The ATM Exchange Wins a Sweeping OK for its Security Product

A Cincinnati-based company that specializes in the repair and refurbishment of ATMs has won a comprehensive class of approval from Visa International for a device it invented to bring installed ATMs into compliance with new card-network security protocols. The approval from Visa means any older ATM incorporating the device will comply with the new rules without the need to replace the machine with a newer, compliant model. The ATM Exchange Inc. now expects to sell about 2,000 of the retrofit kits between now and Labor Day and about 2,000 a month thereafter. It has commitments for 6,600 kits and sees a potential market of 33,000, says Dave Parlin, president. The primary customers for the product, called 3DES Plus, are third-party ATM servicers, which re-sell it to ATM owners. The device sells to servicers for $1,600 regardless of volume, and re-sellers can apply any markup the market will bear, Parlin says. He adds installation fees generally run another $250. The ATM Exchange, which is also a servicer, plans to list the item at $1,950, less than one-fifth the cost of a new ATM. At the same time, nine electronic funds transfer network processors have either approved the device for use in ATMs hooked to their systems or will soon, says Parlin, including Shazam, Fiserv Southwest, Metavante, Star, and eFunds. The networks' approval is necessary before ATM deployers can install the upgrade. The ATM Exchange's product is the first such device for ATMs to win the sweeping class B approval from Visa, certifying that it meets the card company's technical security requirements, including those for so-called triple-DES encryption of personal identification numbers. Class B covers the numerical keypad for entry of personal identification numbers as well as the display screen and manufacturer's firmware, which is the code controlling the ATM's security functions. Visa's lesser Class C designation covers only the encrypting PIN pad, or EPP. Alarmed at the potential for criminals to crack conventional PIN security, both Visa and MasterCard have put in place stringent technical standards for ATMs, point-of-sale terminals, and other so-called PIN entry devices, or PEDs. Among these standards is a new requirement, popularly known as triple DES, calling for a more elaborate encryption protocol for cardholder PINs than has been the case up to now. The ATM Exchange introduced its new product to offer ATM owners a less costly alternative to swapping out their installed base of machines for new ATMs meeting the new standards. The new product, which incorporates technology from Sagem, a keypad manufacturer, and Thales e-Security, a maker of cryptography products, works in most models made by Diebold Inc. and NCR Corp.