EMV PIN Debit – Common Questions and Problems
As the United States’ transition to chip cards crawls along, businesses are finding that debit card transactions aren’t going as expected. Some customers aren’t prompted for PINs when entering their debit cards, with the machine instead defaulting to signature debit. Why does this matter, and what can you do about it?
- EMV Debit vs. PIN Debit
- My new EMV terminal doesn’t require a PIN for debit – what’s the issue?
- PIN Debit vs. Signature Debit – Why it Matters
- Why can’t customers get cash back with a chip debit card?
- The Other Side – Required PINs and PIN Entry Bypass
EMV Debit vs. PIN Debit
First, let’s clear up some confusion about EMV debit and PIN debit. EMV debit cards function the same as previous magnetic stripe debit cards. Using an EMV debit card will deduct funds from a bank account, and requires entering a PIN or signing for a transaction.
EMV debit is not a new or separate category of debit card – it’s simply debit cards with a chip for increased security. The two main types of debit are still PIN debit and signature debit. As of spring 2017, there are no cost differences for accepting a chip debit card vs. a magstripe debit card.
My new EMV terminal doesn’t require a PIN for debit - what’s the issue?
In order for a terminal to prompt for a PIN when a customer uses an EMV debit card, both the terminal and the card must be configured to allow PIN entry. There are 4 main reasons why your machine may not prompt a customer for their PIN: the terminal is not set up with the common AID, the customer did not choose the common AID, the card is not PIN-preferring, or your machine does not have the correct injection keys.
Terminal Not Set Up with Common AID
The “common AID” (short for “application identifier”) communicates with the chip card and allows PIN debit transactions to take place. As of spring 2017, most terminals are set up with the common AID, which means that this is not likely the issue with your machine. However, if you have an older or uncommon machine, it’s worth checking with the manufacturer to find out if the common AID is supported.
Debit transactions utilize the “common AID” while credit transactions utilize the “global AID.” Some terminals may be configured to give the choice of common or global to your customer.
The Customer Did Not Choose the Common AID
At some businesses, customers inserting their chip debit card into a terminal are met with a screen asking them to select between two options, one labeled “US” and one labeled with the credit card company name, such as MasterCard or Visa. For example, if a customer inserts their Visa debit card, the screen may show a choice of “US Debit” or “Visa Debit.” What it is really asking is “common AID” or “global AID.”
Many customers, unfamiliar with the differences, select “Visa Debit” since they know they’re using a Visa card. Other customers mistakenly think that “US Debit” refers to benefits cards provided by the US government. If the customer doesn't choose US Debit (the common AID) they will not be prompted for a PIN.
What is US Debit vs. Visa Debit?
Selecting “Visa debit” means the transaction will “run as credit” – it will take place on the Visa network, the customer will authorize the purchase with a signature (if required), and there will not be an option for cash back. Since credit cards in the US largely don’t use PINs, the customer will not be prompted for a PIN for a transaction running on the credit card network, even though it’s a debit card.
Essentially, the choices “US Debit” or “Visa Debit” replaced the options “debit” and “credit” but function the same as the old terms.
“US Debit” is the option that uses the common AID. A customer would need to select “US Debit” to be prompted for a PIN. Make sure that if your customers want to enter a PIN and have a choice between “US Debit” and “[Card Company] Debit” that they choose US Debit.
The Card is Not “PIN-Preferring”
A less common reason that debit cards may not prompt for a PIN is that the card is not a “PIN-preferring” card. Banks that issue debit cards can set preferences on how the card should be authorized. The bank can decide that a card is “PIN requiring” (meaning it will decline or the transaction will be cancelled if a PIN is not entered), “PIN preferring” (meaning that it will first ask for a PIN but if the PIN is not entered, it will ask for a signature), or it can be “signature preferring” (meaning that it will ask for a signature first.)
PIN-requiring cards will not process at all if a PIN is not entered. If your customers’ transactions are cancelled without giving an option for signature, their cards may be PIN-requiring. If your customers’ transactions prompt for a PIN but give the option to sign for the transaction instead of entering a PIN, the card is “PIN-preferring.”
If your terminal prompts some customers to enter a PIN and not other customers, and your customers are choosing “US Debit,” pay attention to the bank that issued the card. Does your machine never prompt for a PIN for Bank of America cards, for example? This may give you insight into whether particular banks are responsible for the lack of PIN prompt.
The Terminal Does Not Have Proper Injection
There are two different types of chip-and-PIN: cards where the PIN is stored on the chip, and cards where it is not. If a PIN is stored on the chip, injection keys aren’t needed. If the PIN is not stored on the chip, injection keys are needed.
If you purchase a machine through a company other than the processor that handles your transactions, you may not have proper injection keys. Businesses that purchase terminals from other businesses, online retailers, or auctions may not be set up with the right injection keys.
Contact your processor to determine if your machine has the correct injection keys needed to accept PIN debit. Note that if your machine requires injection from the processor, you’ll typically need to send the machine to the processor, as remote injection is not currently possible.
If you’re buying a new machine or upgrading to be EMV compliant, it’s a good idea to consider purchasing from the processor you work with to ensure that it will arrive programmed correctly and with the correct injection keys for accepting PIN debit.
PIN Debit vs. Signature Debit – Why it Matters
We cover the differences in PIN vs. signature debit more thoroughly in the related article linked below, but the short version is that PIN debit and signature debit transactions take place on different networks and may have different costs to process. Walmart sued Visa over routing and debit card costs, and that battle is still playing out.
However, there’s a common misconception that debit cards are treated like credit cards if they’re “run as credit.” A debit card is always a debit card; running “as credit” simply means that the transaction will take place on the credit card network instead of the debit card network.
A PIN debit transaction is one that is authorized by a customer entering their PIN at the time of sale. A signature debit transaction is authorized by a customer signing for the purchase.
Currently, the Durbin Amendment caps interchange for regulated debit cards – cards issued by a bank with $10 billion or more in assets. This cap is in place for both PIN and signature debit cards. Non-regulated debit cards are charged according to either PIN debit network fees or the credit card company’s debit interchange.
As a rough rule of thumb, signature debit transactions are less expensive than PIN debit for businesses with smaller average tickets. PIN debit transactions are less expensive for businesses with larger average tickets.
Related Article: PIN Debit vs. Signature Debit.
Why can’t customers get cash back with a chip debit card?
Customers can get cash back as they always have if they use a debit card authorized with a PIN and your business has enabled cash back. If your customers don’t see an option for getting cash back when you’ve previously offered that choice for debit transactions, the most common reasons are:
- The customer selected “Visa Debit” or “MasterCard Debit”
- Your terminal is not set up to accept PIN debit chip cards
- Your terminal is set to not require PIN or signature for small transactions
The ability to accept a card without requiring a PIN or a signature is called “no verification method” acceptance. Some businesses choose to implement this option for small transactions in order to keep lines moving, but it’s not without risks. Note that the actual dollar value of “small transactions” can vary. Typically, a no verification transaction will not allow for cash back at the time of sale.
If you’ve asked your customers to select “US Debit” and they enter a PIN but still don’t see the option for cash back, you’ll need to contact your processor for assistance.
The Other Side – Required PINs and PIN Entry Bypass
The flip side to terminals that don’t prompt for PINs is terminals that don’t allow PIN entry to be skipped. Skipping the step of entering a PIN is called “PIN entry bypass” and allows a customer to skip entering their PIN even though the terminal prompts for it. When the customer skips entering their PIN, the transaction will be “run as credit” and they may need to sign for the purchase.
As of spring 2017, most terminals can support PIN entry bypass, but banks can choose to require PINs and disallow bypass on the debit cards that they issue to their customers. Additionally, businesses can choose to require PINs when a customer uses a PIN-enabled card. In either of those situations, attempting to bypass PIN entry will result in a declined or cancelled transaction.
If you’re having problems with your new EMV machine not asking for PINs on debit or not permitting PIN bypass, check with your processor to ensure everything is configured correctly, paying special attention to the common problems detailed in this article.