Page 42 - GS180402

Views

Keeping up with the will supplement its existing range of account numbers
(that now begin with the numeral 5), with a new range
card brands – EMV that begins with the numeral 2, to effectively double the
number of cards they can support.
and beyond This requires a software update for terminals or changes
to a BIN range configuration file or table. Some merchants
will require new hardware if their terminals are too old to
handle the software updates. Online payments sometimes
use an auto select feature based on the BIN so that the
customer doesn't have to enter the card brand; they will
need an update, as well. Mastercard set a deadline of
June 30, 2017, for merchants to be able to accept what it
has dubbed "2-series" cards, and has designed 2-series test
cards to validate terminals for compliance.

To spur compliance, Mastercard stated that an acquirer
may be subject to monthly fines for noncompliance, which
could amount to $100 per event for a small merchant. The
new cards will be issued this summer.
Eight-digit BINs

Payment processors have typically centered their Payment
Card Industry (PCI) Data Security Standard (DSS)
By Brandes Elitch compliance strategy on using PAN truncation to render
CrossCheck Inc. cardholder data unreadable. PAN truncation keeps the
first six and the last four digits, and destroys six digits,
he EMV (Europay, Mastercard and Visa) data so an attacker has a 1 in 100,000 chance of guessing the
transmission protocol has received significant original PAN. The proposal for an eight-digit BIN will
press over the last year, but the fight against change these rules.
T payment card fraud is just beginning. An
October 2016 article in The Nilson Report projects that card The possibility of an eight-digit BIN and a 16-digit PAN
fraud will grow 42 percent in the next three years, and could impact the software on every terminal, merchant
worldwide, fraud losses will approach $31 billion. website, processor and card processing network.

Problems include the delay of gas station EMV adoption, The prospect of eight-digit BINs raises significant issues
card skimming, data breaches, systemic problems with for back-end systems, analytics, databases and reporting
Card Verification Value numbers for online purchases, systems, and the cost of changing payment terminals
and "fallback fraud" occurring when an EMV transaction would be meaningful. The International Organization for
is processed via a mag stripe. Standardization (ISO) has a working group studying the
expansion of BIN numbers, and has suggested a move to
Members of the Electronic Transactions Association have eight-digit BINs.
been busy coming up with new ways to control fraud and
manage the enormous growth in cards. The American Currently, the six-digit BIN has two open slots (positions
Bankers Association reported that new credit card seven and eight) for customer relationship management
accounts are up 8.8 percent year over year, and the total data about cardholders and their transactions. This would
number of open card accounts is now 357 million. be lost, which would engender a major reengineering that
would create system-wide implementation challenges.
This article discusses several developments you will be
hearing more about later this year. The real problem is the way that card numbers are
allocated and the fact that the existing BIN ranges are not
Mastercard 2-series BINs being fully utilized. Currently, there are no immediate
The bank identification number (BIN) is the first six plans to adopt eight-digit BINs.
characters of a card number, also called a primary account Payment Account Reference
number (PAN). The card brands have seen increased
demand for cards due to tokenization, mobile wallets, When a merchant accepts a transaction that has been key-
replacement account numbers and prepaid cards. Each entered, swiped, or that is part of an ecommerce/card-not-
card brand has devised a proprietary solution. Mastercard present sale and then converts it to a token, the token needs

42