US hotel industry preps for EMV D-day

D-day for the card transaction liability shift – the official start of EMV-compliant chip and pin transactions – is just weeks away in the US. The October deadline draws a line in the sand, whereby the liability for fraudulent transactions shift from bank to merchant.

There has been resistance from small merchants to adopting new hardware, and also some apathy from bigger players.  The hotel industry has been one of the sectors taking the lead and at the forefront of EMV adoption from an early stage, at least in the chain hotel sector.   

The reasoning behind this perhaps is a desire to reverse public assumptions that hotel point of sale systems are a soft target for fraudsters. That is certainly the case regarding the problem of malware attacks resulting in damaging data breaches, with Trump Hotels joining White Lodge and Mandarin Oriental in recent months.

The franchised management business model that hotels operate is an added complication but the big players have been long exposed to EMV compliancy through their international operations around the world where chip and PIN transactions are ubiquitous.

Individual hotels are generally responsible to upgrading PoS terminals to accept EMV compliant cards but many hotel chains are establishing nationwide brand standards.

"We are in the process of rolling out all new EMV-capable credit card readers as our brand standard.  Rollout is anticipated to be complete by September in time for the October compliance date," says Red Roof Inn chief information officer Jeff Linden.

Bernie Moyle, COO for Vantage Hospitality Group said it has ‘asked members to support the migration to EMV as soon as they can’.

The American Hotel & Lodging Association says the industry is getting its act together as the deadline draws near.

"While not every hotel will be in a position to change the system over by October, many more will have been able to accomplish that than we see today," said Maryam Cope, the trade group’s VP of government affairs.

"Making the change to EMV is not an overly complex effort, but it does require funding and time, both of which are always at a premium and need to be prioritized with other initiatives."

"The change also requires the coordination and cooperation of the merchant banks, suppliers, middleware vendors and installation providers, and managing all of these groups will be challenging given the short time frame."

P. William Smith, principal with Analytical & Information Services says prior experience of EMV migration can be invaluable.

"The hotel industry has known the standard is coming for some time, and in fact the global brands already embrace this technology standard in operations outside the US. Larger hotel brands that have prior exposure to EMV will be better prepared," Smith said.

What EMV means for the hotel industry

EMV stands for Europay, Mastercard, Visa. New chip credit cards are being rolled out to all cardholders which offer an extra layer of fraud protection using an individual PIN rather than an easy to replicate signature. The chip technology uses encrypted two-factor authentication which virtaully renders information useless to any hackers and protects the card from counterfeiting.

The payoff is that merchants are required to upgrade PoS terminals to accept chip and PIN transactions and post-EMV migration, the burden of fraud is transferred to the merchant.

However it is not the secret weapon to end all forms of card fraud as many people believe.  Chip and PIN technology effectively combats ‘card present’ scams – when the card is physically presented in person – but not ‘card not present’ transactions such as online bookings. In Europe when EMV compliancy rolled out, fraudsters simply moved online. This is most certainly to become the new battleground against fraud. It is something hotels need to be very mindful of, particularly as the industry in general is looking to promote more direct bookings away from third party platforms and traditional travel agents.