The CO-OP Network, Ontario, Calif., and eFunds, Scottsdale, Ariz., say they have developed the hardware to satisfy MasterCard International's order that ATMs be equipped to handle new security triple data encryption standard (Triple DES) software by April 2005.
Developed by Pi Systems of Euless, Texas, and approved by MasterCard, the hardware and necessary software can be installed into most ATMs presently in use for anywhere from between $2,000 to $3,000, depending on the model, according to Scott Hughes, President of RMC Group, Lakewood, N.J.
"Machines that were built before 1992, or third generation ATMs as NCR calls them, are not upgradeable,'' Hughes said. "But they make up only a small percentage out there.''
He said ATMs built between 1992 and 1995 will have to upgrade their computer processors to handle the new fraud protection at a total cost of about $3,000.
Cost for a new machine runs about $25,000.
Credit unions with newer machines can expect to pay about $1,000 for the hardware and an additional $750 for the software.
Making The Switch
Many financial institutions, including credit unions, are already making the switch, Hughes said.
"That area of business is very active right now,'' he said, adding that about 50% of RMC Group's business comes from credit unions.
While the deadline is still a few years off, he said, a lot of processors are encouraging their clients to upgrade now. There are some, however, that are holding off in the hopes that something less expensive will be developed before the deadline, he said.
For ATM users, the new encryption standard means stronger security against fraudulent activity via new technology that scrambles PIN numbers three times during transmission from ATMs and point-of-sale locations to their final destinations. ATMs currently employ a Single DES capability, or a single scramble.
When MasterCard set the new standard, independent vendors initially claimed they could provide a fix with a simple computer chip and a few lines of additional computer codes.
Hughes, who said about half of his business comes from credit unions, agreed that an inexpensive chip could handle the Triple DES, but, so far, none have been produced that meet the credit card association's security standards.
"There are people out there who have said they can make this (encryption) occur in other places on the computer,'' Hughes said. But, "MasterCard and Visa said the actual transaction had to occur on the inside of the keyboard component.''
As far as he knows, no one has come forward with a chip that meets the requirements.
This technology was first developed by IBM in the 1970s to provide secure transmission of potentially vulnerable data. MasterCard's call for upgraded technology came when the processing abilities of computers overpowered Single DES encryption procedures. In 1998, an industry- approved DES-cracking contest saw a group called the Electronic Frontier Foundation create a world record by cracking the code in under three days using a specially developed computer, breaking the previous record of 39 days.
Federal agencies have already adopted the new standard.
MasterCard's schedule required that all Cirrus network ATMs installed or relocated as of April 1, 2002 be able to encrypt PIN entries using Triple DES. By April 1 of this year, all MasterCard member and processor host systems had to be be Triple DES compliant.
And, by April 1, 2005 all new and existing ATMS must meet the standard.
Full Compliance Not Expected
A spokesman at MasterCard reportedly said his company was conducting a survey to help anticipate how many members would comply, adding that while expectations were high, 100% participation was unrealistic.
"The development of this Triple DES technology is a prime example of the cooperative nature of the credit union industry and CO-OP Network,'' said CO-OP President-EFT Services Gene Polito. "MasterCard laid out some specific requirements to be fulfilled and after tapping the expertise of Pi Systems, we're pleased to help bring this product to the marketplace.''
Polito said one of the most beneficial aspects of this new hardware is that it replaces the non-encrypting pin pads in older ATM machines, which means longer life and less expense to CUs, many that earlier feared they would have to replace their machines to accommodate the new standard.
With more than 1,174 member credit unions, 16,000 surcharge-free ATMs and 14 million credit cardholders, CO-OP Network is the top ATM network in the U.S. financial services industry.
Its partner, eFunds, provides third-party processing services to 800 of CO-OP's CU members.
