The Other Chip Card Conversion

ATM deployers still have more than 18 months to get ready for EMV. Will they make it?

Credit and debit card issuers are furiously pumping out hundreds of millions of EMV chip cards this year. And stores are busily retrofitting their checkout lanes to accept them. Often overlooked in all of the hullabaloo, however, is another big smart card switchover.

This one involves the 400,000-plus U.S. ATMs, which are supposed to be able to accept EMV cards by Oct. 1, 2016. The obvious question is: Will the machines be ready?

The answer, as of late winter 2015: many, but certainly not all. ATM industry consultant Sam M. Ditzion, chief executive of Boston-based Tremont Capital Group Inc., predicts that the “vast majority” of financial institutions’ ATMs will be EMV-capable when the so-called liability shift hits Oct. 1 of next year, but “a significantly lower percentage” of ATMs owned by independent deployers will be ready.

“Not everyone is not going to make that decision to upgrade,” says Ditzion. “There are going to be people who say the risk is not that great, or not great enough to justify the cost of upgrading to EMV, at least for the time being. That might be on a per-ATM basis.”

ATM deployers, card issuers, merchants, and merchant acquirers are working against deadlines set by the two biggest card networks to bring the U.S. into conformity with most of the rest of the world, where EMV payments are well established.

MasterCard Inc.’s multifaceted EMV “roadmap” set the October 2016 ATM liability shift, which means that if a machine can’t read an EMV MasterCard card by then, liability for any resulting counterfeit fraud is assigned to the ATM acquirer.

Visa Inc. set the October 2015 liability shift for point-of-sale payments. That deadline, naturally enough, is getting considerable media attention. Not only does it arrive sooner, but it also involves the re-issuance of about 1 billion magnetic-stripe payment cards and new or upgraded chip card readers for, potentially, about 8 million merchants.

(Visa also has an ATM liability shift set for October 2017, but given that most ATMs accept all general-purpose cards, deployers are working against MasterCard’s deadline.)

‘The Very Last Minute’

An indication of the extent of ATM preparations comes from a late 2014 survey by the Sioux Falls, S.D.-based ATM Industry Association, a trade group of ATM independent sales organizations and retail ATM operators.

Sixty-one percent of 118 respondents said that 76% to 100% of the ATMs they operate would be ready for EMV transactions by the end of 2016. Only 2% said none of their machines would be ready, while just 5% said 1% to 10% of their ATMs would be.

In related findings, 21% of respondents said 76% to 100% of their machines currently were ready for EMV. Some 20% of respondents said none of their machines were ready while 33% said only 1% to 10% of them were.

“I was pleasantly surprised, I really thought there had been some solid progress made [but] the level of that progress was surprising,” says David Tente, executive director for the U.S. and Latin America at the ATMIA.

The ATMIA polled members as well as non-members, and its findings stand in sharp contrast to deployers’ readiness for an EMV liability shift that took place in April 2013, when only 12% of ATM operators had machines deployed that were capable of accepting EMV cards. That shift affected counterfeit transactions involving foreign cardholders using MasterCard’s Maestro-branded cards at U.S. ATMs.

Of the 118 responses the ATMIA received, 59% came from independent ATM deployers and the rest from banks and credit unions. Two-thirds of the financial-institution respondents operate less than 100 ATMs, but a few had fleets of more than 5,000 machines. Some 44% of the ATM ISOs operate 101 to 500 machines.

While the vast majority of ATM operators have begun preparing for the liability shift, what Tente calls a “core group” of about 20% of respondents has yet to do anything. Those tasks include performing hardware and software audits of ATM fleets to determine readiness, staff training, consulting with vendors, and purchasing upgrade components or entirely new, EMV-capable machines.

“One of the independents was very honest about it—they were waiting until the last minute, the very last minute,” says Tente.

POS terminal makers and card manufacturers are seeing EMV-related orders pour in this year, leading to some fears about production backlogs, especially of plastic cards. Some 57% of the ATMIA’s survey respondents also said they were very or moderately concerned about delivery delays or potential shortages of EMV hardware, software, or other resources, including field technicians to work on ATMs.

The XP Tailwind

Still, ATM deployers have several factors working in their favor that could make for a less frenetic EMV conversion than the issuer and merchant cases.

“Generally on the ATM side it has been a much more staggered rollout, you can do your hardware without doing your software,” says Michelle Thornton, manager, core products, at Co-Op Financial Services, a Rancho Cucamonga, Calif. credit-union network with 36,000 ATMs. “I don’t think we’re going to see the same bulge on the ATM side that we’re going to see on the card side.”

This staggered rollout in part is the result of the deadline, which gives ATM deployers a whole year longer than POS merchant acquirers before liability transfers to the non-EMV-capable party in a card transaction. Another reason is the fact that the major ATM manufacturers have all been producing EMV-capable machines for the U.S. market for several years.

“For all intents and purposes, every ATM that we’ve introduced into the marketplace since 2010 has had EMV-compliant hardware,” says Owen Wild, director of security marketing at Duluth, Ga.-based NCR Corp., the leading U.S. ATM maker. Wild also notes that NCR has considerable experience with EMV thanks to its foreign operations.

“Doing business in 180 countries, this isn’t anything new for us,” he says.

James Philips, vice president of sales and marketing at Long Beach, Miss.-based Triton Systems of Delaware LLC, says that in 2014, “the percentage of [Triton] machines with EMV card readers was growing—80 to 85%.” Triton’s customers are mostly off-premise retail ATM deployers, but the company also sells ATMs to community banks and credit unions.

Adds Dean Stewart, senior director, self-service product management at North Canton, Ohio-based Diebold Inc.: “It’s probably a safe bet to say everything going into the U.S. is ready.”

Another reason for this perceived readiness for EMV is a tailwind for chip cards created by the recent upgrade of most ATMs’ operating systems from Microsoft Corp.’s old Windows XP operating system, which the giant software maker stopped supporting last year, to newer systems, usually Microsoft’s Windows 7 (“April Fools?” March, 2014). Many deployers embarked on their EMV conversions simultaneously with their Windows 7 upgrades.

“A lot of credit unions took the opportunity to upgrade,” says Thornton.

‘Calories of Manpower’

ATM owners have several options in upgrading hardware for EMV. If a deployer’s replacement cycle calls for a new machine at a particular location, the new one very likely will have an EMV chip card reader. An older but still serviceable ATM may get an upgrade kit that includes a chip card reader. And some deployers, depending on their budgets and risk tolerance, may elect not to do any upgrades.

“Others are still evaluating whether they want to do this to any or all of their ATMs,” says consultant Ditzion.

Card readers probably will not be an issue as 2015 melds into 2016. But an EMV-capable ATM needs the proper firmware and software, including the so-called “kernel,” which gives the reader the ability to read and communicate with an EMV card’s chip. After software downloads, the entire system then must be certified and activated before an ATM can actually perform EMV transactions.

Diebold’s Stewart cautions against deployers thinking they’re over the hump once the reader is installed. Acquirers, along with issuers, will have plenty of testing to do before they can ascertain that their ATM fleets are ready for EMV.

“Around here we have an expression, ‘It’s just software, how hard can it be?’” says Stewart. “The point I’m leading up to is there has to be an end-to-end functionality. There’s a lot of calories of manpower being spent on that right now.”

He adds: “I think the underlying value of all that is to try and create something as bulletproof as possible so when the consumer comes up to make a transaction, it will work.”

Needless to say, all of this is going to cost deployers money. Exactly how much is unclear, but 34% of the ATMIA’s survey respondents expressed concerns about budgetary constraints.

An upgrade kit, including software, for a full-service, bank-owned ATM might cost thousands of dollars, and $250 to $700 for a retail ATM, according to Philips. But the incremental cost of a new ATM with an EMV card reader is only nominally greater than the cost a new machine with a mag-stripe reader, according to Ditzion.

Leading retail ATM network owner and operator Cardtronics Inc. disclosed in February that it plans to spend $20 million this year on EMV upgrades to its U.S. fleet, which includes 30,323 company-owned machines.

Houston-based Cardtronics declined to make an executive available for an interview with Digital Transactions, but said in an emailed statement that “Cardtronics has established an EMV implementation roadmap and we are actively working to upgrade all of our ATMs to enable EMV acceptance in time for the liability shift in October 2016. It will be a challenging journey, but we are confident of meeting the 2016 deadline.”

‘Brand Risk’

After all the hardware and software is installed and tested comes consumer education about using chip-enabled ATMs. Cardholders will enter a PIN like they do with mag-stripe cards, but they’ll be “dipping,” or inserting, their cards into the machine and leaving them there briefly. The changes will call for new screen prompts, according to Marcelo Castro, a principal product manager at Diebold.

While ATM executives expect consumers won’t be stone cold about using chip cards because of the POS conversion, “at the beginning, I’m sure you’re going to have some confusion,” says Castro.

EMV chip cards are highly effective at reducing counterfeiting as well as lost-and-stolen card fraud, but such crimes amount to less than half of all card fraud. And in some EMV countries, counterfeiting is making a comeback because criminals are stealing card data from the back-up mag stripes on most chip cards and using that data to make fake cards.

Still, the EMV train is now rolling in the U.S. Despite the cost of upgrades and the uncertainty of getting a full return in the form of reduced fraud, deployers are acting, knowing they could see their reputations diminish in the eyes of consumers if their ATMs don’t accept chip cards within a couple of years.

“There’s some real brand risk to institutions that are viewed as not taking security as seriously as their competitors are,” says Ditzion.

Consumers, adds Philips of Triton Systems, “will be looking for EMV ATMs.”