Nonstop Upgrades

The ATM EMV conversion is only partly done, and now deployers are beginning preparations for Windows 10 only a few years after upgrading to Windows 7.

ATM deployers can take solace in the fact that their EMV upgrades are going faster than merchants’ conversion to chip card acceptance. But lest they rest on their laurels, deployers soon will need to replace their operating systems due to the impending cessation of support for Microsoft Corp.’s Windows 7, the industry’s dominant operating system.

The back-to-back upgrades are the latest in a continuum of technological changes stretching back more than a decade that are meant to keep ATMs up to date with the latest security and operational features. But they have deployers feeling a bit exasperated.

“There’s a lot of stuff going on,” says David Tente, executive director for the U.S. and Latin America at the ATM Industry Association.

Technology upgrades have been a fact of ATM life since the machines first appeared in the late 1960s. But since 2006, deployers have had to cope with the sunsetting of IBM’s OS/2 operating system, which dominated the ATM industry, and its replacement by Microsoft systems. Around that time, the Triple Data Encryption Standard, or 3DES, came in for added security.

Now the immediate issue is EMV, the chip card standard promulgated by the global payment card networks to replace magnetic-stripe credit and debit cards, which are especially vulnerable to data thefts. In October of 2015, the networks rolled out their so-called liability shifts for the U.S. point of sale, meaning that a merchant that could not accept chip cards would be liable for any resulting fraud from counterfeit cards.

Big Banks Are Done

The same concept applies to ATMs: deployers will bear the cost of counterfeit fraud if their devices can’t read a chip card. Mastercard Inc. and Discover Financial Services’ Pulse electronic funds transfer network set ATM liability shifts for October 2016 (Mastercard delayed its shift for about three weeks from the originally planed Oct. 1), while Visa Inc. and most of the other EFT networks have scheduled corresponding liability shifts for this coming Oct. 1. But since nearly all ATMs accept Mastercard cards, most deployers worked against the 2016 date.

Mastercard was in the ATM EMV game early, having instituted a U.S. liability shift for its Maestro debit card—a big brand in Europe—in 2013. The shift affected the comparatively few ATMs used by a large number of foreign visitors. Also that year, the company provided “tens of millions” of dollars in funding for early EMV adopters, according to Bruce Owens, Mastercard’s vice president of product for the North American ATM channel, declining to give numbers.

Converting an ATM fleet to EMV acceptance can involve anything from installing a chip card reader and activating the required software to replacing the entire machine if it is too old to support EMV technology. Most new U.S. ATMs have been enabled for EMV for years now, although it is up to the deployer to turn it on.

More than half of the nation’s approximately 450,000 ATMs can now accept EMV cards, according to Mastercard and ATMIA, a trade group of mostly retail ATM deployers and independent sales organizations that has offices in Sioux Falls, S.D., and London.

“We look at true chip transactions that are coming from terminals,” says Owens. “Right now, at the end of the first quarter, we’re somewhere around the 60% conversion rate in the United States.” What that means is that 60% of ATMs are sending “chip transactions in some form or another,” he says.

Most banks have completed their ATM EMV upgrades, according to Owens. “All the big banks have converted,” he says. Credit unions got off to a slower start, “but they’re getting caught up,” he adds.

ISOs and merchants control in the high-50% to 60% of the nation’s ATMs, according to ATMIA.

“The retail outlets are a little behind,” says Owens. But he notes that some big non-bank ATM deployers such as Houston-based Cardtronics plc have largely converted.

About a year ago, ATMIA surveyed its U.S. membership and found that 58% of respondents said they would have the majority of their upgrades done by the end of 2016, according to Tente. And 79% of respondents predicted most of their upgrades would be done by the end of 2017. “Bottom line, the [2016] number we had pegged seems to be pretty accurate, which makes me happy,” says Tente. “Hopefully, the number we had pegged for 2017 will be pretty accurate.”

Owens says financial institutions generally have gone along with the network-led EMV conversion, but Mastercard did get more protests from retail deployers. “Now the ISO community is a different mindset,” he says. “I wouldn’t say we didn’t get any push-back.”

‘We’re Doing Pretty Well’

Despite that, the pace of the ATM conversion appears to be ahead of that at the point of sale. About half of bank card purchase transactions are coming from chip cards used at live EMV terminals. But some merchant sectors, such as hospitality, have had problems getting EMV rolled out. And the card networks in December postponed their planned October 2017 EMV liability shifts for automated fuel dispensers until 2020 after hearing complaints from petroleum retailers about the costs and operational problems of bringing EMV to gas pumps.

“Compared to the merchant side, we’re doing pretty well,” says Tente.

Reliable numbers on the cost of the ATM EMV upgrades are hard to come by because there are so many variables involved, including the age of the ATM, its software and features, its ability to be upgraded, and the cost of sending a technician out to do the job. On the low end, an upgrade kit might go for $300 to $500, and beyond that, conversion costs might run into several thousands of dollars.

“It just depends on what you have and what you’re starting with,” says industry consultant Sam M. Ditzion, president and chief executive of Boston-based Tremont Capital Group Inc. Adds Tente: “I’m hearing a lot in the $1,000 to $1,500 range for cash dispensers.”

Cardtronics, which owned nearly 45,000 ATMs in the U.S. as of Dec. 31 and managed many thousands more, did not respond to a Digital Transactions request for comment. The company said in its 2015 annual report that its planned capital expenditures for EMV in 2016 would be $10 million to $15 million, and its 2016 report said spending would continue into early 2017.

Industry executives predict a decline in the number of ATM deployments once all the networks’ liability shifts take effect because owners will decide the costs of upgrading or replacing some old machines are not worthwhile. But exactly how much shrinkage looms is a matter of guesswork. Owens estimates 5% to 6% of the current base. “There are some ATMs in the market that are going to disappear because of EMV,” he says.

Tente goes somewhat lower, saying about 4% of ATMIA’s survey respondents indicated they would retire old machines rather than upgrade them.

Owens predicts that about 75% of ATMs will be EMV-capable by year’s end, which will make the remaining non-EMV machines juicy targets for fraudsters. That’s not too far off of ATMIA’s prediction of 79%, and the high number will force deployers to upgrade or remove most remaining non-EMV machines. “The risk is too great to be exposed,” Owens says.

Risk Assessments

But some deployers are likely to take a chance and retain but not upgrade a few ATMs in low-risk locations. Consultant Ditzion says the ATMs most likely to be replaced or upgraded are in big cities, especially urban areas such as New York and Miami, that get many international visitors and tourists and have high volumes of foot traffic. Those and other variables are associated with risk, he says.

“The reality is there is much higher risk in certain markets and much lower risk in some markets,” he says. “If you go to a bank branch in Montana, it’s highly unlikely someone would target this type of fraud.”

In combination with chip card acceptance at the point of sale, the ATM EMV conversion should soon be making a big contribution to reducing counterfeit fraud, Owens says. In Canada, where chip cards had about a five-year headstart on the U.S., counterfeit fraud from ATMs and the POS is down by 80%, he says. And in Brazil, which also converted before the U.S., fraud is down by 70%.

But if ATMs and stores are harder to steal from, fraudsters will simply ply their trade elsewhere, especially on the Internet, where payment card fraud already is rising (“The 10 Most Pressing Issues in E-Payments,” November, 2016).

As they head toward the finish line with EMV, ATM deployers are now turning their attention to their machines’ operating systems. Today, most run Microsoft’s Windows 7, while lower-end cash dispensers run Windows CE. Microsoft has announced that it will end support for Windows 7 in January 2020, by which time most deployers will have adopted the newer Windows 10. Support for CE is going away too, but not until 2023.

In late March, ATMIA issued a position paper urging its members to begin preparing for the transition “as soon as possible.” In early April, the association published a paper about Windows CE alternatives.

Tente says he wants to avoid the crunch many deployers experienced in the transition from Windows XP to 7, when some found that required software was not available until late in the conversion. Microsoft ended support for Windows XP in April 2014. “It just means people should really start to think about what their plan should be,” says Tente. “We’ve been saying that for at least a year.”

‘Frustrating Issue’

Not everyone is expected to go with Microsoft systems, according to experts. Some deployers will use Linux-based systems, and leading ATM manufacturer NCR Corp. has a cloud-based system that uses Alphabet Inc.’s Android system.

But the end of support means Microsoft will no longer provide patches for Windows 7 security flaws, and fixing other problems will be up to users.

“It’s a frustrating issue for ATM operators,” says Ditzion, noting that some deployers continued to use Windows XP long after that system’s support sunset because it was working just fine for them. As a result, “We’re still in this Windows XP migration,” Ditzion laments.

In April, North Canton, Ohio-based Diebold Nixdorf Inc. claimed it was the first ATM manufacturer to support Windows 10.

“This is certainly a huge undertaking for deployers, which is why this has been a priority for Diebold Nixdorf so we can enable our customers to have the most amount of time to orchestrate their migration plans and transition in advance of the 2020 deadline,” a company spokesperson says by email.