Security & EMV

Payment Card Industry (or Payment Application) Data Security Standards, commonly referred to as PCI, are a set of regulations, standards and requirements put in place for the secure processing of credit and debit cards. All merchants that accept credit cards are required to meet these standards. The hardware and software you use to process credit cards, along with the security of your network, impact the scope of the standards that apply to your business as well as the difficulty in complying with those standards.

EMV stands for “Europay Mastercard Visa”.  EMV technology was first implemented in Europe  in 1995.  EMV cards have an embedded microchip that creates a unique transaction code each time the card is used. This sharply contrasts to a standard card with a magnetic strip that contains constant and unchanging data. You may also hear EMV referred to as Chip and PIN, but EMV cards are more likely to be used in a signature based transaction during the early stages of EMV rollout in the United States. EMV prevents a card from being physically duplicated, which protects the card brands and acquirers, but it does not protect against data breaches. Additionally, EMV has no bearing on the scope of PCI Compliance.

Otherwise known as End to End Encryption, E2EE virtually eliminates the chances of a data breach like the ones experienced by Target, Home Depot, and countless other retailers. With E2EE, when the card is swiped, it is encrypted by the hardware device and sent directly to the processor where it is decrypted for the first time. The only information returned to the POS system is an approval or decline, meaning there’s no credit card information in your POS system to be compromised. Additionally, E2EE dramatically reduces your scope for PCI Compliance.

Validated P2PE uses the same technology that E2EE does. It just takes it up a level.  The big difference is that Validated P2PE has been vetted and certified by the PCI Security standards council, validating all aspects of the credit card hardware, right down to the hardware serial numbers that you install in your store.  Validated P2PE is by no means a requirement. However, having a validated solution allows merchants to significantly reduce their scope for PCI Compliance. Many security assessors and IS departments prefer a validated solution.

Organizations qualified by PCI SSC as Qualified Integrator and Reseller Companies (QIR Companies) are authorized to implement, configure, and/or support validated PA-DSS Payment Applications on behalf of merchants or service providers for purposes of performing Qualified Installations as part of the QIR Program. The quality, reliability, and consistency of a QIR Company’s work provide confidence that the Payment Application has been implemented in a manner that supports the Customer’s PCI DSS compliance. You can learn more here.

**NOTE: QIR certification is critical for any POS provider to install, implement, train, and support credit card solutions in a PCI compliant retail environment.