PCI Compliance Kiosk & EMV Compliance

PCI Compliance Kiosk

Introduction

PCI Kiosk. It means different things to people. Are your kiosks PCI compliant?  EMV compliant? Is your kiosk or self-order application PA-DSS certified?  Odds are against it. For PCI it’s easy to check just by going to the Validated Applications section on the PCI site. EMV introduces Level 1, Level 2 and then Level 3 certifications. Call them Mechanical, Firmware and Application.  There is also a listing of devices (emvco.com).

Editor Note 2/16/2022 — PTS_PIN_Technical_FAQs_v3_Dec_2021 SPoC_Technical_FAQs_v1.8

Editor Note — 11/2021 – See the latest generation Ingenico Self series at NRF 2022 in our booth — NRF Kiosk Digital Signage – A Preview and Tips for Retail Kiosk Show

[do_widget id=rss-7]

EMV Kiosk Considerations 2021 Update

• You definitely don’t want to be using PCI Pin Transaction Security v3 (PCI-PTS v3), you can only deploy those through April of this year. You should be targeting PCI-PTS v4 at a minimum which can be deployed through 2023, or even better PCI-PTS v5 devices. You can continue to use the payment devices after these dates, you just have to be in the field before then. For more information contact UCP Inc.
• Is EMV required?  No, there are methods of payment such as Net-E-Pay which are supported by the major acquirers which utilizes a QR code for payment.  This form of payment sidesteps EMV. For more information contact Datacapsystems

But I don’t want to do that — Let’s list out some of Why Nots –

1. it costs money to do. You’ll need a QSA and that could be $75K easy.
2. it takes time.  Figure a year or a month depending.
3. It is inconvenient. It’s unnecessary regulation given our environment.  But it can come back to extract a heavy price in the future.
4. All of my transactions are so small and so many that the liability factor is low for any significant fraud rate.

PCI Kiosk Definitions

• PCI Level 1 Compliance — The Payment Card Industry Data Security Standard (PCI DSS) defines defines a “Level 1” merchant as one that processes at least 1 million, 2.5 million, or 6 million transactions per year, depending on which credit cards the merchant accepts. It is the highest, and most stringent, of the PCI DSS levels. Visa, Mastercard, and Discover define Level 1 merchants as those processing more than 6 million credit card transactions annually.
• How to Qualify — To comply with PCI DSS, Level 1 merchants and service providers must attain a yearly Report on Compliance from a Qualified Security Assessor (QSA) or Internal Security Assessor after an onsite audit. Those in levels 2, 3, and 4 may self-assess by filling out the PCI DSS Self-Assessment Questionnaire (SAQ) that the security standards council provides.
• EMV Compliance – EMV compliance means that a business has upgraded their point-of-sale equipment to feature credit card readers that support EMV technology (chip). If a customer walks into the store and is asked to insert their credit card into the slot on the machine, that store is EMV compliant. If the only option is to swipe the card via the magnetic strip on the back, the store in question probably isn’t EMV compliant.
• Is the device you are using Approved by PCI Security Standards Council?  Here is PTS search.

Affiliations

Participating Organization PCI Security Standards Council – The PCI Security Standards Council is an open global forum that is responsible for the ongoing development, enhancement, dissemination, and implementation of security standards for payment cardholder account data. The PCI Security Standards Council’s mission is to enhance payment account data security by driving education and awareness of the PCI Security Standards, which include the Data Security Standard (DSS), Payment Application Data Security Standard (PA-DSS), and PIN-Entry Device (PED) Requirements.

Member Resources

Here are kiosk association companies that have a primary focus on PCI compliance and EMV compliance. For in-depth questions we suggest contacting one of them.

• OTI Global
• Self-Service Networks
• UCP Unattended Payments
• DCAP Systems
• Ingenico EMV Readers

Useful Links

• UK-Finance-Contactless-Transit-EMV-Framework
• EMV Update for 2019
• Storm – informative paper on Pin Pad Accessibility. Download it here — Accessibility – Implications on Keypad Design by Steve Greenaway
• EPP Regulations — Regulations EPP Pin Pads- 2020
• Patent News – new patent on mounting removable POS interface device. Here is patent link.

PCI EMV Kiosk FAQ & Commentary

• • Q: So what about grandfathering devices like they do for ADA?  Can I delay?  A:  The only extensions that Visa/MC are making for the liability shift are for ATMs (2016) and fuel dispensers (2017) – all other merchants are open to the liability shift in 2015.
  • Q: What about someone like Redbox with thousands of machines with old credit card readers?  A:  Redbox may be looking at the cost of upgrading and comparing that against what they would be liable for after the “shift” – one guess is that the cost to upgrade would far outweigh the fraud on $1 payments.
  • Q: Are the banks going to charge me less for being EMV?  A:  One of the other dirty little secrets is that many banks are charging merchants EMV conversion fees to enable EMV acceptance at terminals. For some of the larger merchants, this alone would be some real money.
  • Q: So what costs am I looking at?  A:   The upgrade cost for these merchants would be – the equipment, field technician, software mods, PCI certification (yes – PCI is still required), bank setup fees, and all the other bits and pieces.

EMV Capable Card Readers, PIN Pads and Contactless Readers for Self-Service Kiosks