Contact us. Or write to us at: Ulster Bank Ireland Limited Card Products Merchant Central Sales PO Box 6846 Dublin 2

Transcription

1 Contact us By phone on Monday to Friday 8am 8pm Saturday 9am 6pm Sunday 10am 4pm Bank holidays 9am 5pm (Calls may be recorded for training and security purposes) Or write to us at: Ulster Bank Ireland Limited Card Products Merchant Central Sales PO Box 6846 Dublin 2 merchants@ulsterbank.com Web: Ulster Bank Ireland Limited. Registered in Republic of Ireland No Registered offi c e: Ulster Bank Group Centre, George s Quay, Dublin 2. Member of the Royal Bank of Scotland Group. Ulster Bank Ireland Limited is regulated by the Financial Regulator. Calls may be recorded.

2 Your guide to PIN Safety in numbers After the 17 March you ll need your PIN to pay by Chip card

3 The countdown has begun to PIN not PEN OVERVIEW The way that your customers use their credit and debit cards at your terminal* is changing. You may have already experienced the changes as a result of the Industry-wide initiative to introduce Personal Identification Numbers (PIN), rather than signature as the cardholder verification method. Chip and PIN is now well and truly here with the majority of cardholders and retailers fully upgraded to the new technology. The process as it is now (if a customer has a chip and PIN debit or credit card, but they don t know or have forgotten their PIN) allows customers to use a signature to verify their transactions in some retail stores. This option to bypass PIN entry was originally introduced to allow customers time to get used to chip & PIN technology, however, now is the time to close this option. After 17 March 2007, to protect you and your customers from fraud, you should expect card companies to automatically decline payments if a PIN is not used with a chip and PIN card. This leaflet and the questions and answers section at the back should help you deal with most of your customer queries. WHY IS THIS HAPPENING The reason for introducing chip and PIN was to fi g ht rapidly growing levels of counterfeit, skimming and lost and stolen fraud which continued to grow at a rate of 30% year on year since the mid 90s. A study by the European card schemes Europay, VISA and MasterCard in 2002 suggested that credit card fraud would otherwise have esculated beyond control. Chip and PIN technology makes counterfeiting and fraud much more difficult and will help prevent the misuse of lost and stolen cards.

4 WHAT IS CHANGING The main difference after the 17 of March 2007, is that when a customer pays with their chipped card, the terminal* will now prompt for the customer to input their PIN (the same number they use to withdraw from the cash machine). The option to bypass the PIN and sign will be removed and cardholders must use their PIN to confirm purchases. EXCEPTIONS When the PIN bypass option is removed there will continue to be occasions where signature should be used as cardholder verification, e.g. Chip and Signature cards (Is an option provided to cardholders that are having diffi c ulty using PIN due to a disability. The chip and Signature card automatically prompts your terminal* to ask for a signed receipt rather than a PIN. Magnetic stripe cards - Some cards may not have upgraded to chip & PIN technology yet, or have been issued in countries not yet PIN capable. The magnetic stripe automatically prompts your terminal* to ask for a signed receipt rather than a PIN. Technical fallback will still be permitted after 17 March In other words if a merchant is unable to complete a transaction using chip and PIN due to technical fault e.g. faulty PIN pad, the cardholder will be allowed to sign for the goods/services. Similarly if the chip card reader fails, fallback to magnetic stripe and signature is also permitted subject to issuer authorisation. If you are unsure whether a PIN or signature is required you should swipe/dip the card into the terminal. The terminal will read the card and will instruct you to ask for a signature or PIN as necessary. (*When referring to terminal this statement applies to Bank owned chip & PIN terminals. For Non-bank owned terminals you should contact your supplier for specification.)

5 SECURITY With the introduction of chip & PIN, your terminal* will be more accessible to the cardholder and we would strongly recommend that you consider the security of your terminal. Criminals may attempt to steal or tamper with the PIN pad and/or the terminal believing that they can retrieve the PIN number and card details from it. Manufacturers have taken precautions to ensure that they cannot do so, but you should be prepared to safeguard your equipment from theft. For example, terminals which are not fixed should, where possible, be kept out of sight/locked away when not in use. Vandals may also try to damage the device particularly with unattended terminals. If you have security screens, you should consider how to prevent a thief walking off with the PIN pad. However you must ensure that by securing the terminal to prevent this, it does not impact on the cardholder s ability to use it. NON BANK OWNED TERMINALS If your terminal is not bank owned we recommend for you to contact your supplier to check if it is chip and PIN capable. (Ulster Bank supply upgraded chip and PIN capable terminals.) Some merchants who do not upgrade their terminals to chip and PIN can still accept signature. (Please note liability section.) If your machine is still not chip & PIN capable then you will need to be more vigilant as without chip and PIN technology you will be more prone to fraud. (Please note liability section.) LIABILITY Since 1 January 2005, a retailer that accepts a chipped credit card with a signature instead of PIN for a purchase that later proves fraudulent, will bear the cost. The same rule has applied to debit cards since 1 January Therefore after the 17 of March 2007 there will be no change to the existing liability rules. Therefore, if you have a bank owned terminal* and follow the correct procedure by asking the customer to insert their PIN rather than a signature, and if the transaction turns out to be fraudulent you will be protected from a chargeback, as this will be covered by the card issuer. It is important to note that if you complete a declined transaction or attempt to bypass a transaction when a PIN is asked for and the transaction turns out to be fraudulent, you the merchant will hold liability for the chargeback. If you do not have a bank owned terminal we recommend that you contact your supplier to ensure you are upgraded to chip and PIN capable technology, otherwise the liability rules may not protect you from chargebacks. (*When referring to terminal this statement applies to Bank owned chip & PIN terminals. For Non-bank owned terminals you should contact your supplier for specification.)

6 CARD ACCEPTANCE GUIDE Step by step guide to accepting a card for chip and PIN capable terminals* Whilst the majority of card payments you process will be with a PIN, there are a number of groups that will continue to sign to authorise their payments. To ensure there is no confusion or a chance of giving incorrect information to a customer, staff should not question the type of card that is presented by the customer. Instead they should always insert the card into the card terminal. The terminal will read the card and will request either a signature or a PIN. The following diagram shows the process your terminal will follow. All you need to do is insert the card into the terminal. Cashier/Customer inserts the card Chip and PIN card? No Yes Chip & signature card from a disabled cardholder Signature card from overseas cardholder? Old-style card from Irish cardholder (Magnetic stripe) Yes Yes Yes Dip Card Swipe Card Swipe Card Terminal requests a PIN Terminal requests a Signature Terminal requests a Signature Terminal requests a Signature Make sure that you and your staff are fully trained in line with the chip and PIN Best Practice Process: 1. Enter card into chip reader firmly 2. Enter the sales amount and press YES to confirm 3. If the card is chip and PIN the terminal* will prompt for a PIN 4. Invite the cardholder to enter their PIN on the pad 5. Encourage the cardholder to shield the PIN pad when entering their PIN 6. The terminal will authorise the transaction and issue a customer receipt 7. Remove the card and return to the cardholder along with the receipt (*When referring to terminal this statement applies to Bank owned chip & PIN terminals. For Non-bank owned terminals you should contact your supplier for specification.)

7 QUESTIONS & ANSWERS ALWAYS FOLLOW THE TERMINAL PROMPTS What is chip and PIN? Chip and Pin is a more secure way to pay with a credit, debit or charge card. In future a customer will simply tap in a four-digit number rather than signing a receipt. What is PIN? (Personal Identification Number) is a four digit code that is either assigned to or chosen by a cardholder to help prove they are the rightful owner of a card when making a transaction. What is chip? A microchip on a debit/credit card which stores a customer s card data more securely than the current magnetic stripe it is much harder to copy. What is PIN Bypass? Were a chip & PIN card meets a chip & PIN terminal, the card Chip is read but the PIN is not verified because the cashier takes a proactive step to bypass the PIN entry and ask for the customer to sign. (This is what is being turned off on chip and PIN capable terminals after 17 March 2007.) What are chip & Signature cards? Most cardholders with a disability find chip and PIN easy to use, but not all. The banking industry has therefore offered disabled cardholders a chip and Signature card. If a disabled customer presents a chip and signature card after the 17th of March 2007 you should insert the card as normal. The terminal* will then request a signature from the cardholder. Why are banks removing the option to bypass PIN Allowing signature on chip and PIN cards gives fraudsters a window of opportunity between the time they steal a card and the time the owner reports it lost or stolen, during which time they can claim they don t know the PIN and forge the signature. By getting all shoppers to use their PIN we can reduce this fraud. Will using a PIN take longer at the check out? The good news about PIN for both card holders and retailers is that PIN is faster than signature, so customers will spend less time queuing at the till. How will it work? The cardholder will key in their PIN (at the moment 4 digits long) at the point of sale rather than signing a receipt. The terminal at the point of sale will be able to check that the PIN entered is correct. As is done now, cardholders are required to check the amount before confirming the transaction by inputting their PIN. Are there any exceptions? There will be instances where cardholders do not have a chip and PIN card, and where a signature will still be accepted. Some disabled cardholders, for example, may use chip and signature cards. Customers from countries that have yet to upgrade to chip and PIN may not have a chip and PIN enabled card, your terminal* should prompt for a signature. Any customer using a non chip and PIN card will automatically be prompted by the terminal* to give their signature. Remember, as always, you need to undertake the usual security checks so that you are protected from any liability for fraud. Should I insist on PIN for all transactions now? You can continue to still accept a signature up to (and including) 17 March After this time, transactions may be declined by the card issuer if a PIN is not used with a chip and PIN card in a chip and PIN terminal*. To make the transition as smooth as possible you should communicate the change to customers now so they have time to prepare by finding out and memorising their PIN. A customer states they do not have to use PIN due to disability. Overall, chip and PIN will allow more disabled people to use cards than before. However, it will not suit everyone. Therefore some disabled cardholders will have made arrangements with their card issuer that they can still sign (this is referred as chip and Signature and when you swipe the card through your terminal it will request and allow a signature.) What should I do if the customer does not seem to know their PIN? If the customer does not seem aware that they have a chip and PIN card, does not know their PIN, or their PIN is locked, suggest that they contact their card company If a customer has diffi c ulty remembering their PIN, advise them to change it to a more memorable number at a cash machine.

8 What should I do if the customer states they do not have a PIN? If the customer states they do not have a PIN for their chipped card then they should contact their card issuer directly for one to be issued. If the card is not chipped the terminal* should not request a PIN and the customer can sign for the transaction. What should I do if the Customer has forgotten their PIN? If the customer has a chip and PIN card and does not know their PIN, then their card may be declined and therefore will need to provide an alternative method of payment instead. What should I do if the customer does not have a chip and PIN card? This change only affects chip and PIN cardholders. The customer can continue to use non-chip and PIN cards in all outlets, and you may follow the instruction on the terminal* for the customer to sign for the goods. Why do some shops ask customers to still sign for goods, but in your store they are requested to provide a PIN? A customer may have used their card in a shop that has not yet upgraded their terminal to chip and PIN equipment, and therefore they will need to ask for a signature. What does it mean if a customer s PIN is locked? This means that the customer may have entered the wrong PIN three times in a row when trying to make a purchase and the card is made temporarily unusable. The customer should contact their card issuer directly for assistance in unlocking it. What if a customer consumes/uses the goods before payment (e.g. at a restaurant or petrol station) and then they do not have a PIN or locked out? If you are in an industry where customers consume before they pay, it is particularly in your interest to encourage all your customers to know their PIN well ahead of 17 March If they do not use their PIN after this date, their card may be declined and you may need to ask them for an alternative form of payment. What should a member of staff do if a cardholder locks their PIN incorrectly at the till? The staff member should advise the customer that he/she can unlock it at most ATMs or by contacting their bank/card issuer. Does the merchant key in the PIN or does the cardholder? The cardholder must input the PIN (The cardholder should never disclose their PIN to anyone including employees of the bank or sales assistants therefore this should not be requested of the customer.) Do I have to upgrade my terminal to chip and PIN capable? If you have a Bank owned terminal you will not be required to do anything. If you have your own terminal or it is supplied by another company we advise that you speak to them as soon as possible to check that you are chip and PIN capable. Any merchant who is not chip and PIN capable will eventually provide a loophole for fraud and may become liable to significant costs as a result. (See Liability section.) What should I do to prepare for 17 March 2007? Train your staff give them this pack to read, and make sure they understand the changes. What will happen if I accept a card issued overseas with either PIN or signature? Overseas issued cards will be acceptable and your terminal* will provide messages to prompt you when accepting these cards. I accept mail order transactions, what do I have to do? There will be no change to these transactions for the time being. Please follow your terminal instructions for a customer not present transaction. I operate an e-commerce business, what do I have to do? There will be no change to these transactions for the time being. How can I encourage customers to use their PIN? From now on, encourage all customers to enter their PIN as a matter of course, so that the transition towards PIN Day is as smooth as possible. Always invite customers to enter their PIN when prompted. Do not ask them if they know their PIN as this will give them an opportunity to opt out of PIN entry. Ensure the PIN pad is suitably positioned to enable all customers to enter their PIN easily and securely. Most PIN pads can be picked up, swivelled or tilted and you should assist customers with this, if appropriate, to help them to enter their PIN in comfort and privacy. Special attention should be given to disabled customers, for example wheelchair users. (*When referring to terminal this statement applies to Bank owned chip & PIN terminals. For Non-bank owned terminals you should contact your supplier for specification.)