MasterCard Inc. is urging ATM owners to add hardware for accepting chip-card payments. Those that don't may be faced with a higher level of liability.
MasterCard's plan affects inter-regional transactions on its Maestro network. The Purchase, N.Y., card brand sent a bulletin to top banks and ATM makers last week detailing the new requirements, which would take effect Apr. 19, 2013.
The liability-shift program is an extension of one already in effect overseas. The new deadline covers the U.S. and Asia-Pacific regions. Australia and New Zealand are also affected, but with a Dec. 31, 2015 deadline.
The purpose of the liability shift is "to align technology efforts to prevent and manage fraud," a MasterCard spokesman said in an email Wednesday. He would not provide a copy of the bulletin.
MasterCard's focus on the ATM should reduce fraud in a channel that is not directly addressed by Visa Inc.'s plan, which focuses on the point of sale. Visa says its merchants must accept chip cards that adhere to the EMV standard by October 2015 to avoid a shift of liability for fraud to the merchant's acquirer. In MasterCard's program, the liability would shift to the ATM acquirer under similar circumstances. Currently the card's issuer bears the liability for ATM and point of sale transactions.
Payment cards that use the EMV standard are commonly called chip-and-PIN cards for their most prominent security feature. In addition to a PIN, EMV cards can use encrypted and dynamic data to improve security for card-present transactions.
By focusing on the ATM, "MasterCard is going after a big point of pain for domestic and overseas banks," says Julie Conroy McNelley, a senior analyst for Aite Group.
However, MasterCard's move is not as far-reaching as it could be. "If it's just Maestro, it will have a less widespread impact in the U.S., as that is their tertiary brand here," she says.
Many other countries already require their credit and debit cards to use EMV chips. Fraudsters that are deterred by EMV often shift their focus to the U.S. to exploit the more easily compromised magnetic-stripe cards, she says.
Skimming causes average losses of $50,000 per affected ATM, and there is three times as much crime on debit cards than on credit cards, McNelley says.
MasterCard's program "needs to get done for EMV to be meaningful, it is a good thing they are requiring it. Visa should have too," says Avivah Litan, a vice president and distinguished analyst at the Stamford, Conn., market research company Gartner Inc.
MasterCard set an aggressive deadline for making the upgrade to EMV, experts say.
The ATM makers Diebold Inc. and NCR Corp. say they support MasterCard's move and they are ready to implement the changes immediately. Both say they received MasterCard's bulletin, and they already build EMV-accepting machines for international clients.
MasterCard "seems to be attacking the criminals' redemption [of cash] squarely where it belongs," says Chuck Somers, vice president of ATM security and systems for Diebold.
