How Ready Are They?

Now that merchants have had their EMV D-Day, it’s the turn of ATM owners and petroleum marketers. The compliance picture isn’t pretty. Here’s why, and what ATM deployers, c-stores, and others can do about it.

Another deadline for the great EMV migration has arrived. A year ago, U.S. merchants were expected to be ready to accept chip cards. Now, it’s ATM owners’ turn, at least for some debit cards, and petroleum marketers are due up in 12 months.

For this latest round of EMV-readiness MasterCard Inc. set a deadline for ATM owners of October 2016, one year ahead of Visa Inc.’s ATM deadline, Oct. 1, 2017. Visa’s choice of a 2017 deadline for ATM owners coincides with the deadline both card networks set for gas stations and convenience stores to have fuel-pump card readers EMV-compliant.

EMV is the global standard for credit and debit chip cards that takes its name from the card networks that developed it 20 years ago, Europay, MasterCard, and Visa. With each compliance deadline for ATMs and fuel pumps, liability for fraudulent transactions and chargebacks shifts from card issuers to ATM owners and retail fueling stations whose machines aren’t capable of accepting EMV cards.

Doing the Numbers

As was the case a year ago with merchants, the big question for ATM owners is how many are compliant and how many are not. While the exact figures won’t be known for months, 58% of ATM owners expected to have 76% to 100% of their machines compliant by year’s end, according to a survey conducted by the Sioux Falls, S.D.-based ATM Industry Association.

Additionally, 51% of ATM owners have upgraded more than half of their fleet, nearly double the number from a year ago, and 90% have begun purchasing components to upgrade their machines and replacement ATMs, ATMIA says.

While the figures for EMV-compliant machines are projected to improve considerably by the end of 2017—79% of ATM owners expect 76% to 100% of their machines to be complaint—that still leaves a lot of non-compliant ATMs in the market where fraudulent transactions can take place with counterfeit cards.

Nor is full compliance expected even after 2017, with 91% of ATM owners projecting 76% to 100% of the fleet to be EMV-compliant in 2018. Concerns that independent ATM owners with small and mid-size fleets would lag behind banks appear to be unfounded, the survey says, since readiness rates for independent ATM owners and banks are similar.

That’s a sunny picture, though, compared with the outlook for gas stations and convenience stores looking to upgrade their gas pumps. Less than 20% of convenience stores with pumps are expected to be EMV-ready next October, says Gray Taylor, executive director for Alexandria, Va.-based Conexxus, formerly the Petroleum Convenience Alliance for Technology Standards.

Among the 150,000 retail fueling sites in the United States, 125,000 belong to convenience stores, according to Chicago-based W. Capra Consulting Group.

Meanwhile, fuel pumps account for a healthy chunk of electronic payments. Of all fuel sales, 75% are paid for with debit, credit, fleet, and private-label cards, accounting for 12% of all U.S. card-based dollar volume, the consulting firm says.

Still, there are signs of hope that more fuel pump card readers than expected will be EMV-compliant by next October.

“While the percentage of gas stations and convenience stores that retrofitted their card pump readers varies widely by region and by type of fuel retailer, the industry has started moving rapidly on EMV hardware upgrades,” says Tomas Levi, co-chairman of the Petroleum Working Committee for the Washington D.C.-based U.S. Payment Forum and director for global payment strategy at Greensboro, N.C.-based Gilbarco Veeder-Root, a maker of fuel pumps and c-store equipment.

Budget Constraints

Nevertheless, expectations are that a substantial portion of ATMs and fuel-pump readers will not be EMV-compliant come Oct. 1, 2017.

The reasons vary. Cost is a frequently cited issue. Industrywide, ATM owners are projected to spend more than $1 billion to make their fleets EMV-ready, says David Tente, executive director USA for the ATMIA.

Cardtronics plc, a London-based (Houston-based until very recently) independent ATM owner that owns more than 41,000 machines in the U.S. and owns, manages or processes for nearly 200,000 globally, projects the cost of making the majority of its fleet EMV-ready in 2016 will be $10 million to $15 million, the company says in its 2015 annual report.

That amount is in addition to the cost of procuring EMV upgrade kits in 2015, which Cardtronics did not break out in its annual report. EMV-related expenditures are expected to continue into 2017, the company says.

All told, retrofitting an ATM for EMV compliance can cost as much as several thousand dollars after figuring in the cost of hardware, software, and service technician fees, payments experts say.

Cardtronics also expects it may incur increased charges from networks associated with actual or potentially fraudulent transactions and additional administrative costs to support the handling of an increase in disputed transactions.

Overall, ATM owners expect to replace about 20% of their fleets with EMV-compliant machines, compared to 13% a year ago, the ATMIA says. Breaking that figure down further, the ATMIA says independent ATM owners expect to replace 26% of their ATMs compared to 16% for financial institutions.

The cost of a replacement ATM can run as much as five figures, depending on the make, model, and functionality, payments experts say. A cash dispenser, for example, costs less than a full-function ATM that accepts cash and check deposits, dispenses cash, and links a cardholder to her bank accounts.

Not surprisingly, the hefty price tag for EMV compliance has given some ATM owners pause about meeting this year’s deadline. Thirty percent of respondents to the ATMIA’s survey cited budget constraints as a reason for delaying EMV compliance.

Yet, upgrading fuel-pump readers will be a much costlier proposition. Terry Mahoney, a partner with W. Capra Consulting, pegs the collective industrywide cost to convert fuel pumps at $4 billion to $6 billion.

The cost of converting a retail fuel site to EMV depends on a number of factors, including the site infrastructure and number, type, and age of dispensers. Most site operators will have two options, Mahoney says. First, dispenser manufacturers and other third parties have developed upgrade kits that add EMV capability to existing fuel dispensers. If their dispensers are compatible with these kits, the sites can add EMV capability outside at a cost of $20,000 to $30,000 for an average site, depending on the number of dispensers.

“Complete replacement of dispensers with brand-new EMV-capable models could cost $50,000 to $80,000 or even higher, depending on the age of their dispensers and related infrastructure,” Mahoney says.

Given the high cost, some ATM owners are likely to decide it makes more sense financially to just manage the fraud liability in the near-term, especially for aged, low-volume machines. Should the fraud losses become too great and compliance costs remain an issue, ATM owners can always opt to retire non-compliant machines and not replace them, payments experts say.

Six percent of respondents to the ATMIA survey say they will continue to operate non-EMV-compliant machines post deadline as is, meaning no upgrade or replacement, and another 4% say they will retire non-EMV ATMs without an upgrade or replacement post deadline.

“The question for ATM owners, and gas stations and convenience stores for that matter, is do potential fraud losses that occur from non-compliance outweigh the cost of an EMV conversion,” says Sam Ditzion, chief executive for Boston-based Tremont Capital Group, an ATM consultancy.

Some gas stations and convenience stores are expected to reach that decision. “Replacing card pump readers will be a cost higher than some station owners can sustain,” says Randy Vanderhoof, director of the Princeton Junction, N.J.-based U.S. Payments Forum. “Fuel-pump readers have a useful life of about 20 years and so are replaced less frequently than ATMs. I suspect the oil companies will provide some financial assistance for those that don’t convert to cover fraud losses.”

‘Usability Issues’

But cost isn’t the only issue. Further delays in EMV compliance are being caused by a shortage of EMV-certified software from processors to handle transactions made with EMV cards.

Among ATM owners, 24% of respondents say they do not have the necessary software from their processor and other transaction partners to handle EMV transactions, according to the ATMIA survey.

Even worse, as of August some ATM processors reportedly were not EMV-ready, and one major processor was expected to miss the Oct.1 deadline, says Tente, who declined to name the processors.

“Even if an ATM has been upgraded to accept EMV cards, if the ATM owner’s processor is not ready to accept EMV transactions, then the machine can’t accept EMV transactions,” says Tente.

Similar issues are hindering the petroleum industry. “The software specifications for fuel-pump readers were finally worked out about a year and half ago, which has led to a lack of certified software in the industry” says Taylor. “There were a lot of usability issues in the U.S. market that took longer than expected to work out.”

Zeroing in on Risk

Since fraud will naturally migrate to non-EMV-compliant ATMs and fuel-pump readers, just as it has to non-EMV-compliant merchants, one of the most effective steps ATM owners and retail fueling locations can take to lower their fraud risk, while coming into compliance post deadline, is to evaluate the risk profile of all their ATMs and card-pump readers.

“Identifying the highest risk locations and volumes those devices generate can help determine the risk factor and which locations to bring into compliance first to lower the risk of fraud,” says consultant Ditzion.

Community banks and credit unions, which reportedly lag the largest banks in upgrading their ATM fleets—the top 10 banks were expected to be near 100%, if not fully, EMV-compliant on Oct. 1, according to payments experts—can reduce their risk profile by identifying foreign transaction volume at each ATM and convert those machines with the highest percentage of foreign transactions first, says Jeff Irwin, systems manager for self-service solutions at Cummins Allison Corp., a Mount Prospect, Ill., provider of currency and coin-handling systems, and ATMs.

A foreign card transaction is made by a cardholder who is not a customer of the financial institution that owns the ATM. As a result, the ATM owner relies on the cardholder’s bank to authorize the transaction. Unless the card is on a blacklist or was recently reported lost or stolen, the card issuer is unlikely to deny authorization.

Foreign card transactions can be lucrative for financial institutions because the card issuer pays them interchange for each transaction and they can tack on a surcharge to the consumer.

Alternatively, on-us transactions, which are made by cardholders who are customers of the financial institution that owns the ATM, are considered lower-risk, since the ATM owner knows the cardholder, making it easier to spot and deny suspect transactions on those cards.

“The first ATM liability shift also applies to a smaller network of chip cards—[that is], MasterCard—which leaves ATM operators responsible for fraud costs on a lower number of cards,” Irwin says. “That could lead some ATM operators to believe they have limited exposure to counterfeit fraud liability and little incentive to upgrade. Visa’s liability shift will cover an additional 484 million cards.”

‘Not a Good Idea’

Some of the steps non-EMV-compliant gas stations and convenience stores can take to mitigate fraud include requiring the cardholder to verify the ZIP code on their billing address and keeping a blacklist of cards known to be counterfeit or reported lost or stolen.

“A large convenience-store chain running its own switch and using risk analysis might put tighter velocity checks and internal blacklisting into play,” Taylor says. “Counterfeit liability, in fact all liability, is controllable in other ways than EMV.”

One risk gas stations and convenience stores face with counterfeit transactions paid for at the pump is that criminals have been known to install a separate large gas tank on a vehicle, fill it up, and sell the gas on the black market. Even if the gas is sold below market price, the revenue earned is pure profit for the criminal since the product was fraudulently obtained, Ditzion says.

Even if managers take steps like these to manage the fraud risk for non-EMV-compliant ATMs and fuel-pump readers, criminals are sure to flock to those devices, as they will represent the path of least resistance to committing fraud, payment experts says. How long the holdouts will continue to tempt fate comes down to their financial wherewithal to absorb the cost of fraud and chargebacks.

“The fraud liability for non-EMV compliance is real and it will re-concentrate on non-EMV-complaint payment devices,” says Taylor. “For as many issues as there have been that have delayed compliance, being among the last to convert is not a good idea.”