October 2012, but MasterCard set a 2013 deadline when it announced its roadmap roughly half a year after Visa's.
