News
Testing takes on new importance with EMV evolution
With deployment of smart cards and ATMs to meet the new EMV specifications well underway in Europe and elsewhere, planning has begun for chip-enabled products and services that banks want to offer. With such radical changes in card and network functionality, a robust testing program is needed to ensure everything goes smoothly, writes Martin Macmillan, chief executive of Level Four Software.
March 3, 2003
EMV is an agreed standard, driven by Visa and the recently merged MasterCard and Europay, designed to ensure interoperability between chip cards and terminals on a global basis.
 |
Martin Macmillan |
Many industry players are eager for the EMV specifications to come into effect earlier than the much-publicized deadline of January 2005 (in Europe; deadline varies elsewhere. See related story Asia-Pac is leading EMV adoption) to help combat rising levels of plastic card fraud. As a result, in most European countries banks are in the process of rolling out the chip cards, ATMs and host switches required to support the EMV standard.
However, not all banks are ready for the monumental step change in functionality that comes with EMV. Old magnetic stripe cards and the functionality of ATM and point-of-sale networks haven't changed much since they were first introduced. It has been a stable, static network where the functionality has remained constant, so there is a risk that banks may become complacent over the introduction of a significant new technology into the network.
This won't be possible once EMV smart cards go live. Initial applications will cover payments, cash and accounts, and will be managed by the bank or card issuer. Subsequent applications on the card can be much more diverse, such as loyalty schemes, and these will likely involve joint ventures with the banks who are issuing the cards.
Up to speed with new apps
The future challenge for banks is how to deploy these applications quickly into their ATM networks where they can be accessed by customers. Picture the scene -- the bank's marketing team has struck a deal with a big supermarket chain to get a loyalty point scheme onto its bankcard. They have an agency lined up for it, and have a launch date in three months. They take it to the IT department who say: "Sorry, we can't do it. It will take months to create, and even longer to test."
In order to meet the ongoing and increasing pace of demands from business areas, banks need a framework where they can shorten the deployment cycle. Shortening the time it takes to test EMV applications and infrastructure is one of the best ways to achieve this.
When the first ATMs were deployed back in the early 1980s, the cash point was an added convenience for bank customers, rather than a mission-critical service. Today ATM and POS terminals have become a fundamental part of our daily lives, making customers far less tolerant of system failures.
Until recently, virtually all testing of the machines and network was performed manually. Today testing rooms still have real people and real cards and machines, but the smartest financial institutions have realized that an automated testing regime is a more efficient use of resources.
An automated system that creates virtual cards, and simulates all the components in the network -- from host switches to ATMs and the banking interface -- can provide fast, repeatable testing processes that involve the entire network from end to end. With such a system it is possible to perform sequential testing by simulating what happens on any of the components during a transaction, and to look at where errors have occurred in relation to other processes that the ATM or switch may have been conducting.
Some banks have estimated that with the move to EMV the number of tests required will multiply tenfold. Introducing the new chip card adds complexity to the dialogue between the card, the ATM and the rest of the network, so much so that it is almost impossible to test on a purely manual basis.
This will especially be the case when specifications change or new ones are introduced. This often happens at the later stages of testing, after practical experience in a pilot results in requests from users for minor modifications.
Therefore banks not only need the capability to run all the necessary tests, but they also need to be able to run them again quickly. Once specifications have changed, even if only slightly, all tests have to be conducted again, because Murphy's Law dictates that if you re-run 99 out of 100 tests it will be the last one that kills the system.
Taking into account the time and staff resources required for manual testing, it has been demonstrated that investments in automated testing for ATM networks can easily show a return on investment (ROI) in less than a year.
Once a bank has gone live with its chip card, it has to be confident the adoption by customers will be smooth. If a card encounters any problem on an ATM or POS terminal, or if there are any discrepancies or internal errors, it will shut down the chip and block access. This makes criminal activity much more difficult, but also means that if a bank had any errors in its system in a live situation, the customer's card would be blocked incorrectly. The card would need to be unblocked by special equipment at the bank, which is frustrating for the customer and embarrassing for the bank -- especially if the errors have affected thousands of customers.
The big picture
Among those banks that have progressed beyond manual testing, many are using testing tools provided to them by component vendors. A key problem with using testing software provided by an ATM or host switch vendor is that it tests components in isolation rather than as part of a wider network. Its testing tools are generally not designed for end users; product developers build them as part of the development cycle. They usually have no GUI or usability considerations and output test results in code or raw text, which is time consuming to evaluate.
Successful testing is not just a matter of finding a problem, it's fixing it too. It is easier to resolve a problem when your testing solution provides a visual view of the entire network. In a manual process or when using single component test tools, you have to determine the cause of an error by downloading the contents of the chip, by checking the status of the ATM and by determining what was happening at the host. This takes time. The quicker you can sort the problem out, the quicker you can move on to sorting out the next one.
Equally, if there are any errors in the product that the vendor has supplied, chances are that the same mistakes will also be replicated in their testing tools. A better approach is to use a third-party, independent testing platform that is designed to see the problem like the bank does -- across the whole network, rather than just the individual components.
If banks are going to take EMV seriously they should be investing in a complete testing solution, independent from any vendor, that can be customized and adapted to future developments.
Banks that leave things to chance on something like an ATM or POS network, which customers have come to rely on, will get burned. Testing is too important to be left to the customers.
The author, Martin Macmillan, is chief executive officer of Level Four Software Ltd., based in the UK. He has substantial experience in launching and managing technology businesses in the global financial services industry, having served as a director of UBS Warburg in both London and New York from 1994 to 2000. There, he participated in the development, launch and operation of multiple Web sites enabling commerce between UBS Warburg and its clients.
His company provides best-of-breed ATM test and development software to retail banks and ATM manufacturers. Level Four's key offering is the ATM Channel Development Suite, a suite of integrated modules that enable rapid development of new ATM applications and full end-to-end testing of ATM networks.
Level Four's clients include The Royal Bank of Scotland, Lloyds TSB and Abbey National. Level Four has offices in Dunfermline, Scotland and in London, England.
